aa-notify blocks desktop with garbage notifications

[Hadmut Danisch]

Hi,

aa-notify is highly annoying.

Unfortunately the aa-armor profiles of firefox and chromium-browser are poorly maintained and cause dozens, hundreds, thousands of log messages for denied access, in most cases the same message again and again.

aa-notify then throws dozens, hundreds of notification tiles on the desktop, sometimes faster than one can click them to go away, thus rendering the desktop unusable, making windows invisible.

It is broken by design to throw unlimited numbers of notification on the user interface.

regards

ProblemType: Bug
DistroRelease: Ubuntu 16.10
Package: apparmor-notify 2.10.95-4ubuntu5.1
ProcVersionSignature: Ubuntu 4.8.0-34.36-generic 4.8.11
Uname: Linux 4.8.0-34-generic x86_64
NonfreeKernelModules: zfs zunicode zcommon znvpair zavl
ApportVersion: 2.20.3-0ubuntu8.2
Architecture: amd64
CurrentDesktop: XFCE
Date: Tue Jan 24 10:26:57 2017
InstallationDate: Installed on 2016-04-22 (276 days ago)
InstallationMedia: Lubuntu 16.04 LTS "Xenial Xerus" - Release amd64 (20160420)
PackageArchitecture: all
ProcKernelCmdline: BOOT_IMAGE=/vmlinuz-4.8.0-34-generic root=UUID=d0b47754-d5ca-49ec-8190-92a24e58e373 ro rootflags=subvol=@ nosplash noplymouth nomodeset text
SourcePackage: apparmor
Syslog:

UpgradeStatus: Upgraded to yakkety on 2016-10-17 (99 days ago)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Christian Boltz (cboltz)]

Agreed, aa-notify needs some love. Nevertheless, please open separate bugreports for firefox and chromium to get their profiles fixed ;-)

[John Johansen (jjohansen)]

We need to make it so it can scan ahead and use summary mode if the outstanding number of messages is larger than the threshold when it goes to display the next message.

[Hadmut Danisch (hadmut)]

I already have opened separate bugreports for firefox and chromium. Seems as if some problems can not be fixed since the sandbox model of chromium allegedly has a higher complexity than apparmor can deal with and would exceed the capabilities of apparmor.

[John Johansen (jjohansen)]

No, the chromium and firefox profiles can be fixed. However the current fixes are not ideal. Basically apparmor currently needs to allow capability sys_admin and a few other dangerous privileges in the base profile.

This is not do to the complexity of the sandbox model but because the linux namespace code does not provide the LSM the hooks/information for apparmor to be able to setup a separate profile for the user namespace chrome is setting up for its sandbox. Once the kernel is fixed, apparmor policy will handle the chrome/chromium just fine without the less than ideal fix.

[Seth Arnold (seth-arnold)]

And while the current aa-notify behaviour sounds pretty terrible, it at least accurately reflects what might be chewing your poor disk to pieces. Logging all those denials isn't free either. :/

Thanks

[dino99 (9d9)]

This is an unsupported release now. Please think to install the next LTS 'Bionic 18.04'

http://cdimage.ubuntu.com/ubuntu-next/daily-live/current/
https://www.omgubuntu.co.uk/2018/02/ubuntu-18-04-minimal-install-option

[Christian Boltz (cboltz)]

Reopening for upstream AppArmor - unfortunately nobody worked on this yet :-(