apparmor profile denials with latest sun-java6

Bug #633369 reported by Jamie Strandboge on 2010-09-08
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
Medium
Jamie Strandboge
Karmic
Undecided
Unassigned
Lucid
Undecided
Unassigned
Maverick
Medium
Jamie Strandboge
firefox (Ubuntu)
Undecided
Unassigned
Karmic
Medium
Jamie Strandboge
Lucid
Medium
Jamie Strandboge
Maverick
Undecided
Unassigned

Bug Description

Binary package hint: firefox

With sun-java6-plugin 6.20dlj, apparmor causes the following denials:
[ 3405.519958] type=1503 audit(1283963411.764:34): operation="file_mmap" pid=7959 parent=7943 profile="/usr/lib/firefox-3.6.9/firefox-*bin//firefox_java" requested_mask="mr::" denied_mask="m::" fsuid=1000 ouid=1000 name="/home/jamie/.fontconfig/e13b20fdb08344e0e664864cc2ede53d-x86.cache-2"
[ 3405.526024] type=1503 audit(1283963411.772:35): operation="open" pid=7959 parent=7943 profile="/usr/lib/firefox-3.6.9/firefox-*bin//firefox_java" requested_mask="::r" denied_mask="::r" fsuid=1000 ouid=0 name="/etc/debian_version"
[ 3405.526111] type=1503 audit(1283963411.772:36): operation="open" pid=7959 parent=7943 profile="/usr/lib/firefox-3.6.9/firefox-*bin//firefox_java" requested_mask="::r" denied_mask="::r" fsuid=1000 ouid=0 name="/proc/loadavg"

Attached is a patch for firefox 9.10. It should also be applied to 10.04. Maverick will be fixed in the apparmor package.

Jamie Strandboge (jdstrand) wrote :
Changed in firefox (Ubuntu):
status: New → Triaged
Changed in firefox (Ubuntu Maverick):
status: Triaged → Invalid
Changed in firefox (Ubuntu Lucid):
status: New → Triaged
Changed in firefox (Ubuntu Karmic):
status: New → Triaged
Changed in apparmor (Ubuntu Karmic):
status: New → Invalid
Changed in apparmor (Ubuntu Maverick):
status: New → Triaged
assignee: nobody → Jamie Strandboge (jdstrand)
importance: Undecided → Medium
Changed in apparmor (Ubuntu Lucid):
status: New → Invalid
Changed in apparmor (Ubuntu Maverick):
milestone: none → ubuntu-10.10
Changed in apparmor (Ubuntu Maverick):
status: Triaged → Fix Committed
Changed in firefox (Ubuntu Lucid):
assignee: nobody → Jamie Strandboge (jdstrand)
status: Triaged → Fix Committed
Changed in firefox (Ubuntu Karmic):
assignee: nobody → Jamie Strandboge (jdstrand)
status: Triaged → In Progress
status: In Progress → Fix Committed
importance: Undecided → Medium
Changed in firefox (Ubuntu Lucid):
importance: Undecided → Medium
Changed in apparmor (Ubuntu Maverick):
status: Fix Committed → Fix Released
Colin Watson (cjwatson) wrote :

firefox (3.6.10+build1+nobinonly-0ubuntu1) maverick; urgency=low

  * New upstream release v3.6.10 (FIREFOX_3_6_10_BUILD1)

  [ Chris Coulson <email address hidden> ]
  * Fix "ISO C++ forbids braced-groups within expressions" error on
    GCC < 4.4 (which is also a warning on GCC >= 4.4)
    - update debian/patches/bz591331_att469858_breakpad_allow_ptrace.patch
  * Blacklist plugin-container in Apport
    - update debian/apport/blacklist
  * Fix LP: #637434 - components.list is not installed
    - update debian/firefox.install
  * De-fuzz patches
    - update debian/patches/mozilla-kde.patch

  [ Jamie Strandboge <email address hidden> ]
  * adjust apparmor profile for non-maverick dailies for latest sun-java6
    plugin (LP: #633369)
  * ignore writes to /var/cache/fontconfig for 10.10

 -- Chris Coulson <email address hidden> Wed, 15 Sep 2010 17:50:08 +0100

Changed in firefox (Ubuntu Maverick):
status: Invalid → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package firefox - 3.6.10+build1+nobinonly-0ubuntu0.10.04.1

---------------
firefox (3.6.10+build1+nobinonly-0ubuntu0.10.04.1) lucid-security; urgency=low

  * New usptream release v3.6.10 (FIREFOX_3_6_10_BUILD1)

  [ Jamie Strandboge <email address hidden> ]
  * adjust apparmor profile for latest sun-java6 plugin (LP: #633369)

  [ Chris Coulson <email address hidden> ]
  * Fix LP: #637434 - components.list is not installed
    - update debian/firefox.install
  * De-fuzz patches
    - update debian/patches/mozilla-kde.patch
  * Make sure we actually blacklist firefox and plugin-container in Apport
    - add debian/apport/blacklist
    - update debian/rules
 -- Chris Coulson <email address hidden> Wed, 15 Sep 2010 18:46:13 +0100

Changed in firefox (Ubuntu Lucid):
status: Fix Committed → Fix Released
Changed in firefox (Ubuntu Karmic):
status: Fix Committed → Fix Released

Accepted apparmor into lucid-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

tags: added: verification-needed
Jamie Strandboge (jdstrand) wrote :

Lucid affected, but fixed in firefox package. Maverick fixed in ubuntu-browsers.d/java which is not part of this update. Upgrading to 2.5.1-0ubuntu0.10.04.1 in lucid-proposed showed no regressions.

tags: added: verification-done
removed: verification-needed
Launchpad Janitor (janitor) wrote :
Download full text (10.1 KiB)

This bug was fixed in the package apparmor - 2.5.1-0ubuntu0.10.04.1

---------------
apparmor (2.5.1-0ubuntu0.10.04.1) lucid-proposed; urgency=low

  * Backport 2.5.1-0ubuntu0.10.10.1 from maverick for userspace tools to work
    with newer kernels (LP: #660077)
    NOTE: user-tmp now uses 'owner' match, so non-default profiles will have
    to be adjusted when 2 separately confined applications that both use the
    user-tmp abstraction depend on being able to cooperatively share files
    with each other in /tmp or /var/tmp.
  * remove the following patches (features not appropriate for SRU):
    - 0002-add-chromium-browser.patch
    - 0003-local-includes.patch
    - 0004-ubuntu-abstractions-updates.patch
  * debian/rules (this makes it the same as what was shipped in 10.04 LTS
    release):
    - don't ship aa-update-browser and its man page (requires
      0004-ubuntu-abstractions-updates.patch)
    - don't ship apparmor.d/local/ (requires 0003-local-includes.patch)
    - don't use dh_apparmor (not in Ubuntu 10.04 LTS)
    - don't ship chromium profile
  * remove debian/profiles/chromium-browser
  * remove debian/aa-update-browser*
  * debian/apparmor-profiles.postinst: revert to that in lucid release
    (requires dh_apparmor and 0002-add-chromium-browser.patch)
  * remove debian/apparmor-profiles.postrm: doesn't make sense without
    0002-add-chromium-browser.patch
  * debian/control:
    - revert Build-Depends on debhelper (>= 5)
    - revert Standards-Version to 3.8.4
    - revert Vcs-Bzr
    - use Conflicts/Replaces version that was in Ubuntu 10.04 LTS
  * debian/patches/0011-lucid-compat-dbus.patch: move /var/lib/dbus/machine-id
    back into dbus, since profiles on 10.04 LTS expect it there
  * debian/patches/0012-lucid-compat-kde.patch: add kde4-config to kde
    abstraction, since the firefox profile on Ubuntu 10.04 LTS expects it to
    be there

apparmor (2.5.1-0ubuntu0.10.10.2) maverick-proposed; urgency=low

  * New upstream release (LP: #660077)
    - The following patches were refreshed:
      + 0001-fix-release.patch
      + 0003-local-includes.patch
      + 0004-ubuntu-abstractions-updates.patch
      + 0008-lp648900.patch: renamed as 0005-lp648900.patch
    - The following patches were dropped (included upstream):
      + 0005-lp601583.patch
      + 0006-network-interface-enumeration.patch
      + 0007-gnome-updates.patch
  * debian/patches/0006-testsuite-fixes.patch: testsuite fixes from head
    of 2.5 branch. These are needed for QRT and SRU testing (LP: #652211)
  * debian/patches/0007-honor-cflags.patch: have the parser makefile honor
    CFLAGS environment variable. Brings back missing symbols for the retracer
  * debian/patches/0008-lp652674.patch: fix warnings for messages without
    denied or requested masks (LP: #652674)
  * debian/apparmor.init: fix path to aa-status (LP: #654841)
  * debian/apport/source_apparmor.py: apport hook should use
    root_command_hook() for running apparmor_status (LP: #655529)
  * debian/apport/source_apparmor.py: use ProcKernelCmdline and don't clobber
    cmdline details (LP: #657091)
  * debian/{rules,control}: move apache2 abstractions into the base package
    so we can put ...

Changed in apparmor (Ubuntu Lucid):
status: Invalid → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers