Confined executable script needs 'mrix' rule on its shebang only when running inside LXD
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apparmor (Ubuntu) |
New
|
Undecided
|
Unassigned | ||
wsdd (Ubuntu) |
Fix Released
|
Medium
|
Alessandro Astone |
Bug Description
I'm writing the AppArmor policy for a python script installed as executable at `/usr/bin/wsdd`
The script has the following shebang: `#!/usr/bin/env python3`
With the aid of aa-logprof I came up with the following rules for enabling the execution of this script:
/usr/bin/env ix,
/{,usr/
/usr/bin/wsdd r,
It works correctly on my machine. However when running the same program with the same profile inside an LXD container, executing /usr/bin/wsdd fails with "Segmentation fault".
Running it in `strace` shows:
execve(
+++ killed by SIGSEGV +++
And the host journal shows:
Jul 19 12:32:00 thinkpad kernel: audit: type=1400 audit(172138512
The audit indicates that AppArmor is preventing mmap of /usr/bin/env, the program specified in the shebang.
Indeed changing the rule from `/usr/bin/env ix` to `/usr/bin/env mrix` solves the issue.
But why is `mrix` only required inside LXD?
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: apparmor 4.0.1really4.
ProcVersionSign
Uname: Linux 6.8.0-40-generic x86_64
NonfreeKernelMo
ApportVersion: 2.28.1-0ubuntu3
Architecture: amd64
CasperMD5CheckR
CurrentDesktop: ubuntu:GNOME
Date: Fri Jul 19 12:17:54 2024
InstallationDate: Installed on 2024-06-16 (33 days ago)
InstallationMedia: Ubuntu 24.04 LTS "Noble Numbat" - Release amd64 (20240424)
ProcKernelCmdline: BOOT_IMAGE=
SourcePackage: apparmor
UpgradeStatus: No upgrade log present (probably fresh install)
Changed in wsdd (Ubuntu): | |
status: | In Progress → Fix Committed |
This bug was fixed in the package wsdd - 2:0.8-2ubuntu3
---------------
wsdd (2:0.8-2ubuntu3) oracular; urgency=medium
* Set XDG_RUNTIME_DIR in autopkgtest
-- Alessandro Astone <email address hidden> Tue, 23 Jul 2024 09:21:36 +0200