umount fstype=... not mediated

[Jamie Strandboge]

These two rules are accepted by the parser and generate equivalent policy:

umount,
umount fstype=fuse.*,

apparmor.d(5) suggests that fstype should be mediated, but it currently is not. Kernel audit suggests it is not mediated:

kernel: [538611.251087] audit: type=1400 audit(1471286430.258:7513): apparmor="DENIED" operation="umount" profile="snap.snap-fuse-test.sh" name="/var/snap/snap-fuse-test/x3/mnt/" pid=1842 comm="umount"

(note fstype is not listed in the denial).

While I found this while developing snappy policy, the interface in question is privileged anyway and so I don't think this is a critical bug for Ubuntu at this time.

[Zygmunt Krynicki (zyga)]

This also affects https://github.com/snapcore/snapd/pull/9547

[John Johansen (jjohansen)]

Indeed fstype= is not currently supported by the kernel for umount. It is not difficult to add, but it has not been a priority.

The parser also needs a small patch, and it should of course be throwing a warning when fstype is not supported.

This at earliest could be supported in 5.11 if it is decided its important enough to spend a day on. Of course Ubuntu could easily pick the fix back to its released kernels if so needed.