Apparmor complains about multiple /run/dovecot file access

[luca]

Hi, since I upgraded from XUbuntu 15.04 to 15.10 I started to get a lot of apparmor complains about dovecot. The complains were more or less like this:

operation="connect" profile="/usr/lib/dovecot/auth" name="/run/dovecot/anvil-auth-penalty" comm="auth" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0
operation="connect" profile="/usr/lib/dovecot/auth" name="/run/dovecot/auth-worker" comm="auth" requested_mask="wr" denied_mask="wr" fsuid=117 ouid=117
operation="file_perm" profile="/usr/lib/dovecot/anvil" name="/run/dovecot/anvil-auth-penalty" comm="anvil" requested_mask="r" denied_mask="r" fsuid=117 ouid=0
operation="file_perm" profile="/usr/lib/dovecot/anvil" name="/run/dovecot/anvil" comm="anvil" requested_mask="r" denied_mask="r" fsuid=117 ouid=0
operation="file_perm" profile="/usr/lib/dovecot/anvil" name="/run/dovecot/anvil" comm="anvil" requested_mask="w" denied_mask="w" fsuid=117 ouid=0
operation="file_perm" profile="/usr/lib/dovecot/auth" name="/run/dovecot/anvil-auth-penalty" comm="auth" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
operation="file_perm" profile="/usr/lib/dovecot/auth" name="/run/dovecot/auth-master" comm="auth" requested_mask="w" denied_mask="w" fsuid=117 ouid=0
operation="file_perm" profile="/usr/lib/dovecot/auth" name="/run/dovecot/auth-worker" comm="auth" requested_mask="r" denied_mask="r" fsuid=0 ouid=117
operation="file_perm" profile="/usr/lib/dovecot/auth" name="/run/dovecot/auth-worker" comm="auth" requested_mask="w" denied_mask="w" fsuid=117 ouid=117
operation="file_perm" profile="/usr/lib/dovecot/auth" name="/run/dovecot/login/login" comm="auth" requested_mask="r" denied_mask="r" fsuid=117 ouid=0
operation="file_perm" profile="/usr/lib/dovecot/auth" name="/run/dovecot/login/login" comm="auth" requested_mask="w" denied_mask="w" fsuid=117 ouid=0
operation="file_perm" profile="/usr/lib/dovecot/imap" name="/run/dovecot/login/imap" comm="imap" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
operation="file_perm" profile="/usr/lib/dovecot/imap" name="/run/dovecot/login/imap" comm="imap" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
operation="file_perm" profile="/usr/lib/dovecot/ssl-params" name="/run/dovecot/login/ssl-params" comm="ssl-params" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
operation="file_receive" profile="/usr/lib/dovecot/imap" comm="imap" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none peer="/usr/lib/dovecot/imap-login"
operation="file_receive" profile="/usr/lib/dovecot/imap-login" comm="imap" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none peer="/usr/lib/dovecot/imap"
operation="signal" profile="/usr/sbin/dovecot" comm="dovecot" requested_mask="send" denied_mask="send" signal=int peer="/usr/lib/dovecot/auth"

To avoid them, I added some stuff to the /etc/apparmor.d/local directory, patch attached.

ProblemType: Bug
DistroRelease: Ubuntu 15.10
Package: dovecot-core 1:2.2.18-2ubuntu2
ProcVersionSignature: Ubuntu 4.2.0-17.21-generic 4.2.3
Uname: Linux 4.2.0-17-generic x86_64
ApportVersion: 2.19.1-0ubuntu4
Architecture: amd64
CurrentDesktop: XFCE
Date: Sun Nov 1 19:42:56 2015
InstallationDate: Installed on 2012-11-11 (1085 days ago)
InstallationMedia: Xubuntu 12.10 "Quantal Quetzal" - Release amd64 (20121017.1)
SourcePackage: dovecot
UpgradeStatus: Upgraded to wily on 2015-11-01 (0 days ago)

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Patch for local files" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Nathaniel Homier (mechamechanism)]

This still happens as of 16.10 with all updates applied.

[Christian Boltz (cboltz)]

Commited to AppArmor bzr - trunk r3627, 2.10 branch r3383 and 2.9 branch r3048.

Fixing the Ubuntu packages is not my job ;-)

[Andreas Hasenack (ahasenack)]

Confirmed this is not yet in xenial (16.04), but bionic (18.04) has it.

[Andreas Hasenack (ahasenack)]

Artful (17.10) also does not have it.

[Andreas Hasenack (ahasenack)]

Fix released in bionic.