guest session generates a series of apparmour denied messages

[C de-Avillez]

Binary package hint: gdm-guest-session, under LightDM

Logged in as myself; some time later, opened a guest session. I then looked at dmesg, and found a series of audit denied messages:

Jun 10 15:15:39 xango3 gdm-session-worker[4761]: WARNING: Could not copy file to cache: Error opening file '/var/cache/gdm/guest/dmrc': Permission denied
Jun 10 15:15:39 xango3 kernel: [ 2918.206215] type=1400 audit(1307736939.494:23): apparmor="DENIED" operation="open" parent=4752 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=4761 comm="gnome-session" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:39 xango3 kernel: [ 2918.244662] type=1400 audit(1307736939.534:24): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=4803 comm="gconf-sanity-ch" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:39 xango3 kernel: [ 2918.326956] type=1400 audit(1307736939.614:25): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=4813 comm="gnome-keyring-d" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:39 xango3 kernel: [ 2918.327905] type=1400 audit(1307736939.614:26): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=4815 comm="gnome-keyring-d" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:39 xango3 kernel: [ 2918.330169] type=1400 audit(1307736939.614:27): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=4816 comm="gnome-keyring-d" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:39 xango3 kernel: [ 2918.332866] type=1400 audit(1307736939.624:28): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=4817 comm="gnome-keyring-d" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:39 xango3 kernel: [ 2918.336240] type=1400 audit(1307736939.624:29): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=4820 comm="gsettings-data-" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:39 xango3 kernel: [ 2918.355837] type=1400 audit(1307736939.644:31): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=4824 comm="gnome-power-man" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:39 xango3 kernel: [ 2918.379314] type=1400 audit(1307736939.664:32): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=4823 comm="gnome-settings-" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:39 xango3 pulseaudio[4874]: module-udev-detect.c: Failed to open /proc/asound/card1: Permission denied
Jun 10 15:15:41 xango3 pulseaudio[4874]: module-udev-detect.c: Failed to open /proc/asound/card0: Permission denied
Jun 10 15:15:41 xango3 pulseaudio[4874]: module-udev-detect.c: Failed to open /proc/asound/card2: Permission denied
Jun 10 15:15:46 xango3 kernel: [ 2925.354082] type=1400 audit(1307736946.654:303): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=5025 comm="telepathy-indic" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:46 xango3 kernel: [ 2925.401760] type=1400 audit(1307736946.704:304): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=5026 comm="gnome-screensav" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:51 xango3 kernel: [ 2930.398507] type=1400 audit(1307736951.714:305): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=5043 comm="gdu-notificatio" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:15:56 xango3 kernel: [ 2935.368172] type=1400 audit(1307736956.694:306): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=5048 comm="gnome-user-shar" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:16:11 xango3 kernel: [ 2950.289387] type=1400 audit(1307736971.654:307): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/meminfo" pid=5080 comm="applet.py" requested_mask="r" denied_mask="r" fsuid=127 ouid=0
Jun 10 15:16:11 xango3 kernel: [ 2950.309437] type=1400 audit(1307736971.674:308): apparmor="DENIED" operation="mknod" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/usr/share/system-config-printer/debug.pyc" pid=5080 comm="applet.py" requested_mask="c" denied_mask="c" fsuid=127 ouid=127
Jun 10 15:16:11 xango3 kernel: [ 2950.317767] type=1400 audit(1307736971.684:309): apparmor="DENIED" operation="open" parent=4761 profile="/usr/share/gdm/guest-session/Xsession" name="/proc/filesystems" pid=5080 comm="applet.py" requested_mask="r" denied_mask="r" fsuid=127 ouid=0

ProblemType: BugDistroRelease: Ubuntu 11.10
Package: gdm-guest-session 0.24
ProcVersionSignature: Ubuntu 2.6.39-3.10-generic 2.6.39
Uname: Linux 2.6.39-3-generic x86_64
NonfreeKernelModules: wl nvidia
Architecture: amd64
Date: Fri Jun 10 15:25:58 2011
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Alpha amd64 (20110228)
PackageArchitecture: allSourcePackage: gdm-guest-session
UpgradeStatus: Upgraded to oneiric on 2011-05-31 (10 days ago)

[Gunnar Hjalmarsson (gunnarhj)]

As you can guess from the name, I doubt that gdm-guest-session is designed to work with any other dm but gdm. Subscribing the author Martin Pitt who ought to know...

[C de-Avillez (hggdh2)]

Hi Gunnar,

I do not discuss it. But if it is a selectable option it must work.

[Launchpad Janitor (janitor)]

This bug was fixed in the package gdm-guest-session - 0.25

---------------
gdm-guest-session (0.25) oneiric; urgency=low

  * apparmor/gdm-guest-session: Allow reading /proc/filesystems and
    /proc/meminfo. (LP: #795723)
  * apparmor/gdm-guest-session: Explicitly deny access to other /proc files to
    avoid noise in dmesg.
 -- Martin Pitt <email address hidden> Mon, 20 Jun 2011 17:58:40 +0200

[Gunnar Hjalmarsson (gunnarhj)]

Martin, I take it that your fix of this bug means that gdm-guest-session should work also with lightdm, which is good news to me. Sometimes it feels great to be wrong. :)

However, it still does not work for me, so I just filed bug 799950.

[Martin Pitt (pitti)]

Gunnar Hjalmarsson [2011-06-20 21:56 -0000]:
> Martin, I take it that your fix of this bug means that gdm-guest-session
> should work also with lightdm, which is good news to me. Sometimes it
> feels great to be wrong. :)

I tested it with gdm2. I don't know how lightdm's guest session will
work, but if it's got its own implementation, then we can at least
copy gdm-guest-session's apparmor profile, so it doesn't hurt to have
it working :) (I checked, current lightdm doesn't have an AA profile
right now).

Martin
--
Martin Pitt | http://www.piware.de
Ubuntu Developer (www.ubuntu.com) | Debian Developer (www.debian.org)

[Gunnar Hjalmarsson (gunnarhj)]

@Martin
Ok, so I jumped at conclusions from the bug reporter's mentioning of "under LightDM". But then bug 799950 is even more justified, so no harm done.