logprof doesn't handle log messages without denied or requested masks correctly

Bug #652674 reported by Jesse Michael on 2010-10-01
16
This bug affects 2 people
Affects Status Importance Assigned to Milestone
AppArmor
Undecided
Unassigned
2.5
Medium
Unassigned
apparmor (Ubuntu)
Medium
Jamie Strandboge
Lucid
Medium
Jamie Strandboge
Maverick
Medium
Jamie Strandboge
Natty
Medium
Jamie Strandboge

Bug Description

SRU

1. when loading, unloading and replacing policy, AppArmor leaves a message in kern.log. When aa-logprof encounters this, it will spew many confusing warning messages.

2. The bug has not been addressed in the development branch (natty is not open yet)

3. Patch is from r1440 of 2.5 branch (linked to this bug)

4. TEST CASE:
$ echo 'Oct 14 07:14:13 bug652674 kernel: [ 5.429706] type=1400 audit(1287058453.835:9): apparmor="STATUS" operation="profile_load" name="/usr/share/gdm/guest-session/Xsession" pid=1201 comm="apparmor_parser"' > /tmp/log
$ sudo aa-logprof -f /tmp/log # may be prompted to enable the repository. Choose 'Ask later'

5. The regression potential is considered low. The fix does not affect the boot or shutdown process.

Binary package hint: apparmor

When aa-logprof runs into log messages that don't have denied or requested masks, like the following status message, it ends up trying to perform a string operation on an undefined variable which causes warnings to be printed to the console.

    [ 9.633452] type=1400 audit(1285899118.285:5): apparmor="STATUS" operation="profile_replace" name="/sbin/dhclient3" pid=912 comm="apparmor_parser"

I'm attaching a patch to fix this.

ProblemType: Bug
DistroRelease: Ubuntu 10.10
Package: apparmor 2.5.1~rc1-0ubuntu2
ProcVersionSignature: Ubuntu 2.6.35-22.33-generic 2.6.35.4
Uname: Linux 2.6.35-22-generic x86_64
NonfreeKernelModules: nvidia
Architecture: amd64
Date: Thu Sep 30 21:16:25 2010
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Release Candidate amd64 (20100928)
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.utf8
 SHELL=/bin/bash
SourcePackage: apparmor

Jesse Michael (jesse.michael) wrote :
Jürgen Kreileder (jk) wrote :

This is a regression from lucid. I just upgraded one machine to maverick and now aa-logprof spits out thousands of warnings.
Jesse's patch looks fine.

tags: added: patch
Steve Beattie (sbeattie) wrote :

This was fixed in trunk upstream revision 1390. I'm accepting this as a nomination for upstream's 2.5.2 release.

Changed in apparmor:
status: New → Fix Released
Changed in apparmor (Ubuntu):
status: New → Triaged
importance: Undecided → Medium
Changed in apparmor (Ubuntu Maverick):
status: New → In Progress
importance: Undecided → Medium
assignee: nobody → Jamie Strandboge (jdstrand)
Changed in apparmor (Ubuntu Natty):
assignee: nobody → Jamie Strandboge (jdstrand)
Jamie Strandboge (jdstrand) wrote :

SRU

1. when loading, unloading and replacing policy, AppArmor leaves a message in kern.log. When aa-logprof encounters this, it will spew many confusing warning messages.

2. The bug has not been addressed in the development branch (natty is not open yet)

3. Patch is from r1440 of 2.5 branch (linked to this bug)

4. TEST CASE:
$ echo 'Oct 14 07:14:13 bug652674 kernel: [ 5.429706] type=1400 audit(1287058453.835:9): apparmor="STATUS" operation="profile_load" name="/usr/share/gdm/guest-session/Xsession" pid=1201 comm="apparmor_parser"' > /tmp/log
$ sudo aa-logprof -f /tmp/log # may be prompted to enable the repository. Choose 'Ask later'

5. The regression potential is considered low. The fix does not affect the boot or shutdown process.

Changed in apparmor (Ubuntu Maverick):
milestone: none → maverick-updates
Jamie Strandboge (jdstrand) wrote :

Uploaded 2.5.1-0ubuntu0.10.10.1 to maverick-proposed.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.5.1-0ubuntu1

---------------
apparmor (2.5.1-0ubuntu1) natty; urgency=low

  * New upstream release (LP: #660077)
    - The following patches were refreshed:
      + 0001-fix-release.patch
      + 0003-local-includes.patch
      + 0008-lp648900.patch: renamed as 0005-lp648900.patch
    - The following patches were dropped (included upstream):
      + 0005-lp601583.patch
      + 0006-network-interface-enumeration.patch
      + 0007-gnome-updates.patch
  * debian/patches/0006-testsuite-fixes.patch: testsuite fixes from head
    of 2.5 branch. These are needed for QRT and SRU testing (LP: #652211)
  * debian/patches/0007-honor-cflags.patch: have the parser makefile honor
    CFLAGS environment variable. Brings back missing symbols for the retracer
  * debian/patches/0008-lp652674.patch: fix warnings for messages without
    denied or requested masks (LP: #652674)
  * debian/apparmor.init: fix path to aa-status (LP: #654841)
  * debian/apport/source_apparmor.py: apport hook should use
    root_command_hook() for running apparmor_status (LP: #655529)
  * debian/apport/source_apparmor.py: use ProcKernelCmdline and don't clobber
    cmdline details (LP: #657091)
 -- Jamie Strandboge <email address hidden> Fri, 15 Oct 2010 12:23:00 -0500

Changed in apparmor (Ubuntu Natty):
status: Triaged → Fix Released

Accepted apparmor into maverick-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Changed in apparmor (Ubuntu Maverick):
status: In Progress → Fix Committed
tags: added: verification-needed
Changed in apparmor (Ubuntu Lucid):
assignee: nobody → Jamie Strandboge (jdstrand)
importance: Undecided → Medium
milestone: none → lucid-updates
status: New → In Progress
description: updated
Jamie Strandboge (jdstrand) wrote :

Upgraded to 2.5.1-0ubuntu0.10.10.2 in two clean up to date VMs (amd64 and i386) and this issue is resolved.

Martin Pitt (pitti) on 2010-11-15
tags: added: verification-done
removed: verification-needed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.5.1-0ubuntu0.10.10.2

---------------
apparmor (2.5.1-0ubuntu0.10.10.2) maverick-proposed; urgency=low

  * New upstream release (LP: #660077)
    - The following patches were refreshed:
      + 0001-fix-release.patch
      + 0003-local-includes.patch
      + 0004-ubuntu-abstractions-updates.patch
      + 0008-lp648900.patch: renamed as 0005-lp648900.patch
    - The following patches were dropped (included upstream):
      + 0005-lp601583.patch
      + 0006-network-interface-enumeration.patch
      + 0007-gnome-updates.patch
  * debian/patches/0006-testsuite-fixes.patch: testsuite fixes from head
    of 2.5 branch. These are needed for QRT and SRU testing (LP: #652211)
  * debian/patches/0007-honor-cflags.patch: have the parser makefile honor
    CFLAGS environment variable. Brings back missing symbols for the retracer
  * debian/patches/0008-lp652674.patch: fix warnings for messages without
    denied or requested masks (LP: #652674)
  * debian/apparmor.init: fix path to aa-status (LP: #654841)
  * debian/apport/source_apparmor.py: apport hook should use
    root_command_hook() for running apparmor_status (LP: #655529)
  * debian/apport/source_apparmor.py: use ProcKernelCmdline and don't clobber
    cmdline details (LP: #657091)
  * debian/{rules,control}: move apache2 abstractions into the base package
    so we can put apache2 profiles into the -profiles package without
    aa-logprof bailing out. Patch by Marc Deslauriers.
    (LP: #539441)
  * debian/patches/0009-sensible-browser-pix.patch: use Pix with
    sensible-browser
  * debian/patches/0010-ubuntu-buildd.patch: skip parser caching test if
    the AppArmor securityfs introspection directory is not mounted, as
    is the case on Ubuntu buildds.
 -- Jamie Strandboge <email address hidden> Tue, 02 Nov 2010 12:04:06 -0500

Changed in apparmor (Ubuntu Maverick):
status: Fix Committed → Fix Released
Martin Pitt (pitti) wrote :

Accepted apparmor into lucid-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Changed in apparmor (Ubuntu Lucid):
status: In Progress → Fix Committed
tags: removed: verification-done
tags: added: verification-needed
Jamie Strandboge (jdstrand) wrote :

While this does not affect Lucid release, it could affect Lucid users who use the backported LTS kernel. Upgraded to 2.5.1-0ubuntu0.10.04.1 in lucid-proposed then booted into both the lucid-security (Ubuntu 2.6.32-26.48-generic 2.6.32.24+drm33.11) kernel and into the linux-image-generic-lts-backport-maverick (Ubuntu 2.6.35-22.35~lucid1-generic 2.6.35.4) kernel from lucid-proposed and aa-logprof behaves properly.

Martin Pitt (pitti) on 2010-12-14
tags: added: verification-done
removed: verification-needed
Launchpad Janitor (janitor) wrote :
Download full text (10.1 KiB)

This bug was fixed in the package apparmor - 2.5.1-0ubuntu0.10.04.1

---------------
apparmor (2.5.1-0ubuntu0.10.04.1) lucid-proposed; urgency=low

  * Backport 2.5.1-0ubuntu0.10.10.1 from maverick for userspace tools to work
    with newer kernels (LP: #660077)
    NOTE: user-tmp now uses 'owner' match, so non-default profiles will have
    to be adjusted when 2 separately confined applications that both use the
    user-tmp abstraction depend on being able to cooperatively share files
    with each other in /tmp or /var/tmp.
  * remove the following patches (features not appropriate for SRU):
    - 0002-add-chromium-browser.patch
    - 0003-local-includes.patch
    - 0004-ubuntu-abstractions-updates.patch
  * debian/rules (this makes it the same as what was shipped in 10.04 LTS
    release):
    - don't ship aa-update-browser and its man page (requires
      0004-ubuntu-abstractions-updates.patch)
    - don't ship apparmor.d/local/ (requires 0003-local-includes.patch)
    - don't use dh_apparmor (not in Ubuntu 10.04 LTS)
    - don't ship chromium profile
  * remove debian/profiles/chromium-browser
  * remove debian/aa-update-browser*
  * debian/apparmor-profiles.postinst: revert to that in lucid release
    (requires dh_apparmor and 0002-add-chromium-browser.patch)
  * remove debian/apparmor-profiles.postrm: doesn't make sense without
    0002-add-chromium-browser.patch
  * debian/control:
    - revert Build-Depends on debhelper (>= 5)
    - revert Standards-Version to 3.8.4
    - revert Vcs-Bzr
    - use Conflicts/Replaces version that was in Ubuntu 10.04 LTS
  * debian/patches/0011-lucid-compat-dbus.patch: move /var/lib/dbus/machine-id
    back into dbus, since profiles on 10.04 LTS expect it there
  * debian/patches/0012-lucid-compat-kde.patch: add kde4-config to kde
    abstraction, since the firefox profile on Ubuntu 10.04 LTS expects it to
    be there

apparmor (2.5.1-0ubuntu0.10.10.2) maverick-proposed; urgency=low

  * New upstream release (LP: #660077)
    - The following patches were refreshed:
      + 0001-fix-release.patch
      + 0003-local-includes.patch
      + 0004-ubuntu-abstractions-updates.patch
      + 0008-lp648900.patch: renamed as 0005-lp648900.patch
    - The following patches were dropped (included upstream):
      + 0005-lp601583.patch
      + 0006-network-interface-enumeration.patch
      + 0007-gnome-updates.patch
  * debian/patches/0006-testsuite-fixes.patch: testsuite fixes from head
    of 2.5 branch. These are needed for QRT and SRU testing (LP: #652211)
  * debian/patches/0007-honor-cflags.patch: have the parser makefile honor
    CFLAGS environment variable. Brings back missing symbols for the retracer
  * debian/patches/0008-lp652674.patch: fix warnings for messages without
    denied or requested masks (LP: #652674)
  * debian/apparmor.init: fix path to aa-status (LP: #654841)
  * debian/apport/source_apparmor.py: apport hook should use
    root_command_hook() for running apparmor_status (LP: #655529)
  * debian/apport/source_apparmor.py: use ProcKernelCmdline and don't clobber
    cmdline details (LP: #657091)
  * debian/{rules,control}: move apache2 abstractions into the base package
    so we can put ...

Changed in apparmor (Ubuntu Lucid):
status: Fix Committed → Fix Released
Steve Beattie (sbeattie) wrote :

Closing the apparmor 2.5 task, apparmor 2.5.2 was released.

tags: added: testcase
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers