Cannot run "sudo chroot ." in Terminal

[dobey]

The Terminal app is being denied to exec the shell inside a chroot when attempting to run sudo chroot .:

Jan 15 15:09:22 ubuntu-phablet kernel: [66337.301777] type=1400 audit(1452888562.238:76): apparmor="DENIED" operation="exec" profile="com.ubuntu.terminal_terminal_0.7.140" name="/home/phablet/vivid-chroot/bin/bash" pid=30547 comm="chroot" requested_mask="x" denied_mask="x" fsuid=0 ouid=0

It would be nice to fix this so that sudo chroot . will work, so that people can use a chroot to install additional console apps and tools, rather than using writable images, following the instructions on AskUbuntu at http://bit.ly/1RLv3g9

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Myrmidon83 (myrmidon83)]

Utilising the command from the guide linked above, 'sudo chroot .' from inside the chroot directory gives the following error:

chroot: failed to run comand '/bin/bash': Permission denied

[Jamie Strandboge (jdstrand)]

The reason why this doesn't work is because this rule carves out /home:
/[^h][^o][^m][^e]** pix,

We needed to do that for autopilot fakeenv-style tests. I think this style of test has been abandoned due to other issues though; if that is true, I can simplify the exec transition rules and remove these autopilot rules. Nicholas, can you comment?

[Nicholas Skaggs (nskaggs)]

Jamie, I thought we had dropped all the fakeenv rules for autopilot? Indeed we did switch to the notion of having dedicated devices that we manually curate into known states before testing.

So all rules that support faking envs or mocking for autopilot can be removed.

[dobey (dobey)]

Adding system-image to the bug, so it can get tagged for the OTA.

[Jamie Strandboge (jdstrand)]

This was fixed in apparmor-easyprof-ubuntu in wily 15.10.3. This only needs an update for OTA. IMO this change is fine for OTA because relatively few applications use the unconfined template.

[Jamie Strandboge (jdstrand)]

This is queued for 1.3.16. I need a member of the Touch release team to comment if this should be in OTA 10.

[Pat McGowan (pat-mcgowan)]

sounds ok

[Jamie Strandboge (jdstrand)]

https://requests.ci-train.ubuntu.com/#/ticket/1190 in silo 046.