apparmor rules block ejabberdctl

[Hadmut Danisch]

Hi,

I am just trying to install ejabberd in a fresh Ubuntu 16.04 LXD container running on a 16.10 host.

I found that I cannot run ejabberdctl directly as root:

# ejabberdctl
/usr/sbin/ejabberdctl: line 428: 2886 Segmentation fault $EXEC_CMD "$CMD"

strace reveals what happens:

2861 execve("/bin/su", ["su", "ejabberd", "-c", "/usr/bin/erl -sname ctl-2841-ejabberd -noinput -hidden -s ejabberd_ctl -extra ejabberd "], [/* 23 vars */]) = -1 EACCES (Permission denied)
2861 --- SIGSEGV {si_signo=SIGSEGV, si_code=SI_KERNEL, si_addr=0} ---
2861 +++ killed by SIGSEGV +++

It is not allowed to execute su to become ejabberd, because apparmor does not allow this:

[ 7827.594020] audit: type=1400 audit(1485515038.865:156): apparmor="DENIED" operation="file_mmap" namespace="root//lxd-ansitest_<var-lib-lxd>" profile="/usr/sbin/ejabberdctl//su" name="/bin/su" pid=12861 comm="su" requested_mask="m" denied_mask="m" fsuid=165536 ouid=165536

But if I do it the other way round (i.e. su outside of ejabberdctl), it works:

su ejabberd -c ejabberdctl

since then the su is not covered by the apparmor profile of ejabberdctl.

Is that behaviour intended?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Blue Duck (blueduck)]

Hi,

Just same issue here.

Tried to stop and disable apparmor, reboot... same segmentation fault.

[Kees Cook (kees)]

Add "m" to /etc/apparmor.d/usr.sbin.ejabberdctl's "su" subprofile on /bin/su line:

                /bin/su rm,

[Blue Duck (blueduck)]

Hi Kees,

Your tip solve my issue: many thanks!

I tried to understand this change, but my english and admin skills are not sufficient; nevertheless, here are the references: https://www.novell.com/documentation/apparmor/apparmor201_sp10_admin/data/bx5bmls.html

[Launchpad Janitor (janitor)]

This bug was fixed in the package ejabberd - 17.07-1

---------------
ejabberd (17.07-1) unstable; urgency=medium

  * New upstream version 17.07 (Closes: #867723)
  * Updated Standards-Version: 4.0.0 (no changes needed)
  * Updated years in debian/copyright
  * Updated (Build-)Depends
  * Refreshed patches for ejabberd 17.07
  * Updated debian/rules
  * Added NEWS entry regarding configuration changes

 -- Philipp Huebner <email address hidden> Fri, 14 Jul 2017 12:12:13 +0200

[Simon Arlott (sa.me.uk)]

This is also an issue on 16.04, logrotate continually fails to execute ejabberdctl after an apparmour update:
[413761.100538] audit: type=1400 audit(1560125582.853:33): apparmor="DENIED" operation="file_mmap" profile="/usr/sbin/ejabberdctl//su" name="/bin/su" pid=5366 comm="su" requested_mask="m" denied_mask="m" fsuid=0 ouid=0

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.