AppArmor breaks seccomp @ Apache mpm-itk

[Andrew Lewis]

Tested on Ubuntu 14.04 only- unsure about status on other platforms. MPM-itk features a seccomp filter that tries to see that parameters passed to setuid() are acceptable in order to hopefully prevent the application getting back root or assuming rights of some system user. This breaks when Apache is mediated by AppArmor - prctl() fails with a 'Permission denied' error. This problem can be replicated /only/ when the code in question lives in a shared library (demo attached) /not/ when built into the app. Irrespective of whether this behaviour is justified or not (I don't know?) it would be nice to have a way to address this.

root@bizarro:~/test# gcc -fPIC -std=gnu99 -c herp.c -o herp.o
root@bizarro:~/test# gcc -shared -o libherp.so herp.o
root@bizarro:~/test# gcc derp.c -lseccomp -lherp -L. -lseccomp
root@bizarro:~/test# ./derp python
-bash: ./derp: No such file or directory
root@bizarro:~/test# gcc derp.c -lseccomp -lherp -L. -lseccomp -o derp
root@bizarro:~/test# ./derp python
./derp: error while loading shared libraries: libherp.so: cannot open shared object file: No such file or directory
root@bizarro:~/test# LD_LIBRARY_PATH=. ./derp python
Python 2.7.6 (default, Mar 22 2014, 22:59:56)
[GCC 4.8.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from os import setuid
>>> setuid(1)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
OSError: [Errno 1] Operation not permitted
>>>
root@bizarro:~/test# testsh # enter mediation by apparmor
root@bizarro:~/test# LD_LIBRARY_PATH=. ./derp python
Installing seccomp filter failed (probably due to too old kernel); unable to restrict setuid privileges.
Python 2.7.6 (default, Mar 22 2014, 22:59:56)
[GCC 4.8.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from os import setuid
>>> setuid(1)
>>>

[Víktu Pons i Colomer (viktu-t)]

I add mailman, as I think this issue affects mailman's python scripts when running with apache-mpm-itk.

Running any of the python's scripts on a site protected with apache-mpm-itk gives a "Operation not permitted" error

[Andrew Lewis (dabbed)]

Note that the 'Operation not permitted' error in the original demonstration is desired behaviour- when this does /not/ happen the seccomp filter is not working as intended. It's not clear to me what problem you're see'ing but it /could/ be an affect of the seccomp filter in mpm-itk (governed by the LimitUIDRange setting) if for instance mailman is trying to run Exim which is setuid root.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[dwarfplanet9 (ron-ophoenix)]

We are also seeing the problem with mailman. I would appreciate it if someone could provide a workaround. Or perhaps a hint of where to look for the code that needs fixing.

[Andrew Lewis (dabbed)]

I'm not clear on what the issue with mailman is but if removing the LimitUIDRange option from your Apache config solves it then it's probably expected behaviour when calling a setuid root executable (Exim?).