missing apparmor rules
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| | mysql-5.7 (Ubuntu) |
Low
|
Robie Basak | ||
| | mysql-8.0 (Ubuntu) |
Medium
|
Robie Basak | ||
Bug Description
Missing from apparmor rules:
/sys/
/sys/
| Simon Déziel (sdeziel) wrote : | #2 |
I'm also noticing those on Xenial systems:
audit: type=1400 audit(148538277
audit: type=1400 audit(148538277
On the affected system, there was no noticeable impact (yet?) other than the denials, so I'd say it's low impact.
On top of the rules mentioned by Kees, adding this one would silence the other denial:
owner @{PROC}
Once all 3 rules were added to a test system, no more denials were logged.
| Kees Cook (kees) wrote : | #3 |
I added this to the base profile, since other processes tripped over that one. (It's in a separate bug report)
| Christian Ehrhardt (paelzer) wrote : | #4 |
Thank you Simon and Kees,
I personally would not want it allowed in my base profile - but I'll leave that for the other bug to decide.
We certainly can consider adding it to mysql together with the others.
I feel relieved that the impact seems low, but OTOH that means it likely boils down to a community effort.
So if one wants to provide a debdiff to be reviewed and integrated, please go for it.
| Changed in mysql-5.7 (Ubuntu): | |
| status: | Incomplete → Confirmed |
| importance: | Undecided → Low |
| status: | Confirmed → Triaged |
| Simon Déziel (sdeziel) wrote : | #5 |
The addition of "@{PROC}
| tags: | added: bionic xenial |
| Jared Fernandez (jared-fernandez) wrote : | #6 |
Seeing these log entries in Bionic:
audit: type=1400 audit(152512878
audit: type=1400 audit(152512878
audit: type=1400 audit(152512878
audit: type=1400 audit(152512878
audit: type=1400 audit(152512878
audit: type=1400 audit(152512878
audit: type=1400 audit(152512879
audit: type=1400 audit(152512879
audit: type=1400 audit(152512879
| Pavel Malyshev (afunix) wrote : | #7 |
# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.5 LTS
Release: 16.04
Codename: xenial
# grep denied /var/log/
type=AVC msg=audit(
type=AVC msg=audit(
| Andreas Hasenack (ahasenack) wrote : | #8 |
@afunix, was this a fresh xenial 16.04.5 install, or an upgrade from a previous release?
Can you list the mysql and apparmor packages you have installed?
| Andreas Hasenack (ahasenack) wrote : | #9 |
Confirmed I also see this on bionic.
| Andreas Hasenack (ahasenack) wrote : | #10 |
And also still present in disco:
[ter nov 20 15:38:42 2018] audit: type=1400 audit(154274162
[ter nov 20 15:38:42 2018] audit: type=1400 audit(154274162
[ter nov 20 15:38:42 2018] audit: type=1400 audit(154274162
| Antonio (tonecas) wrote : | #11 |
also confirming on:
Kernel: 4.15.0-46-generic x86_64 bits: 64 Desktop: Xfce 4.12.3 Distro: Ubuntu 18.04.2 LTS
-- Unit mysql.service has begun starting up.
mar 15 23:48:50 Work audit[25035]: AVC apparmor="DENIED" operation="open" profile=
mar 15 23:48:50 Work kernel: audit: type=1400 audit(155269373
mar 15 23:48:50 Work audit[25035]: AVC apparmor="DENIED" operation="capable" profile=
mar 15 23:48:50 Work kernel: audit: type=1400 audit(155269373
mar 15 23:48:50 Work audit[25037]: AVC apparmor="DENIED" operation="open" profile=
mar 15 23:48:50 Work kernel: audit: type=1400 audit(155269373
mar 15 23:48:50 Work systemd[1]: Started MySQL Community Server.
| Antonio (tonecas) wrote : | #12 |
in my case, to have a clean MySQL start, had to do this:
sudo nano /etc/apparmor.
# add
capability dac_read_search,
/sys/
/sys/
/sys/
/sys/
sudo apparmor_parser -r /etc/apparmor.
service mysql restart
On eoan, we need to add even more lines (I prefer to use /etc/apparmor.
dbus send
bus=system
capability dac_read_search,
/proc/*/status r,
/sys/
/sys/
| Andreas Hasenack (ahasenack) wrote : | #14 |
eoan will have mysql-8 soon, so I installed it from proposed to verify.
These are the DENIED messages I got right after installation:
[ 580.067210] audit: type=1400 audit(156630497
[ 580.068837] audit: type=1400 audit(156630497
[ 580.088987] audit: type=1107 audit(156630497
[ 580.091224] audit: type=1400 audit(156630497
[ 580.104218] audit: type=1400 audit(156630497
[ 580.347414] audit: type=1400 audit(156630497
[ 580.861280] audit: type=1400 audit(156630497
| Changed in mysql-8.0 (Ubuntu): | |
| status: | New → Triaged |
| importance: | Undecided → Medium |
| tags: | added: server-next |
| Andreas Hasenack (ahasenack) wrote : | #15 |
Tagging server-next mainly because of mysql-8, so we fix this finally, and then SRUs can be considered.
| Changed in mysql-8.0 (Ubuntu): | |
| assignee: | nobody → Robie Basak (racb) |
| Changed in mysql-5.7 (Ubuntu): | |
| assignee: | nobody → Christian Ehrhardt (paelzer) |
| assignee: | Christian Ehrhardt (paelzer) → Robie Basak (racb) |
| tags: | added: bitesize |
| Lars Tangvald (lars-tangvald) wrote : | #16 |
I think I have most of these fixed now, but am a bit confused about the org.freedesktop
| Launchpad Janitor (janitor) wrote : | #17 |
This bug was fixed in the package mysql-8.0 - 8.0.17-0ubuntu2
---------------
mysql-8.0 (8.0.17-0ubuntu2) eoan; urgency=medium
[ Robie Basak ]
* Ship missing files newly built since MySQL 8.0:
libmysqlrou
mysqlrouter
* Ship missing mysql_clone.so MySQL plugin, newly built since
8.0.17.
* Protect against future new build files from being missed:
- Add debian/
- Switch from --list-missing to --fail-missing
[ Lars Tangvald ]
* Fix failing autopkgtest mysql_os_user.
* d/mysql-
the upstream recommended mechanism caching_
default root user when a default root password is set via debconf
(this is not the default case).
* d/mysql-
done automatically by the MySQL daemon on startup.
* d/additions/
(LP: #1658233).
* d/copyright: add missing entries for clone and ddl_rewriter plugins.
-- Robie Basak <email address hidden> Wed, 09 Oct 2019 14:03:12 +0100
| Changed in mysql-8.0 (Ubuntu): | |
| status: | Triaged → Fix Released |
| Launchpad Janitor (janitor) wrote : | #18 |
This bug was fixed in the package mysql-5.7 - 5.7.28-
---------------
mysql-5.7 (5.7.28-
* SECURITY UPDATE: Update to 5.7.28 to fix security issues
- CVE-2019-2910, CVE-2019-2911, CVE-2019-2914, CVE-2019-2922,
CVE-
CVE-
CVE-2019-2993
* Removed patches no longer required:
- debian/
* debian/rules: removed -DWITH_SSL=bundled, option no longer works.
* debian/control: add libssl-dev to Build-Depends.
* d/additions/
(LP: #1658233).
-- Marc Deslauriers <email address hidden> Fri, 15 Nov 2019 08:23:09 -0500
| Changed in mysql-5.7 (Ubuntu): | |
| status: | Triaged → Fix Released |
| Launchpad Janitor (janitor) wrote : | #19 |
This bug was fixed in the package mysql-5.7 - 5.7.28-
---------------
mysql-5.7 (5.7.28-
* SECURITY UPDATE: Update to 5.7.28 to fix security issues
- CVE-2019-2910, CVE-2019-2911, CVE-2019-2914, CVE-2019-2922,
CVE-
CVE-
CVE-2019-2993
* Removed patches no longer required:
- debian/
* debian/rules: removed -DWITH_SSL=bundled, option no longer works.
* debian/control: add libssl-dev to Build-Depends.
* d/additions/
(LP: #1658233).
-- Marc Deslauriers <email address hidden> Fri, 15 Nov 2019 08:23:09 -0500
| Changed in mysql-5.7 (Ubuntu): | |
| status: | Triaged → Fix Released |
| Launchpad Janitor (janitor) wrote : | #20 |
This bug was fixed in the package mysql-5.7 - 5.7.28-
---------------
mysql-5.7 (5.7.28-
* SECURITY UPDATE: Update to 5.7.28 to fix security issues
- CVE-2019-2910, CVE-2019-2911, CVE-2019-2914, CVE-2019-2922,
CVE-
CVE-
CVE-2019-2993
* Removed patches no longer required:
- debian/
* debian/rules: removed -DWITH_SSL=bundled, option no longer works.
* debian/control: add libssl-dev to Build-Depends.
* d/additions/
(LP: #1658233).
-- Marc Deslauriers <email address hidden> Fri, 15 Nov 2019 08:23:09 -0500
| Changed in mysql-5.7 (Ubuntu): | |
| status: | Triaged → Fix Released |
Hi,
thank you for your report and your help to make Ubuntu better!
We build with libnuma-dev which should auto-enable https:/
Might I ask you to describe what effect you see by this missing (other than the Denie in the log) - just to help rating the importance and urgency.
If you happen to brute force it disabled (not recommended in the long run) via
ln -s /etc/apparmor.
apparmor_parser -R /etc/apparmor.
Does it give you any extra capability/feature that was missing before?
The reason I ask is that there are quite often non-fatal denies like that which e.g. do not need an SRU. While at other times they almost disables a feature like it could do to numa in this case.