Guest session emits AppArmor denials about reading /proc/<PID>/stat

[Tyler Hicks]

When the guest session launches, bamfdaemon triggers denials on reading /proc/<PID>/stat:

apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/863/stat" pid=1816 comm="bamfdaemon" requested_mask="r" denied_mask="r" fsuid=117 ouid=0

and common utilities, such as ps and killall, trigger the same types of denials:

apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/11/stat" pid=2827 comm="ps" requested_mask="r" denied_mask="r" fsuid=117 ouid=0
apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/12/stat" pid=2813 comm="killall" requested_mask="r" denied_mask="r" fsuid=117 ouid=0

We already grant some read permissions on /proc/ <PID>/*:

  owner @{PROC}/** rm,
  # needed for gnome-keyring-daemon
  @{PROC}/*/status r,

but non-owned /proc/<PID>/stat files are not covered.

We should either grant the permission to read the files or quiet the denials, as they can generate quite a few log entries. Since we already grant read permissions on /proc/<PID>/status, it seems like adding read permissions on /proc/<PID>/stat is appropriate.

[Launchpad Janitor (janitor)]

This bug was fixed in the package lightdm - 1.9.14-0ubuntu2

---------------
lightdm (1.9.14-0ubuntu2) trusty; urgency=medium

  * debian/patches/06_guest_signal_and_ptrace_aa_rules.patch: Grant
    permission for guest session processes to signal and ptrace each
    other (LP: #1298611)
  * debian/patches/07_guest_proc_pid_stat_aa_rule.patch: Grant permission for
    guest session processes to read /proc/<PID>/stat. This prevents AppArmor
    denial messages caused by bamfdaemon and common utilities such as ps and
    killall. (LP: #1301625)
 -- Tyler Hicks <email address hidden> Thu, 03 Apr 2014 02:48:51 -0500