apparmor policy forbids running various /bin/*

[Martin Pitt]

A project of mine calls uname in its wrappers:

/apps/testapp/0.1/setup.sh: line 21: /bin/uname: Permission denied

[ 993.457524] audit: type=1400 audit(1418042729.948:12): apparmor="DENIED" operation="exec" profile="testapp_testbin_0.1" name="/bin/uname" pid=1032 comm="testbin" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0
[ 993.457556] audit: type=1400 audit(1418042729.948:13): apparmor="DENIED" operation="open" profile="testapp_testbin_0.1" name="/bin/uname" pid=1032 comm="testbin" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

[Martin Pitt (pitti)]

We also currently disallow running /usr/bin/python*.

[Alexander Sack (asac)]

two ways to look at it:

1. we should allow running all non-risky commands from base system
2. these things might go away eventually (after snappy rewrite and system strip to just the bare minimum), but in general we say you can use what is on the base system, so wouldnt affect that we should fix this

[Alexander Sack (asac)]

breaks core security experience by being too restrictive; marking as devel and safe xp

[Jamie Strandboge (jdstrand)]

This is in vivid NEW awaiting approval.

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor-easyprof-ubuntu-snappy - 1.3.4

---------------
apparmor-easyprof-ubuntu-snappy (1.3.4) vivid; urgency=medium

  * ubuntu-snappy/docker-1.3_client: update for ever changing paths
  * ubuntu-snappy/networking: add read for @{PROC}/sys/net/core/somaxconn
  * ubuntu-snappy/default (LP: #1400306):
    - add uptime and uname
    - add dash
    - add read access to /etc/inputrc, but not @{HOME}/.inputrc
    - also allow python2 and perl5*
    - use @{HOMEDIRS}/*/ instead of @{HOMEDIRS}/
    - allow @{PROC}/sys/kernel/hostname
    - allow @{PROC}/sys/kernel/osrelease
 -- Jamie Strandboge <email address hidden> Thu, 04 Dec 2014 15:00:29 -0600