| 2017-03-06 16:16:53 |
Robie Basak |
bug |
|
|
added bug |
| 2017-03-06 16:19:15 |
Robie Basak |
bug task added |
|
apparmor (Ubuntu) |
|
| 2017-04-10 13:08:59 |
Robie Basak |
tor (Ubuntu): status |
New |
Incomplete |
|
| 2017-06-20 08:32:01 |
Christian Ehrhardt |
bug |
|
|
added subscriber ChristianEhrhardt |
| 2017-06-20 08:32:07 |
Christian Ehrhardt |
apparmor (Ubuntu): status |
New |
Confirmed |
|
| 2017-06-20 08:33:46 |
Christian Ehrhardt |
bug watch added |
|
https://github.com/lxc/lxd/issues/3255 |
|
| 2017-06-20 14:24:27 |
Jamie Strandboge |
apparmor (Ubuntu): status |
Confirmed |
Fix Released |
|
| 2017-06-20 14:24:33 |
Jamie Strandboge |
tor (Ubuntu): status |
Incomplete |
Invalid |
|
| 2017-06-20 14:50:43 |
Christian Ehrhardt |
nominated for series |
|
Ubuntu Yakkety |
|
| 2017-06-20 14:50:43 |
Christian Ehrhardt |
bug task added |
|
tor (Ubuntu Yakkety) |
|
| 2017-06-20 14:50:43 |
Christian Ehrhardt |
bug task added |
|
apparmor (Ubuntu Yakkety) |
|
| 2017-06-20 14:50:43 |
Christian Ehrhardt |
nominated for series |
|
Ubuntu Xenial |
|
| 2017-06-20 14:50:43 |
Christian Ehrhardt |
bug task added |
|
tor (Ubuntu Xenial) |
|
| 2017-06-20 14:50:43 |
Christian Ehrhardt |
bug task added |
|
apparmor (Ubuntu Xenial) |
|
| 2017-06-20 14:50:50 |
Christian Ehrhardt |
bug task deleted |
tor (Ubuntu Xenial) |
|
|
| 2017-06-20 14:50:53 |
Christian Ehrhardt |
bug task deleted |
tor (Ubuntu Yakkety) |
|
|
| 2017-06-21 07:41:35 |
Christian Ehrhardt |
bug |
|
|
added subscriber Ubuntu Server Team |
| 2017-06-21 07:41:47 |
Christian Ehrhardt |
tags |
|
bitesize server-next |
|
| 2018-02-14 14:26:07 |
Christian Ehrhardt |
bug task added |
|
ntp (Ubuntu) |
|
| 2018-02-14 14:27:00 |
Christian Ehrhardt |
bug task deleted |
apparmor (Ubuntu Yakkety) |
|
|
| 2018-02-14 14:27:08 |
Christian Ehrhardt |
apparmor (Ubuntu Xenial): status |
New |
Triaged |
|
| 2018-02-14 14:27:14 |
Christian Ehrhardt |
ntp (Ubuntu): status |
New |
Confirmed |
|
| 2018-02-14 14:39:22 |
Christian Ehrhardt |
ntp (Ubuntu): importance |
Undecided |
High |
|
| 2018-02-14 14:40:13 |
Christian Ehrhardt |
summary |
Missing apparmor rules cause tor to fail to start |
apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...) |
|
| 2018-02-15 07:03:29 |
Christian Ehrhardt |
apparmor (Ubuntu Xenial): importance |
Undecided |
High |
|
| 2018-02-15 07:03:42 |
Christian Ehrhardt |
tor (Ubuntu): status |
Invalid |
Confirmed |
|
| 2018-02-17 22:41:02 |
Simon Déziel |
bug |
|
|
added subscriber Simon Déziel |
| 2018-02-20 15:07:11 |
Christian Ehrhardt |
attachment added |
|
Backport of 2.11.0-2ubuntu5 fix to Xenial to fix 1670408 https://bugs.launchpad.net/ubuntu/+source/tor/+bug/1670408/+attachment/5058995/+files/xenial-base-journald-updates.debdiff |
|
| 2018-02-20 15:07:30 |
Christian Ehrhardt |
bug |
|
|
added subscriber Jamie Strandboge |
| 2018-02-20 16:21:43 |
Ubuntu Foundations Team Bug Bot |
tags |
bitesize server-next |
bitesize patch server-next |
|
| 2018-02-21 08:59:30 |
Christian Ehrhardt |
description |
Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor fails to start after installing the tor package. "systemctl status tor@default" reports:
Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, code=killed, status=11/SEGV
Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network for TCP.
Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed state.
Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 'signal'.
There are two AppArmor denials in the kernel log:
Mar 6 15:53:12 zesty-test kernel: [ 102.699647] audit: type=1400 audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit" namespace="root//lxd-zesty_<var-lib-lxd>" profile="system_tor" name="/run/systemd/journal/stdout" pid=3520 comm="tor" requested_mask="wr" denied_mask="wr" fsuid=100000 ouid=100000
Mar 6 15:53:12 zesty-test kernel: [ 102.702418] audit: type=1400 audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap" namespace="root//lxd-zesty_<var-lib-lxd>" profile="system_tor" name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m" denied_mask="m" fsuid=100000 ouid=100000
Workaround: add the following two lines to /etc/apparmor.d/system_tor:
/usr/bin/tor m,
/run/systemd/journal/stdout rw,
I couldn't remember how to that that profile reloaded, so I rebooted, and after the reboot tor does start up successfully. "systemctl tor@default" reports it as running.
I haven't checked to see if only one or other rule is actually required.
Importance -> High since this bug makes the package unusable in its default configuration on Zesty. Since the AppArmor profile comes from Debian's 0.2.9.9-1, this should probably be fixed in Debian. |
[Impact]
* The base abstraction in xenial misses some ways programs can push
logs to journald
* Backport the fix form Artful to:
1. get rid of the Denies making logs less readable
2. get users to see the actual log entries will help to unbreak many
other cases
[Test Case]
* Install one of the affected packages (in a xenial container is enough)
* For the case of ntp just install and then run
systemctl restart ntp
* in Dmesg you'll see apparmor Denies like
apparmor="DENIED"
operation="file_inherit"
profile="/usr/sbin/ntpd"
name="/run/systemd/journal/stdout"
* Each case is different, in this (ntp) case also some log entries are
missed due to the block
* After installing the fixed package there is no Deny anymore and
programs are able to correctly log.
[Regression Potential]
* The change is in ubuntu as-is since artful and we are only opening up,
but not limiting the access - so there should be nothing that is denied
after the update that was not before.
Vice versa there could be changes due to things now working correcrly,
but I'd not see that as a regression.
[Other Info]
* affects many packages ntp, tor - I even heard examples of mysql.
But the fix is in apparmor through base abstraction
---
Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor fails to start after installing the tor package. "systemctl status tor@default" reports:
Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, code=killed, status=11/SEGV
Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network for TCP.
Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed state.
Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 'signal'.
There are two AppArmor denials in the kernel log:
Mar 6 15:53:12 zesty-test kernel: [ 102.699647] audit: type=1400 audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit" namespace="root//lxd-zesty_<var-lib-lxd>" profile="system_tor" name="/run/systemd/journal/stdout" pid=3520 comm="tor" requested_mask="wr" denied_mask="wr" fsuid=100000 ouid=100000
Mar 6 15:53:12 zesty-test kernel: [ 102.702418] audit: type=1400 audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap" namespace="root//lxd-zesty_<var-lib-lxd>" profile="system_tor" name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m" denied_mask="m" fsuid=100000 ouid=100000
Workaround: add the following two lines to /etc/apparmor.d/system_tor:
/usr/bin/tor m,
/run/systemd/journal/stdout rw,
I couldn't remember how to that that profile reloaded, so I rebooted, and after the reboot tor does start up successfully. "systemctl tor@default" reports it as running.
I haven't checked to see if only one or other rule is actually required.
Importance -> High since this bug makes the package unusable in its default configuration on Zesty. Since the AppArmor profile comes from Debian's 0.2.9.9-1, this should probably be fixed in Debian. |
|
| 2018-02-21 13:21:52 |
Chris J Arges |
apparmor (Ubuntu Xenial): status |
Triaged |
Fix Committed |
|
| 2018-02-21 13:21:53 |
Chris J Arges |
bug |
|
|
added subscriber Ubuntu Stable Release Updates Team |
| 2018-02-21 13:21:55 |
Chris J Arges |
bug |
|
|
added subscriber SRU Verification |
| 2018-02-21 13:21:58 |
Chris J Arges |
tags |
bitesize patch server-next |
bitesize patch server-next verification-needed verification-needed-xenial |
|
| 2018-02-21 16:00:21 |
Christian Ehrhardt |
tags |
bitesize patch server-next verification-needed verification-needed-xenial |
bitesize patch server-next verification-done verification-done-xenial |
|
| 2018-03-12 10:37:49 |
Launchpad Janitor |
apparmor (Ubuntu Xenial): status |
Fix Committed |
Fix Released |
|
| 2018-03-12 10:37:54 |
Łukasz Zemczak |
removed subscriber Ubuntu Stable Release Updates Team |
|
|
|
| 2018-04-13 14:14:09 |
Robie Basak |
ntp (Ubuntu): status |
Confirmed |
Fix Released |
|
| 2018-04-13 14:14:12 |
Robie Basak |
ntp (Ubuntu): status |
Fix Released |
Invalid |
|
| 2018-04-13 14:14:15 |
Robie Basak |
tor (Ubuntu): status |
Confirmed |
Invalid |
|
