aa-autodep crashes with KeyError: 'abstractions/bash'

[Yves Trudeau]

Looks like any bash scripts cause an error like this one:

root@BlogApparmor1:~# aa-autodep /usr/bin/mysqld_safe
Traceback (most recent call last):
  File "/usr/sbin/aa-autodep", line 36, in <module>
    tool.cmd_autodep()
  File "/usr/lib/python3/dist-packages/apparmor/tools.py", line 196, in cmd_autodep
    apparmor.autodep(program)
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 593, in autodep
    profile_data = create_new_profile(pname)
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 444, in create_new_profile
    handle_binfmt(local_profile[localfile], interpreter_path)
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 377, in handle_binfmt
    if not is_known_rule(profile, 'file', library_rule):
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 3384, in is_known_rule
    if include[incname][incname].get(rule_type, False):
KeyError: 'abstractions/bash'

An unexpected error occoured!

[Seth Arnold (seth-arnold)]

Hello Yves, does the bash abstraction exist on your system?

ls -l /etc/apparmor.d/abstractions/bash

Thanks

[Seth Arnold (seth-arnold)]

I think I've recreated this bug locally:

sarnold@hunt:~/bin$ vim dnsbl
sarnold@hunt:~/bin$ chmod 755
chmod: missing operand after ‘755’
Try 'chmod --help' for more information.
sarnold@hunt:~/bin$ chmod 755 dnsbl
sarnold@hunt:~/bin$ sudo aa-autodep dnsbl
[sudo] password for sarnold:
Traceback (most recent call last):
  File "/usr/sbin/aa-autodep", line 36, in <module>
    tool.cmd_autodep()
  File "/usr/lib/python3/dist-packages/apparmor/tools.py", line 196, in cmd_autodep
    apparmor.autodep(program)
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 593, in autodep
    profile_data = create_new_profile(pname)
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 444, in create_new_profile
    handle_binfmt(local_profile[localfile], interpreter_path)
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 377, in handle_binfmt
    if not is_known_rule(profile, 'file', library_rule):
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 3384, in is_known_rule
    if include[incname][incname].get(rule_type, False):
KeyError: 'abstractions/ruby'

An unexpected error occoured!

For details, see /tmp/apparmor-bugreport-x28ydvz6.txt
Please consider reporting a bug at https://bugs.launchpad.net/apparmor/
and attach this file.
sarnold@hunt:~/bin$ ls -l /etc/apparmor.d/abstractions/ruby
-rw-r--r-- 1 root root 906 Apr 12 2016 /etc/apparmor.d/abstractions/ruby

sarnold@hunt:~/bin$ sudo cat !$
sudo cat /tmp/apparmor-bugreport-x28ydvz6.txt
KeyError
Python 3.6.5: /usr/bin/python3
Mon Jul 16 17:45:13 2018

A problem occurred in a Python script. Here is the sequence of
function calls leading up to the error, in the order they occurred.

 /usr/sbin/aa-autodep in <module>()
   27 parser = argparse.ArgumentParser(description=_('Generate a basic AppArmor profile by guessing requirements'))
   28 parser.add_argument('--force', action='store_true', default=False, help=_('overwrite existing profile'))
   29 parser.add_argument('-d', '--dir', type=str, help=_('path to profiles'))
   30 parser.add_argument('program', type=str, nargs='+', help=_('name of program'))
   31 parser.add_argument('--no-reload', dest='do_reload', action='store_false', default=True, help=_('Do not reload the profile after modifying it'))
   32 args = parser.parse_args()
   33
   34 tool = apparmor.tools.aa_tools('autodep', args)
   35
   36 tool.cmd_autodep()
tool = <apparmor.tools.aa_tools object>
tool.cmd_autodep = <bound method aa_tools.cmd_autodep of <apparmor.tools.aa_tools object>>

 /usr/lib/python3/dist-packages/apparmor/tools.py in cmd_autodep(self=<apparmor.tools.aa_tools object>)
  191 apparmor.check_qualifiers(program)
  192
  193 if os.path.exists(apparmor.get_profile_filename(program)) and not self.force:
  194 aaui.UI_Info(_('Profile for %s already exists - skipping.') % program)
  195 else:
  196 apparmor.autodep(program)
  197 if self.aa_mountpoint:
  198 apparmor.reload(program)
  199
  200 def clean_profile(self, program):
global apparmor = <module 'apparmor.aa' from '/usr/lib/python3/dist-packages/apparmor/aa.py'>
apparmor.au...

[Christian Boltz (cboltz)]

Unfortunately I can't reproduce this bug (tested with latest git), at least with the simple test script (just a #!/usr/bin/ruby header) I used.

@Yves and Seth: Which version of the AppArmor utils version do you use? Is there a special trick to reproduce the error?

[Seth Arnold (seth-arnold)]

On Tue, Jul 17, 2018 at 11:30:55AM -0000, Christian Boltz wrote:
> @Yves and Seth: Which version of the AppArmor utils version do you use?
> Is there a special trick to reproduce the error?

2.12-4ubuntu5 here; no trick to reproducing, it was rather unexpected. :)

Thanks

[Yves Trudeau (y-trudeau)]

Le Fri, 13 Jul 2018 23:01:50 +0000,
Seth Arnold <email address hidden> a écrit :

> Hello Yves, does the bash abstraction exist on your system?
>
> ls -l /etc/apparmor.d/abstractions/bash
>
> Thanks
>

Hi Seth,

Apparently:

root@BlogApparmor1:~# ls -l /etc/apparmor.d/abstractions/bash
-rw-r--r-- 1 root root 1512 Apr 17
20:15 /etc/apparmor.d/abstractions/bash

--Yves

[Yves Trudeau (y-trudeau)]

Apparently, the aa.py script is not loading all the profiles in /etc/apparmor.d. I added this file and the script now works:

root@BlogApparmor1:/etc/apparmor.d# cat scripts

#include <abstractions>
root@BlogApparmor1:/etc/apparmor.d#
root@BlogApparmor1:/etc/apparmor.d# aa-autodep /usr/bin/mysqld_safe
Writing updated profile for /usr/bin/mysqld_safe.
root@BlogApparmor1:/etc/apparmor.d#