[systemd] dhclient causes apparmor warnings against /run/systemd/journal/dev-log

[Bryan Quigley]

When running a system with systemd, the logs get filled with dhclient getting denied access to the below.

Example dmesg output:
[ 28.037120] audit: type=1400 audit(1421846274.704:51): apparmor="DENIED" operation="sendmsg" profile="/sbin/dhclient" name="/run/systemd/journal/dev-log" pid=1678 comm="dhclient" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
[ 45.367871] audit: type=1400 audit(1421846292.048:52): apparmor="DENIED" operation="sendmsg" profile="/sbin/dhclient" name="/run/systemd/journal/dev-log" pid=1678 comm="dhclient" requested_mask="w" denied_mask="w" fsuid=0 ouid=0

ProblemType: Bug
DistroRelease: Ubuntu 15.04
Package: isc-dhcp-client 4.3.1-5ubuntu2
ProcVersionSignature: Ubuntu 3.18.0-9.10-generic 3.18.2
Uname: Linux 3.18.0-9-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.15.1-0ubuntu2
Architecture: amd64
Date: Wed Jan 21 09:26:16 2015
DhclientLeases:

InstallationDate: Installed on 2015-01-08 (12 days ago)
InstallationMedia: Ubuntu 15.04 "Vivid Vervet" - Alpha amd64 (20150108)
ProcEnviron:
 LANGUAGE=en_US
 TERM=xterm
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: isc-dhcp
UpgradeStatus: No upgrade log present (probably fresh install)

[Bryan Quigley (bryanquigley)]

Just adding
  /run/systemd/journal/dev-log w,
to /etc/apparmor.d/sbin.dhclient makes it work not.

I noticed after that it wasn't actually logging an dhclient messages before enabling write access there.

[Bryan Quigley (bryanquigley)]

makes it work *now*.

[Jamie Strandboge (jdstrand)]

Thanks for using Ubuntu and filing a bug. This should actually be fixed in apparmor's base abstraction (which already permits /dev/log). Retargetting to apparmor.

[Steve Langasek (vorlon)]

Jamie, now that systemd is becoming the default in vivid, I think this is critical to fix, as dmesg is quite spammy at present (and of course the log entries are being lost if the writes are denied). Can this fix be expedited?

[Jamie Strandboge (jdstrand)]

This was committed upstream some time ago and will be in AppArmor 2.9.2. I'm not sure of the timing of that so I'll cherrypick it for the Ubuntu package for now.

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor - 2.9.1-0ubuntu7

---------------
apparmor (2.9.1-0ubuntu7) vivid; urgency=medium

  * systemd-dev-log-lp1413232.patch: Allow writes to the systemd journal
    socket /{,var}/run/systemd/journal/dev-log. This can be dropped with
    with AppArmor 2.9.2. (LP: #1413232)
 -- Jamie Strandboge <email address hidden> Fri, 06 Mar 2015 06:22:34 -0600

[ttbek (ttbek)]

Potential regression? I think I'm seeing this on Ubuntu 20.04:

May 31 04:35:10 HOSTNAME audit[2997513]: AVC apparmor="DENIED" operation="sendmsg" profile="/{,usr/}sbin/dhclient" name="/log" pid=2997513 comm="dhclient" requested_mask="w" denied_mask="w" fsuid=0 ouid=0

dpkg --list | grep apparmor
ii apparmor 2.13.3-7ubuntu5 amd64 user-space parser utility for AppArmor
ii libapparmor1:amd64 2.13.3-7ubuntu5 amd64 changehat AppArmor library

[ChuckG (tubastuff)]

Seeing the same for 20.04:

[ 171.828819] audit: type=1400 audit(1598467536.663:28): apparmor="DENIED" operation="open" profile="/{,usr/}sbin/dhclient" name="/proc/1060/task/1063/comm" pid=1060 comm="dhclient" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

[John Johansen (jjohansen)]

@tubastuff that is definitely not the same problem, please see https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/1918410