[SRU] race condition bringing up interfaces with AppArmor

[Kees Cook]

Binary package hint: ifupdown

Due to a missing upstart feature (bug 568860), /etc/init/network-interface-security.conf's use of "start on (starting ... or starting ...)" does not block each of the list jobs. It is possible, for example for this to happen:

network-manger starting
network-interface-security starting
networking starting
networking runs and finishes, bringing up eth0, running dhclient3
network-interface-security runs and brings up dhclient3 profile
...

i.e. since network-manager caused network-interface-security to start, network-interface-security isn't involved and doesn't have to wait for it. To reduce the race, we can add "instance $JOB" to n-i-s, and add a stamp file to avoid it running multiple times (though it doesn't hurt to run multiple times, profile loading (and cache generation) is atomic).

[Kees Cook (kees)]

You can trigger this race by adding "sleep 60" to the start of /etc/init.d/apparmor and adding "sleep 20" to the pre-start script in /etc/init/network-interface-security.conf. The result after boot will be seeing dhclient3 running but not enforced in "sudo aa-status".

[Launchpad Janitor (janitor)]

This bug was fixed in the package ifupdown - 0.6.10ubuntu4

---------------
ifupdown (0.6.10ubuntu4) natty; urgency=low

  * debian/ifupdown.network-interface{,-security}.upstart: handle race
    condition when loading AppArmor profiles for interfaces (LP: #689892).
 -- Kees Cook <email address hidden> Mon, 13 Dec 2010 13:53:12 -0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package ifupdown - 0.6.10ubuntu3.1

---------------
ifupdown (0.6.10ubuntu3.1) maverick-security; urgency=low

  * debian/ifupdown.network-interface{,-security}.upstart: handle race
    condition when loading AppArmor profiles for interfaces (LP: #689892).
    Patch by Kees Cook.
 -- Jamie Strandboge <email address hidden> Tue, 04 Jan 2011 12:40:01 -0600

[Launchpad Janitor (janitor)]

This bug was fixed in the package ifupdown - 0.6.8ubuntu29.2

---------------
ifupdown (0.6.8ubuntu29.2) lucid-security; urgency=low

  * debian/ifupdown.network-interface{,-security}.upstart: handle race
    condition when loading AppArmor profiles for interfaces (LP: #689892).
    Patch by Kees Cook.
 -- Jamie Strandboge <email address hidden> Tue, 04 Jan 2011 12:48:52 -0600