DNS resolving doesn't work in complain mode with dnsmasq and apparmor
Bug #1703520 reported by
Bjoern O.
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apparmor (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
After i have firefox, chromium-browser and dnsmasq profiled with sudo aa-autodep (complain-mode was used), i can not resolving websites. (Log is at the attachement)
I have copied the profiles of the three programms from the top in /etc/apparmor.
The network manager can connect with my router the whole time.
I'm have Ubuntu 16.04.02 LTS with all updates. (11.07.2017 CEST)
Did you by chance change anything related to dnsmasq's startup? This looks like dnsmasq is now starting in a private filesystem namespace without access to the dbus sockets. It's possible to adapt the AppArmor profile for this (by adding the attach_disconnected flag to the profile) but the downside is that AppArmor will then attach all paths not in the namespace to / which might allow e.g. a chroot etc/shadow to also allow access to non-chroot /etc/shadow.
Thanks