kernel panic - oops when accessing /proc/pid/attr/current

[Mathias Gug]

Binary package hint: apparmor

Running ubuntu17 on gutsy, I get kernel panics when I try to run apparmor_status or cat /proc/pid/attr/current for a daemon which has a profile defined.

I've attached screenshots of the screen. Nothing else is available.

[Kees Cook (kees)]

Are you sure you have the ubuntu17 module built and loaded? You'll need to do an rmmod/modprobe after the upgrade. I cannot reproduce this, I think it is the same issue as the ubuntu15 module's ps aZ crash (since it's reading from the same location).

[Mathias Gug (mathiaz)]

Updated to ubuntu18. Recompiled the module and rebooted. Still has the same bug. I've attached some screenshots.

[Mathias Gug (mathiaz)]

The output of "sudo ps -AZ" prints strange column content for protected profiles:

@ 3926 ? 00:00:00 smbd
L 3975 ? 00:00:00 smbd

F 3612 ? 00:00:00 syslogd

The output of the command change with running it multiple times.

[Kees Cook (kees)]

On Mon, Jul 02, 2007 at 09:57:42AM -0000, Mathias Gug wrote:
> The output of "sudo ps -AZ" prints strange column content for protected
> profiles:

This is very strange! I cannot reproduce this at all. :(

--
Kees Cook @outflux.net

[Mathias Gug (mathiaz)]

On Mon, Jul 02, 2007 at 03:33:27PM -0000, Kees Cook wrote:
> This is very strange! I cannot reproduce this at all. :(
I'm running all the tests in a vmware server. Could this be an issue ?

[Kees Cook (kees)]

On Mon, Jul 02, 2007 at 03:45:31PM -0000, Mathias Gug wrote:
> I'm running all the tests in a vmware server. Could this be an issue ?

I'm not sure -- I will get a vmware set up on my laptop -- I have been
testing on amd64.

--
Kees Cook @outflux.net

[Kees Cook (kees)]

apparmor (2.0.1+510.dfsg-0ubuntu19) gutsy; urgency=low

  * Update 11-getprocattr-api.dpatch: pass back the correct string pointer
    so as to not corrupt kernel memory (LP: #123081).
  * debian/control: add XS-Vcs for bzr branch.

 -- Kees Cook <email address hidden> Tue, 03 Jul 2007 09:07:52 -0700