[manta] video playback currently broken (denied by apparmor)

[Ricardo Salveti]

current build number: 173
device name: manta
channel: ubuntu-touch/utopic-proposed
last update: 2014-08-05 21:10:15
version version: 173
version ubuntu: 20140805.2
version device: 20140805.2

When trying to scan/play:
root@ubuntu-phablet:~# grep DENIED /var/log/syslog
Aug 5 21:21:32 ubuntu-phablet kernel: [ 67.561632] type=1400 audit(1407273692.712:87): apparmor="DENIED" operation="file_mmap" profile="/usr/bin/media-hub-server" name="/tmp/orcexec.IdUnsY" pid=3673 comm="aqueue:src" requested_mask="m" denied_mask="m" fsuid=32011 ouid=32011
Aug 5 21:21:32 ubuntu-phablet kernel: [ 67.561956] type=1400 audit(1407273692.712:88): apparmor="DENIED" operation="mknod" profile="/usr/bin/media-hub-server" name="/run/user/32011/orcexec.UVatQM" pid=3673 comm="aqueue:src" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011
Aug 5 21:21:32 ubuntu-phablet kernel: [ 67.562246] type=1400 audit(1407273692.712:89): apparmor="DENIED" operation="mknod" profile="/usr/bin/media-hub-server" name="/home/phablet/orcexec.CiEwdB" pid=3673 comm="aqueue:src" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011
Aug 5 21:36:48 ubuntu-phablet kernel: [ 162.522469] type=1400 audit(1407274608.938:87): apparmor="DENIED" operation="open" profile="com.ubuntu.gallery_gallery_2.9.1.1025" name="/dev/video6" pid=3688 comm="CodecLooper" requested_mask="w" denied_mask="w" fsuid=32011 ouid=0
Aug 5 21:37:58 ubuntu-phablet kernel: [ 15.506075] type=1400 audit(1407274678.859:87): apparmor="DENIED" operation="open" profile="/usr/bin/mediascanner-service-2.0" name="/sys/devices/platform/s5p-mfc/video4linux/video6/name" pid=1739 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:37:58 ubuntu-phablet kernel: [ 15.506184] type=1400 audit(1407274678.859:88): apparmor="DENIED" operation="open" profile="/usr/bin/mediascanner-service-2.0" name="/sys/devices/platform/s5p-mfc/video4linux/video7/name" pid=1739 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:37:58 ubuntu-phablet kernel: [ 15.506312] type=1400 audit(1407274678.859:89): apparmor="DENIED" operation="open" profile="/usr/bin/mediascanner-service-2.0" name="/sys/devices/virtual/video4linux/video11/name" pid=1739 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:37:58 ubuntu-phablet kernel: [ 15.506401] type=1400 audit(1407274678.859:90): apparmor="DENIED" operation="open" profile="/usr/bin/mediascanner-service-2.0" name="/sys/devices/virtual/video4linux/video12/name" pid=1739 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:37:58 ubuntu-phablet kernel: [ 15.506508] type=1400 audit(1407274678.859:91): apparmor="DENIED" operation="open" profile="/usr/bin/mediascanner-service-2.0" name="/sys/devices/platform/exynos-mdev.0/video4linux/video16/name" pid=1739 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:37:58 ubuntu-phablet kernel: [ 15.506674] type=1400 audit(1407274678.859:92): apparmor="DENIED" operation="open" profile="/usr/bin/mediascanner-service-2.0" name="/sys/devices/platform/exynos-mdev.0/video4linux/video17/name" pid=1739 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:43:09 ubuntu-phablet kernel: [ 294.183344] type=1400 audit(1407274989.967:111): apparmor="DENIED" operation="open" profile="/usr/bin/media-hub-server" name="/sys/devices/platform/s5p-mfc/video4linux/video6/name" pid=3535 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:43:09 ubuntu-phablet kernel: [ 294.186568] type=1400 audit(1407274989.972:112): apparmor="DENIED" operation="open" profile="/usr/bin/media-hub-server" name="/sys/devices/platform/s5p-mfc/video4linux/video7/name" pid=3535 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:43:09 ubuntu-phablet kernel: [ 294.187156] type=1400 audit(1407274989.972:113): apparmor="DENIED" operation="open" profile="/usr/bin/media-hub-server" name="/sys/devices/virtual/video4linux/video11/name" pid=3535 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:43:09 ubuntu-phablet kernel: [ 294.187560] type=1400 audit(1407274989.972:114): apparmor="DENIED" operation="open" profile="/usr/bin/media-hub-server" name="/sys/devices/virtual/video4linux/video12/name" pid=3535 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:43:09 ubuntu-phablet kernel: [ 294.188111] type=1400 audit(1407274989.972:115): apparmor="DENIED" operation="open" profile="/usr/bin/media-hub-server" name="/sys/devices/platform/exynos-mdev.0/video4linux/video16/name" pid=3535 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:43:09 ubuntu-phablet kernel: [ 294.188636] type=1400 audit(1407274989.977:116): apparmor="DENIED" operation="open" profile="/usr/bin/media-hub-server" name="/sys/devices/platform/exynos-mdev.0/video4linux/video17/name" pid=3535 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:43:09 ubuntu-phablet kernel: [ 294.189062] type=1400 audit(1407274989.977:117): apparmor="DENIED" operation="open" profile="/usr/bin/media-hub-server" name="/sys/devices/platform/exynos-mdev.0/video4linux/video18/name" pid=3535 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:43:09 ubuntu-phablet kernel: [ 294.189464] type=1400 audit(1407274989.977:118): apparmor="DENIED" operation="open" profile="/usr/bin/media-hub-server" name="/sys/devices/platform/exynos-mdev.0/video4linux/video19/name" pid=3535 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:43:09 ubuntu-phablet kernel: [ 294.189988] type=1400 audit(1407274989.977:119): apparmor="DENIED" operation="open" profile="/usr/bin/media-hub-server" name="/sys/devices/virtual/video4linux/video23/name" pid=3535 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0
Aug 5 21:43:09 ubuntu-phablet kernel: [ 294.190391] type=1400 audit(1407274989.977:120): apparmor="DENIED" operation="open" profile="/usr/bin/media-hub-server" name="/sys/devices/platform/exynos-mdev.0/video4linux/video24/name" pid=3535 comm="CodecLooper" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0

[Jamie Strandboge (jdstrand)]

mediascanner2 needs to add this to its apparmor policy:
  /sys/devices/**/video4linux/video** r,

media-hub needs to add this to its policy:
  /sys/devices/**/video4linux/video** r,

The media-hub orcexec issue is already fixed, but you may not have the policy update loaded due to bug #1350673. This will be fixed in the next apparmor upload (scheduled for next week). To workaround the orcexec issue, please do:
$ sudo rm -f /etc/apparmor.d/cache/*
$ sudo reboot

[James Henstridge (jamesh)]

I don't have a Manta device here, but I tried blowing away the mediascanner's cache and letting it rebuild on my Nexus 4, and saw a similar message from

Aug 8 16:33:00 ubuntu-phablet kernel: [ 3265.527971] type=1400 audit(1407486780.540:120): apparmor="DENIED" operation="file_mmap" profile="/usr/bin/mediascanner-service-2.0" name="/tmp/orcexec.zAEfkM" pid=4271 comm="multiqueue109:s" requested_mask="m" denied_mask="m" fsuid=32011 ouid=32011

I guess mediascanner needs the same orcexec fixes?

[Jamie Strandboge (jdstrand)]

This is bug #1357348 which is now fixed. It looked like the other bug, but turned out to be different.

Please feel free to add this to the policy:
  /sys/devices/**/video4linux/video** r,

[Launchpad Janitor (janitor)]

This bug was fixed in the package mediascanner2 - 0.104+14.10.20140825-0ubuntu1

---------------
mediascanner2 (0.104+14.10.20140825-0ubuntu1) utopic; urgency=medium

  [ James Henstridge ]
  * Add support for custom sort orders in query(), queryAlbums() and
    queryArtists() methods. This breaks the ABI, so bump soname.
  * Update AppArmor policy to allow read access to
    /sys/devices/**/video4linux/video** (LP: #1353139)

  [ Ubuntu daily release ]
  * debian/libmediascanner-2.0-2.symbols: auto-update to released
    version

  [ Jussi Pakkanen ]
  * Fix inotify usage.
  * Store information on files that break GStreamer and skip them when
    encountered.
  * Don't call closedir with a null argument.
  * Add database integrity constraints.

  [ Jamie Strandboge ]
  * allow read access to /etc/udev/udev.conf for gstreamer (LP:
    #1356883) (LP: #1356883)
 -- Ubuntu daily release <email address hidden> Mon, 25 Aug 2014 12:52:17 +0000