cups-browsed - AppArmor profile missing rights for "/run/systemd/resolve/io.systemd.Resolve"

[Torsten Krah]

Hi,

running 22.04 LTS here and my dmesg is full of those:

[ 35.727142] audit: type=1400 audit(1686639577.484:36): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 35.736231] audit: type=1400 audit(1686639577.496:37): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 35.737408] audit: type=1400 audit(1686639577.496:38): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 35.737616] audit: type=1400 audit(1686639577.496:39): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 35.898021] audit: type=1400 audit(1686639577.656:40): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 35.898307] audit: type=1400 audit(1686639577.656:41): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 35.898502] audit: type=1400 audit(1686639577.656:42): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 35.899754] audit: type=1400 audit(1686639577.656:43): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 35.899957] audit: type=1400 audit(1686639577.656:44): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 40.788252] audit: type=1400 audit(1686639582.548:66): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 40.788757] audit: type=1400 audit(1686639582.548:67): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 40.789133] audit: type=1400 audit(1686639582.548:68): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102
[ 40.794756] audit: type=1400 audit(1686639582.552:69): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/cups-browsed" name="/run/systemd/resolve/io.systemd.Resolve" pid=2076 comm="cups-browsed" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=102

The apparmor profile should imho get an update to fix that.

Package installed is:

cups-browsed:
  Installed: 1.28.15-0ubuntu1.2
  Candidate: 1.28.15-0ubuntu1.2

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Mike Vastola (michael-vastola)]

I was able to get around this by running the following

$ sudo mkdir /etc/apparmor.d/abstractions/nss-systemd.d
$ echo -e '# vim:syntax=apparmor\n\n abi <abi/3.0>,\n @{run}/systemd/resolve/io.systemd.Resolve rw,' | sudo tee /etc/apparmor.d/abstractions/nss-systemd.d/resolver
$ sudo systemctl reload apparmor

There may very well be better ways to do this, but this seems to work.

NB: FWIW, I believe this gives many applications the ability to use systemd-resolved to resolve hostnames, but I can't imagine that being a security issue.