apparmor-utils fail with code exception "AttributeError: 'collections.defaultdict' object has no attribute 'startswith'" 4/4

[Guillaume B]

Hello,

I am on Debian Buster 10.1 running apparmor 2.13.2-10 and apparmor-utils 2.13.2-10.

When trying to use the commands aa-complain, aa-disable, aa-enforce and aa-logprof, the code throws an exception and the commands fail. Downgrading to apparmor-utils 2.11.0-3+deb9u2 and python3-apparmor 2.11.0-3+deb9u2 (Debian oldstable) makes aa-enforce and aa-complain work but aa-logprof still fails.

Since only one file at a time can be attached to a message, I have attached the file for aa-logprof here. The ohter bug reports are in corresponding messages.

Please tell me if more command bug logs are needed.

Thanks.

[Christian Boltz (cboltz)]

Thanks for the reports!

According to the logs, all crashes are caused by the /etc/apparmor.d/usr.sbin.cupsd profile. Can you please attach that file?

[Guillaume B (gueb1)]

Here it is.

[Christian Boltz (cboltz)]

Thanks!

I can reproduce the crash with latest master with your profile and an empty local/usr.sbin.cupsd file.

The problem is probably that

    #include <local/usr.sbin.cupsd>

is located _after_ the closing "}" of the cupsd profile (which is an error in the profile IMHO - I'd guess you broke it while removing the "third_party" child profile) - moving the local include above the "}" or commenting it out avoids the crash.

Nevertheless, even if this line is located at a "wrong" place, it shouldn't crash the aa-* tools ;-)

A simplified test profile that still triggers the crash is:

    /usr/sbin/cupsd {
    }
    #include <local/usr.sbin.cupsd>

[Christian Boltz (cboltz)]

The fix is funny[tm] - removing two lines of code that is, besides causing this crash, unused ;-)

https://gitlab.com/apparmor/apparmor/merge_requests/427

[Guillaume B (gueb1)]

Confirmed fix. The aa-* utils work fine when moving #include <local/usr.sbin.cupsd> before the closing "}" of the cupsd profile fixes the issue.

[Christian Boltz (cboltz)]

This was fixed some months ago, and 2.13.4 includes the fix.