abstractions/X: Possible regression of X session functionality by removing 'w' from /tmp/.X11-unix/* line?
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apparmor (Ubuntu) |
Fix Released
|
High
|
Thomas Ward | ||
Hirsute |
Fix Released
|
High
|
Thomas Ward | ||
Impish |
Fix Released
|
High
|
Thomas Ward |
Bug Description
[Impact]
Any application that requires access to X11 sockets for the Display may want to include abstractions/X in the AppArmor rules, which usually will include rules that we would want for access to the Display socket for X.
However, an upstream regression was made by changes to the abstractions/X to remove the 'w' and leave it read only. This doesn't work - X11 needs readwrite on the sockets for it to properly interact with X11.
This is a fundamental regression that has been fixed upstream.
[Test Plan]
Any application that needs X11 integration with apparmor rules should `#include <abstractions/X>`
This is the problem with https:/
- add `#include <abstractions/X>` into `/etc/apparmor.
- `sudo systemctl restart apparmor.service`
- Attempt to run torbrowser with torbrowser-
We don't have a full test case for Hirsute at this time.
[Where problems could occur]
Based on my understanding of X11 and the upstream AppArmor bugs on this (refer to comments), there is no breakage introduced by this, in fact the breakage was already introduced upstream, so this simply fixes and removes the breakage when an apparmor rule includes these X abstractions and need to write to the socket but can't.
Therefore, I don't believe there are any 'problems' that can occur with this change.
[Original Description]
In Focal, abstractions/X has the following section in it:
# the unix socket to use to connect to the display
/tmp/.X11-unix/* rw,
unix (connect, receive, send)
type=stream
unix (connect, receive, send)
type=stream
However, in Impish, this seems to have changed:
# the unix socket to use to connect to the display
/tmp/.X11-unix/* r,
unix (connect, receive, send)
type=stream
unix (connect, receive, send)
type=stream
This in turn breaks torbrowser-
This looks like a MAJOR regression by removing the permissions. Or has Impish apparmor not been updated for any Ubuntu specific changes?
ProblemType: Bug
DistroRelease: Ubuntu 21.10
Package: apparmor 3.0.0-0ubuntu8
ProcVersionSign
Uname: Linux 5.11.0-20-generic x86_64
ApportVersion: 2.20.11-0ubuntu67
Architecture: amd64
CasperMD5CheckR
CurrentDesktop: LXQt
Date: Tue Jun 29 14:39:00 2021
InstallationDate: Installed on 2021-06-29 (0 days ago)
InstallationMedia: Lubuntu 21.10 "Impish Indri" - Alpha amd64 (20210628)
ProcKernelCmdline: BOOT_IMAGE=
SourcePackage: apparmor
UpgradeStatus: No upgrade log present (probably fresh install)
Changed in apparmor (Ubuntu): | |
assignee: | nobody → Thomas Ward (teward) |
Changed in apparmor (Ubuntu Hirsute): | |
importance: | Undecided → High |
assignee: | nobody → Thomas Ward (teward) |
status: | New → In Progress |
Changed in apparmor (Ubuntu Impish): | |
status: | New → In Progress |
This was already fixed upstream, see https:/ /gitlab. com/apparmor/ apparmor/ -/merge_ requests/ 664