/etc/apparmor.d/abstractions/base missing /usr/share/zoneinfo/ r,

[Edy Corak]

Binary package hint: apparmor

I was update following packages on Ubuntu Server 8.04.4 LTS

apparmor 2.1+1075-0ubuntu9.2 -> 2.1+1075-0ubuntu9.3
apparmor-docs 2.1+1075-0ubuntu9.2 -> 2.1+1075-0ubuntu9.3
apparmor-profiles 2.1+1075-0ubuntu9.2 -> 2.1+1075-0ubuntu9.3
apparmor-utils 2.1+1075-0ubuntu9.2 -> 2.1+1075-0ubuntu9.3

Before I start the update the file /etc/apparmor.d/abstractions/base contains

/usr/share/zoneinfo/ r,
/usr/share/zoneinfo/** r,

After update it contains only

/usr/share/zoneinfo/** r,

and this causes many errors if the profile is started in enforced mode

kernel: [4430583.358293] audit(1296221771.972:275): type=1503 operation="inode_permission" requested_mask="::r" denied_mask=
"::r" name="/usr/share/zoneinfo/" pid=20149 profile="/usr/sbin/lighttpd" namespace="default"

After inserting the missing /usr/share/zoneinfo/ r, in /etc/apparmor.d/abstractions/base everything works fine again.

Kind regards

Edy Corak

[Jamie Strandboge (jdstrand)]

This bug does not affect Natty.

[Jamie Strandboge (jdstrand)]

@Edy,

It looks like you added the rule to your base abstraction manually since the rule is not in the default apparmor packages for 2.1+1075-0ubuntu9.2 and you should have been prompted by dpkg for the conffile change on upgrade. This issue was fixed Ubuntu 10.04 LTS.