AppArmor confinement change in 4.8 and newer kernels causes segfault inside LXD containers

[Tyler Hicks]

[Impact]

Running tcpdump inside of a Yakkety LXD container, with a Yakkety host, results in tcpdump immediately segfaulting due to an AppArmor denial preventing /usr/sbin/tcpdump from being mapped.

This change in behavior is caused by the following upstream kernel change:

   commit 9f834ec18defc369d73ccf9e87a2790bfa05bf46
   Date: Mon Aug 22 16:41:46 2016 -0700

       binfmt_elf: switch to new creds when switching to new mm

[Test Case]

tyhicks@host:~$ lxc launch ubuntu-daily:devel yakkety
tyhicks@host:~$ lxc exec yakkety bash
root@yakkety:~# apt-get update && apt-get dist-upgrade -y
...
root@yakkety:~# tcpdump -i eth0
Segmentation fault

The logs will contain the following AppArmor denial:

audit: type=1400 audit(1476204029.500:186): apparmor="DENIED" operation="file_mmap" namespace="root//lxd-yakkety_<var-lib-lxd>" profile="/usr/sbin/tcpdump" name="/usr/sbin/tcpdump" pid=16746 comm="tcpdump" requested_mask="m" denied_mask="m" fsuid=296608 ouid=296608

The bug fix can be verified by tcpdump working as intended (capturing network traffic) with no AppArmor denial for mapping the /usr/sbin/tcpdump file.

[Regression Potential]

 * Low. The fix is a simply adding an additional file permission in the tcpdump AppArmor profile. The only regression potential comes from tcpdump being built in yakkety for the first time. However, a build log comparison shows that there are no compiler flag changes or any other unexpected churn in the build log.

[Other Info]

 * Other tcpdump AppArmor denials, related to accessing the D-Bus system bus and/or the systemd-resolved D-Bus API, will be seen in the logs until a fix for bug #1598759 is in place. Those denials are documented in the following comment:

  - https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1598759/comments/14

[Martin Pitt (pitti)]

Hello Tyler, or anyone else affected,

Accepted tcpdump into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/tcpdump/4.7.4-1ubuntu1.16.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Tyler Hicks (tyhicks)]

It works for me inside of a container and outside of a container.

[Launchpad Janitor (janitor)]

This bug was fixed in the package tcpdump - 4.7.4-1ubuntu1.16.10.1

---------------
tcpdump (4.7.4-1ubuntu1.16.10.1) yakkety; urgency=medium

  * debian/usr.sbin.tcpdump: Allow the tcpdump binary to be mapped as required
    by version 4.8 and newer kernels. tcpdump was immediately segfaulting when
    used inside of LXD containers before this AppArmor profile change.
    (LP: #1632399)

 -- Tyler Hicks <email address hidden> Thu, 13 Oct 2016 04:58:52 +0000

[Martin Pitt (pitti)]

The verification of the Stable Release Update for tcpdump has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package tcpdump - 4.7.4-1ubuntu1.16.10.1

---------------
tcpdump (4.7.4-1ubuntu1.16.10.1) yakkety; urgency=medium

  * debian/usr.sbin.tcpdump: Allow the tcpdump binary to be mapped as required
    by version 4.8 and newer kernels. tcpdump was immediately segfaulting when
    used inside of LXD containers before this AppArmor profile change.
    (LP: #1632399)

 -- Tyler Hicks <email address hidden> Thu, 13 Oct 2016 04:58:52 +0000