apparmor denial to /sys/devices/system/cpu/online

[Jamie Strandboge]

After upgrading to the latest eglibc today, applications are having the following apparmor denial:

type=AVC msg=audit(1328794019.772:83): apparmor="DENIED" operation="open" parent=3049 profile="/usr/lib/telepathy/mission-control-5" name="/sys/devices/system/cpu/online" pid=3053 comm="mission-control" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
type=AVC msg=audit(1328794257.880:94): apparmor="DENIED" operation="open" parent=3886 profile="/usr/lib/telepathy/telepathy-*" name="/sys/devices/system/cpu/online" pid=3894 comm=64636F6E6620776F726B6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

The following should go into the base abstraction:
/sys/devices/system/cpu/online r,

This seems to have been introduced in the following commit:
http://repo.or.cz/w/glibc.git/commitdiff/84e2a551a72c79b020694bb327e33b6d71b09b63

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor - 2.7.0-0ubuntu5

---------------
apparmor (2.7.0-0ubuntu5) precise; urgency=low

  * debian/patches/0036-lp929531.patch: adjust base abstraction to allow read
    access to /sys/devices/system/cpu/online (LP: #929531)
 -- Jamie Strandboge <email address hidden> Thu, 09 Feb 2012 08:04:13 -0600

[Steve Beattie (sbeattie)]

Committed in upstream lp:apprmor revno 1935

[CuteChaps (sh-senthilkumar)]

I am running on Ubuntu 12.04 final release and I can see the same error repeating.

[ 133.129232] type=1400 audit(1335636601.398:27): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/telepathy/mission-control-5" name="/usr/share/gvfs/remote-volume-monitors/" pid=3171 comm="mission-control" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

root@Senthil-IN:~# dpkg -l |grep apparmor
ii apparmor 2.7.102-0ubuntu3 User-space parser utility for AppArmor
ii dh-apparmor 2.7.102-0ubuntu3 AppArmor debhelper routines
root@Senthil-IN:~#

[Steve Beattie (sbeattie)]

@CuteChaps: your rejection is a different thing (note the 'name="/usr/share/gvfs/remote-volume-monitors/"'); please file a separate bug report if its still an issue for you.

[Steve Beattie (sbeattie)]

This was fixed in the apparmor 2.8.0 release, closing the apparmor task.