alias rules being only partially applied
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
| AppArmor |
High
|
Unassigned |
Bug Description
As reported by Christian Boltz
alias rules broken for /{,var/}run/
Hello,
lots of profiles contain rules for /{,var/}run/ nowadays.
Unfortunately that breaks if /var is a symlink (to /home/sys-var in my
case) even if a correct alias rule is setup.
I'll paste the details from #apparmor:
[22:00] <cboltz> I get unexpected DENIED events in combination with aliases:
[22:00] <cboltz> apparmor="DENIED" operation="mkdir" parent=1 profile=
[22:00] <cboltz> but I have in tunables/alias
[22:01] <cboltz> alias /var/ -> /home/sys-var/,
[22:01] <cboltz> and the profile for avahi-daemon allows write access to /var/run/
[22:01] <cboltz> is this a known or a new bug?
[22:52] <sbeattie> cboltz: sorry, jjohansen and I are at the Ubuntu Developer Summit this week, so we're bouncing on and off irc.
[22:53] <sbeattie> cboltz: not a known bug to me
[22:54] <cboltz> then it must be a new one
[22:56] <cboltz> I just found what causes it
[22:57] <sbeattie> cboltz: oh?
[22:57] <cboltz> /{,var/
[22:57] <cboltz> /var/run/
[23:00] <sbeattie> doh
[23:01] <sbeattie> that's a result of aliases being more like a pre-processing step than a real semantic change.
[23:02] <cboltz> looks like it should be a real semantic change *g*
[23:03] <sbeattie> Feel free to raise the issue on the list or file a bug, though I'm not sure that it'd be an easy thing to address.
[23:03] <cboltz> I'll send a mail
[23:04] <sbeattie> cool, thanks!
[23:04] <cboltz> just tell John that I found a bug again, and then enjoy the developer summit
[23:04] <sbeattie> hehe
[23:06] * sbeattie vanishes again
Changed in apparmor: | |
importance: | Undecided → Critical |
assignee: | nobody → John Johansen (jjohansen) |
Changed in apparmor: | |
importance: | Critical → High |
status: | New → Triaged |
tags: | added: aa-parser |
Changed in apparmor: | |
assignee: | John Johansen (jjohansen) → nobody |
Christian Boltz (cboltz) wrote : | #1 |
On 01/30/2015 03:00 AM, Christian Boltz wrote:
> Any news on this?
>
> John proposed a patch long ago (2013-07-08, "[Patch] Bug 888077 -
> aliases being partially applied"), but it seems it was lost again :-(
>
Not lost, I have reworked it some and have more work to do on it.
Partly I have been holding off on it for the userspace dfa verification
frame work, so we can have better testing before rolling out backend
changes.
That work is also mostly done and I just need to make some time and
get it out the door.
Any news on this?
John proposed a patch long ago (2013-07-08, "[Patch] Bug 888077 - aliases being partially applied"), but it seems it was lost again :-(