Snap blocks access to system input methods (ibus, fcitx, ...)

Bug #1580463 reported by Sebastien Bacher on 2016-05-11
20
This bug affects 3 people
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
Medium
Tyler Hicks
Xenial
Medium
Tyler Hicks
Yakkety
Medium
Tyler Hicks
im-config (Ubuntu)
Medium
Jamie Strandboge
Xenial
Medium
Jamie Strandboge
Yakkety
Medium
Jamie Strandboge
snapd (Ubuntu)
Medium
Unassigned
Xenial
Medium
Unassigned
Yakkety
Medium
Unassigned

Bug Description

= SRU im-config =
[Impact]
ibus-daemon by default uses a unix socket name of /tmp/dbus-... that is indistinguishable from dbus-daemon abstract sockets. While dbus-daemon has AppArmor mediation, ibus-daemon does not so it is important that its abstract socket not be confused with dbus-daemon's. By modifying ibus-daemon's start arguments to use "--address 'unix:tmpdir=/tmp/ibus'" AppArmor can continue mediating DBus abstract sockets like normal and also mediate access to the ibus-daemon-specific abstract socket via unix rules. This also tidies up the abstract socket paths so that it is clear which are for ibus-daemon, which for dbus-daemon, etc.

The upload simply adjusts 21_ibus.rc to start ibus-daemon with "--address 'unix:tmpdir=/tmp/ibus'" and adds a comment. No compiled code changes are required.

[Test Case]
1. start a unity session before updating to the package in -proposed

2. $ grep IBUS_ADDRESS ~/.config/ibus/bus/*-unix-0
IBUS_ADDRESS=unix:abstract=/tmp/dbus-Vyx8fGFA,guid=28e8e7e89f902c8d4e9d77c5557add76

3. $ lsof -p $(pidof ibus-daemon) | grep '/dbus'
ibus-daem 2973 jamie 8u unix 0x0000000000000000 0t0 29606 @/tmp/dbus-oxKYpN30 type=STREAM

4. update the package in -proposed and perform '2' and '3'. The IBUS_ADDRESSES should be the same as before

5. logout of unity, then log back in

6. $ grep IBUS_ADDRESS ~/.config/ibus/bus/*-unix-0
IBUS_ADDRESS=unix:abstract=/tmp/ibus/dbus-SpxOl8Fc,guid=06d4bbeb07614c6dffbf221c57473f4e

(notice '/tmp/ibus/' in the path)

7. $ lsof -p $(pidof ibus-daemon) | grep '/dbus'
ibus-daem 3471 jamie 8u unix 0x0000000000000000 0t0 26107 @/tmp/ibus/dbus-SpxOl8Fc type=STREAM
...

(notice '@/tmp/ibus/' in the path)

In addition to the above, you can test for regressions by opening 'System Settings' under the 'gear' icon in the panel and selecting 'Text Entry'. From there, add an input source on the right, make sure 'Show current input source in the menu bar' is checked, then use the input source panel indicator to change input sources.

Extended test case to verify input support still works in unconfined and confined applications:

1. Systems Settings Language Support, if prompted install the complete language support
2. Install Chinese (simple and traditional)
3. sudo apt-get install ibus-pinyin ibus-sunpinyin
4. logout / login
5. System Settings / Text Entry - add Chinese (Pinyin) (IBus)
6. select pinyin from the indicator
7. sudo lsof | grep ibus | grep @ # will use @/tmp/dbus-...
8. open gnome-calculator and try to type something in (should get a pop-up)
9. open evince and try to search a pdf (should get a pop up)
10. upgrade apparmor and im-config from xenial-proposed
11. logout and back in
12. sudo lsof | grep ibus | grep @ # will use @/tmp/ibus/...
13. open gnome-calculator and try to type something in (should get a pop-up)
14. open evince and try to search a pdf (should get a pop up)
15. verify no new apparmor denials

[Regression Potential]

The regression potential is considered low because there are no compiled code changes and because the changes only occur after ibus-daemon is restarted, which is upon session start, not package upgrade. When it is restarted, the files in ~/.config/ibus/bus/*-unix-0 are updated accordingly for other applications to pick up.

This change intentionally requires a change to the unity7 snapd interface, which is in already done.

This change intentionally requires a change to apparmor to add a unix rule for communicating with the new ibus address. This is in xenial-proposed 2.10.95-0ubuntu2.3 (and 2.10.95-0ubuntu2.4). The packages changes to im-config use 'Breaks: apparmor (<< 2.10.95-0ubuntu2.3) to ensure that the apparmor abstraction is updated and policy recompiled before ibus is restarted. This was omitted from the initial im-config upload which resulted in bug #1588197. Test cases ensuring this is working properly are included above under 'Extended test case'.

= SRU apparmor =
[Impact]
The upload that adjusts ibus-daemon to start with "--address 'unix:tmpdir=/tmp/ibus'" causes the ibus AppArmor abstraction to no longer be sufficient due to the lack of a rule for the new socket path. This upload adds such a rule.

[Test Case]
1. Start a unity session after updating to the im-config package in -proposed but before the apparmor package in -proposed

2. Use the ibus client program to list the available engines
$ ibus list-engine
language: Spanish; Castilian
  xkb:latam::spa - Spanish (Latin American)
  xkb:es::spa - Spanish
language: Slovak
  xkb:sk:qwerty:slo - Slovak (qwerty)
  xkb:sk::slo - Slovak
...

3. Create an AppArmor profile file, called ibus, with the following contents:

#include <tunables/global>

profile ibus {
  #include <abstractions/base>
  #include <abstractions/dbus-session-strict>
  #include <abstractions/ibus>

  /usr/bin/ibus mr,

}

4. Load the profile
$ sudo apparmor_parser -qr ibus

5. Rerun the ibus client program under confinement to see that it fails
$ aa-exec -p ibus -- ibus list-engine
Can't connect to IBus.

6. Note the AppArmor denial in the syslog

audit: type=1400 audit(1472252079.589:57): apparmor="DENIED" operation="connect" profile="ibus" pid=5364 comm="ibus" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@/tmp/ibus/dbus-kxnhAsmv" peer="unconfined"

7. Update to the apparmor package in -proposed

8. Reload the profile
$ sudo apparmor_parser -qr ibus

9. Rerun the ibus client program under confinement to see that it works
$ aa-exec -p ibus -- ibus list-engine
language: Spanish; Castilian
  xkb:latam::spa - Spanish (Latin American)
  xkb:es::spa - Spanish
language: Slovak
  xkb:sk:qwerty:slo - Slovak (qwerty)
  xkb:sk::slo - Slovak
...

[Regression Potential]

The regression potential is considered low because there are no compiled code changes and because the changes only add additional rules to the apparmor ibus abstraction.

= Original description =
Currently snaps can't access ibus/fcitx from the system, do we need a interface for input methods there?

tags: added: snap-desktop-issue snapd-interface
summary: - Needs for an input method interface?
+ Snap blocks access to system input methods (ibus, fctix, ...)

We either need an interface or to simply update the unity7 interface accordingly. Can you please provide a snap and instructions on how to reproduce (for both ibus and fcitx)?

Changed in snapd (Ubuntu):
status: New → Incomplete
importance: Undecided → Medium
Sebastien Bacher (seb128) wrote :

Hum, there are some issues there

* ibus/fcitx integrate into the toolkits by using modules, for example to have a gtk3 software working with ibus you need "ibus-gtk3" installed, for fctix you need "fcitx-frontend-gtk3" ... do we expect every snap to have to include those?

* those have an user session daemon, that's the part where I though we would need an interface/plug (or we need the snaps to ship the daemon and start a custom dbus bus and make their own service use that) ... or we need to have the personal core including ibus/fcitx

* the client needs to be able to talk to im service

I didn't get it to work yet but I'm working using the gnome-calculator example and building the snap with "ibus-gtk3" listed in the stage-packages.
To have ibus working you need to
- have ibus installed
- go to unity-control-center -> text input, add a input source using (e.g "chinese (pinyin) (ibus)")
- have ibus configured as input method, that should be default (check GTK_IM_MODULE and use "im-config -n ibus"/restart session if needed)
- select the pinyin layout in the indicator
- type some text in a gtk entry (e.g the calculator one)

that should display a popover widget with chinese symbols

Changed in snapd (Ubuntu):
status: Incomplete → New
Sebastien Bacher (seb128) wrote :

Ok, I got it working, in addition of the previous steps you need:
- cp /usr/lib/x86_64-linux-gnu/gtk-3.0/3.0.0/immodules.cache to your snap dir
- edit it to keep only ibus/change the dirs to be "/snap/gnome-calculator/current/..."
- have the yaml define "immodules.cache: usr/lib/x86_64-linux-gnu/gtk-3.0/3.0.0/immodules.cache" in the files section
- set "export GTK_IM_MODULE_FILE=$SNAP/usr/lib/x86_64-linux-gnu/gtk-3.0/3.0.0/immodules.cache" in the calc script
- build/install the snap
- then copy ~/.config/ibus/bus/* from your session to ~/snap/gnome-calculator/<id>/.config/ibus/bus

the bus info seems to be written by the ibus service and needed for the client to access it, unsure how that could be integrated in the snap build...

Sebastien Bacher (seb128) wrote :

things work even without devmode, that's probably because ibus is using a private bus between the service and the client and that's not being restricted

Jamie Strandboge (jdstrand) wrote :

"things work even without devmode, that's probably because ibus is using a private bus between the service and the client and that's not being restricted"

Note that we have a few things in the unity7 interface already: accesses to @{HOME}/.config/ibus/bus/* and some accesses to the accessibility bus. @{HOME}/.config/ibus/bus/* contains files with information on where to find the ibus abstract socket. Eg:
$ cat ./.config/ibus/bus/9c3de18b4ba9455c74e059fe00000003-unix-0
# This file is created by ibus-daemon, please do not modify it
IBUS_ADDRESS=unix:abstract=/tmp/dbus-Vyx8fGFA,guid=28e8e7e89f902c8d4e9d77c5557add76
IBUS_DAEMON_PID=2217

We then have dbus-session-strict:
  unix (connect, receive, send)
       type=stream
       peer=(addr="@/tmp/dbus-*"),

There is a problem with this policy though; that access is not very strict at all and we should adjust the unity7 interface accordingly (and test that ibus still works).

Is ibus-daemon actually a dbus service or is it something else?

Sebastien Bacher (seb128) wrote :

k, well the issue is that the bus address is written in the real userdir and ibus tries to look at the standard location which is diverted to the private dir in the snap, which is empty... we would need something to copy or bind mount the real dir over

On 05/11/2016 10:22 AM, Jamie Strandboge wrote:
...
>
> We then have dbus-session-strict:
> unix (connect, receive, send)
> type=stream
> peer=(addr="@/tmp/dbus-*"),
>
> There is a problem with this policy though; that access is not very
> strict at all and we should adjust the unity7 interface accordingly (and
> test that ibus still works).

I'm not sure how we could do that without code changes. There's nothing
differentiating the session bus' abstract socket name from the ibus bus'
abstract socket name.

> Is ibus-daemon actually a dbus service or is it something else?

It looks to me like it is its own bus daemon. In other words, the
equivalent of something like `dbus-daemon --session` instead of simply
being a dbus service.

@Tyler, if it is its own service and not dbus, it shouldn't use a name like @/tmp/dbus-*. It should instead use @/tmp/ibus-daemon-* or similar. This 'strict' rule is intended to allow connection to *dbus* services since dbus has apparmor mediation. If a service isn't a dbus service, it should use a different path.

On 05/11/2016 11:46 AM, Tyler Hicks wrote:
> On 05/11/2016 10:22 AM, Jamie Strandboge wrote:
> ...
>>
>> We then have dbus-session-strict:
>> unix (connect, receive, send)
>> type=stream
>> peer=(addr="@/tmp/dbus-*"),
>>
>> There is a problem with this policy though; that access is not very
>> strict at all and we should adjust the unity7 interface accordingly (and
>> test that ibus still works).
>
> I'm not sure how we could do that without code changes. There's nothing
> differentiating the session bus' abstract socket name from the ibus bus'
> abstract socket name.
>
>> Is ibus-daemon actually a dbus service or is it something else?
>
> It looks to me like it is its own bus daemon. In other words, the
> equivalent of something like `dbus-daemon --session` instead of simply
> being a dbus service.
>
Well then we should be able to launch it under a different profile
and use the label to differential the two

Changed in snapd (Ubuntu):
status: New → In Progress
assignee: nobody → Jamie Strandboge (jdstrand)

FYI, I think we have a handle on how to fix the ibus access wrt security policy to properly mediate the ibus abstract socket that doesn't involve code changes.

@seb128: you gave details on how to get ibus working in comment #3 (thanks!), what about fcitx?

Changed in snapd (Ubuntu):
assignee: Jamie Strandboge (jdstrand) → nobody
status: In Progress → Incomplete
Changed in im-config (Ubuntu Yakkety):
status: New → In Progress
assignee: nobody → Jamie Strandboge (jdstrand)
Changed in im-config (Ubuntu Yakkety):
status: In Progress → Fix Committed
Changed in im-config (Ubuntu Xenial):
status: New → In Progress
assignee: nobody → Jamie Strandboge (jdstrand)
Changed in im-config (Ubuntu Yakkety):
importance: Undecided → Medium
Changed in im-config (Ubuntu Xenial):
importance: Undecided → Medium
Changed in snapd (Ubuntu Xenial):
importance: Undecided → Medium
Changed in im-config (Ubuntu Xenial):
status: In Progress → Triaged
description: updated
description: updated
description: updated
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package im-config - 0.29-1ubuntu13

---------------
im-config (0.29-1ubuntu13) yakkety; urgency=medium

  * debian/patches/use-distinguishable-abstract-address.patch: adjust
    ibus-daemon args to include "--address 'unix:tmpdir=/tmp/ibus'" so it has
    a mediatable abstract socket path (LP: #1580463)

 -- Jamie Strandboge <email address hidden> Thu, 26 May 2016 12:53:53 -0500

Changed in im-config (Ubuntu Yakkety):
status: Fix Committed → Fix Released
description: updated
Changed in im-config (Ubuntu Xenial):
status: Triaged → In Progress

Hello Sebastien, or anyone else affected,

Accepted im-config into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/im-config/0.29-1ubuntu12.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in im-config (Ubuntu Xenial):
status: In Progress → Fix Committed
tags: added: verification-needed

> what about fcitx?

so I had a look to that, a bit similar to ibus

* bundle "fcitx-frontend-gtk3" in your deb

* include those lines in the bundle (replace the static version)

export XDG_CACHE_HOME=$SNAP_USER_DATA/.cache-$SNAP_VERSION
mkdir -p $XDG_CACHE_HOME
export GTK_IM_MODULE_DIR=$XDG_CACHE_HOME/immodules
export GTK_IM_MODULE_FILE=$XDG_CACHE_HOME/immodules/immodules.cache

if [ ! -d $GTK_IM_MODULE_DIR ]; then
  mkdir -p $GTK_IM_MODULE_DIR
  ln -s $SNAP/usr/lib/$ARCH/gtk-3.0/3.0.0/immodules/*.so $GTK_IM_MODULE_DIR
  $SNAP/usr/lib/$ARCH/libgtk-3-0/gtk-query-immodules-3.0 > $GTK_IM_MODULE_FILE
fi

that's enough to made it work in devmode (tried on the gnome-calculator example)

unrelated to snap but to configre fcitx configure/working as your im framework under unity7 open language-selector install the chinese support (should give you the fcitx packages you need) and select fcitx as im method in the combo on the first tab, then restart your session. that gives you an indicator with a configure option, you can add a sunpinyn input method from there and use the indicator to switch to it, once that done typing in e.g the calculator input entry should give you an UI with chinese glyphs

Sebastien Bacher (seb128) wrote :

works confined after adding "#include <abstractions/fcitx>" to the apparmor profile

Changed in snapd (Ubuntu Yakkety):
status: Incomplete → Confirmed
Changed in apparmor (Ubuntu Xenial):
status: New → Triaged
Changed in apparmor (Ubuntu Yakkety):
status: New → In Progress
Changed in apparmor (Ubuntu Xenial):
importance: Undecided → Medium
Changed in apparmor (Ubuntu Yakkety):
importance: Undecided → Medium
Changed in apparmor (Ubuntu Xenial):
assignee: nobody → Tyler Hicks (tyhicks)
Changed in apparmor (Ubuntu Yakkety):
assignee: nobody → Tyler Hicks (tyhicks)
Jamie Strandboge (jdstrand) wrote :

Tyler said that he would update the apparmor ibus abstraction for this change, which will be required to not break ibus in evince and webbrowser-app. As such, I'm going to mark this as 'verification-failed' then adjust im-config to Breaks with apparmor less than the version Tyler is uploading.

tags: added: verification-failed
removed: verification-needed
Changed in im-config (Ubuntu Xenial):
status: Fix Committed → In Progress

Hello Sebastien, or anyone else affected,

Accepted snapd into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snapd/2.0.6 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in snapd (Ubuntu Xenial):
status: New → Fix Committed
tags: removed: verification-failed
tags: added: verification-needed

FYI, fcitx uses dbus-daemon (as opposed to ibus-daemon, which does not) and so apparmor dbus mediation can be used with 'dbus bus=fcitx,'. As such, im-config does not need an update for fcitx.

Jamie Strandboge (jdstrand) wrote :

Based on comment #15 I removed im-config 0.29-1ubuntu12.1 from xenial-proposed so it doesn't accidentally get promoted.

Hello Sebastien, or anyone else affected,

Accepted snapd into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snapd/2.0.7 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in snapd (Ubuntu Yakkety):
status: Confirmed → Fix Committed

2.0.8 generates the new input methods policy and it correctly compiles. Marking verification-done.

tags: added: verification-done
removed: verification-needed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package snapd - 2.0.8

---------------
snapd (2.0.8) xenial; urgency=medium

  * New upstream release: LP: #1589534
    - debian: make `snap refresh` times more random (LP: #1537793)
    - cmd: ExecInCoreSnap looks in "core" snap first, and only in
      "ubuntu-core" snap if rev>125.
    - cmd/snap: have 'snap list' display helper message on stderr
      (LP: #1587445)
    - snap: make app names more restrictive.

 -- Michael Vogt <email address hidden> Wed, 08 Jun 2016 07:56:58 +0200

Changed in snapd (Ubuntu Xenial):
status: Fix Committed → Fix Released
summary: - Snap blocks access to system input methods (ibus, fctix, ...)
+ Snap blocks access to system input methods (ibus, fcitx, ...)
Launchpad Janitor (janitor) wrote :
Download full text (6.5 KiB)

This bug was fixed in the package snapd - 2.11+16.10

---------------
snapd (2.11+16.10) yakkety; urgency=medium

  * New upstream release: LP: #1605303
    - increase version number to reflect the nature of the update
      better
    - store, daemon, client, cmd/snap, docs/rest.md: adieu search
      grammar
    - debian: move snapd.refresh.timer into timers.target
    - snapstate: add daemon-reload to fix autopkgtest on yakkety
    - Interfaces: hardware-observe
    - snap: rework the output after a snap operation
    - daemon, cmd/snap: refresh --devmode
    - store, daemon, client, cmd/snap: implement `snap find --private`
    - tests: add network-observe interface spread test
    - interfaces/builtin: allow getsockopt for connected x11 plugs
    - osutil: check for nogrup instead of adm
    - store: small cleanups (more needed)
    - snap/squashfs: fix test not to hardcode snap size
    - client,cmd/snap: cleanup cmd/snap test suite, add extra args
      testThis cleans up the cmd/snap test suite:
    - wrappers: map "never" restart condition to "no."
    - wrappers: run update-desktop-database after add/remove of desktop
      files
    - release: work around elementary mistake
    - many: remove all traces of channel from the buying codepath
    - store: kill setUbuntuStoreHeaders
    - docs: add payment methods documentation
    - many: present user with a choice of payment backends
    - asserts: add cross checks for snap asserts
    - cmd/snap,cmd/snap-exec: support running hooks via snap-exec.
    - tests: improve snap run symlink tests
    - tests: add content sharing interface spread test
    - store & many: a mechanical branch shortening store names
    - snappy: remove old snappy pkg
    - overlord/snapstate: kill flagscompat
    - overlord/snapstate, daemon, client, cmd/snap: devmode override
      (aka confined)
    - tests: extend refresh test to talk to the staging and production
      stores
    - asserts,daemon: cross checks for account and account-key
      assertions
    - client: existing JSON fixtures uses tabs for indentation
    - snap-exec: add proper integration test for snap-exec
    - spread.yaml, tests: replace hello-world with test-snapd-tools
    - tests: add locale-control interface spread test
    - tests: add mount-observe interface spread test
    - tests: add system-observe interface spread test
    - many: add AuthContext to mediate user updates to the state
    - store/auth: add helper for the macaroon refresh endpoint
    - cmd: add buy command
    - overlord: switch snapstate.Update to use ListRefresh (aka
      /snaps/metadata)
    - snap-exec: fix silly off-by-one error
    - tests: stop using hello-world.echo in the tests
    - tests: add env command to test-snapd-tools
    - classic: remove (most of) "classic" mode, this is implemented as a
      snap now
    - many: remove snapstate.Candidate and other cleanups
    - many: removed authenticator, store gets a user instead
    - asserts: fix minor doc comment typo
    - snap: ensure unknown arguments to `snap run` are ignored
    - overlord/auth: add Device/SetDevice to persist device identity in
      state
    - overlord: make SyncBoot work aga...

Read more...

Changed in snapd (Ubuntu Yakkety):
status: Fix Committed → Fix Released
Tyler Hicks (tyhicks) on 2016-08-26
description: updated
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.10.95-4ubuntu4

---------------
apparmor (2.10.95-4ubuntu4) yakkety; urgency=medium

  * debian/patches/allow-access-to-ibus-socket.patch: Adjust the ibus
    abstraction to allow access to the abstract UNIX domain socket location
    used in Ubuntu. (LP: #1580463)
  * debian/lib/apparmor/functions: Quiet the "Files ... and ... differ"
    output, during the update process, which was printed by diff. This message
    left users concerned since it mentioned md5sums files without being clear
    about what was happening. (LP: #1614215)

 -- Tyler Hicks <email address hidden> Fri, 26 Aug 2016 13:33:46 -0500

Changed in apparmor (Ubuntu Yakkety):
status: In Progress → Fix Released

Hello Sebastien, or anyone else affected,

Accepted apparmor into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/apparmor/2.10.95-0ubuntu2.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in apparmor (Ubuntu Xenial):
status: Triaged → Fix Committed
tags: removed: verification-done
tags: added: verification-needed
Tyler Hicks (tyhicks) wrote :

I'm temporarily marking this SRU bug as verification-failed so that it doesn't get let through until kernel bug 1579135 is fixed. Without the kernel bug fix for bug 1579135, this SRU has the potential for oopsing the kernel of some users. Lets sit on this SRU until the Xenial kernel currently in -proposed has been released for ~1 week to give users some time to upgrade and reboot.

tags: added: verification-failed
removed: verification-needed
description: updated
Tyler Hicks (tyhicks) wrote :

Swapping verification-failed for verification-needed now that bug 1579135 has been fixed for ~1 week.

tags: added: verification-needed
removed: verification-failed
Tyler Hicks (tyhicks) on 2016-10-07
description: updated
Jamie Strandboge (jdstrand) wrote :

im-config 0.29-1ubuntu12.2 is uploaded to xenial-proposed and ensures the newer apparmor is installed. Please see the updated description for im-config in Test Case and Regression Potential for details.

description: updated
description: updated
description: updated
Martin Pitt (pitti) wrote :

Hello Sebastien, or anyone else affected,

Accepted im-config into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/im-config/0.29-1ubuntu12.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in im-config (Ubuntu Xenial):
status: In Progress → Fix Committed
Jamie Strandboge (jdstrand) wrote :

FYI, im-config is verification-done. I didn't do full SRU testing for AppArmor. Tyler, when you are done with the SRU testing, feel free to mark this as verification-done.

Jamie Strandboge (jdstrand) wrote :

Just for clarity, I did both the main test case and the extended test case for im-config. I also noticed that when installing im-config, it correctly required the updated apparmor.

Tyler Hicks (tyhicks) wrote :

I've completed the AppArmor test plan:

  https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor

I've also manually verified the AppArmor portion of this SRU.

tags: added: verification-done
removed: verification-needed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.10.95-0ubuntu2.5

---------------
apparmor (2.10.95-0ubuntu2.5) xenial; urgency=medium

  * debian/lib/apparmor/functions, debian/apparmor.init,
    debian/apparmor.service, debian/apparmor.upstart,
    debian/lib/apparmor/profile-load: Adjust the checks that previously kept
    AppArmor policy from being loaded while booting a container. Now we
    attempt to load policy if we're in a LXD or LXC managed container that is
    using profile stacking inside of a policy namespace. (LP: #1628285)
  * Fix regression tests for stacking so that the kernel SRU process is not
    interrupted by failing tests whenever the AppArmor stacking features are
    backported from the 16.10 kernel or when the 16.04 LTS Enablement Stack
    receives a 4.8 or newer kernel
    - debian/patches/r3509-tests-fix-exec_stack-errors-1.patch: Fix the
      exec_stack.sh test when running on 4.8 or newer kernels (LP: #1628745)
    - debian/patches/r3558-tests-fix-exec_stack-errors-2.patch: Adjust the
      exec_stack.sh fix mentioned above to more accurately test kernels older
      than 4.8 (LP: #1630069)
    - debian/patches/allow-stacking-tests-to-use-system.patch: Apply this
      patch earlier in the series, as to match when it was committed upstream,
      so that the above two patches can be cherry-picked from lp:apparmor

 -- Tyler Hicks <email address hidden> Fri, 07 Oct 2016 05:21:44 +0000

Changed in apparmor (Ubuntu Xenial):
status: Fix Committed → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package im-config - 0.29-1ubuntu12.2

---------------
im-config (0.29-1ubuntu12.2) xenial-proposed; urgency=medium

  * debian/patches/use-distinguishable-abstract-address.patch: adjust
    ibus-daemon args to include "--address 'unix:tmpdir=/tmp/ibus'" so it has
    a mediatable abstract socket path (LP: #1580463)
  * debian/control: Breaks on apparmor << 2.10.95-0ubuntu2.3 since that
    adjusts the ibus abstraction to allow applications to communicate with an
    ibus-daemon started with "--address 'unix:tmpdir=/tmp/ibus'"

 -- Jamie Strandboge <email address hidden> Fri, 07 Oct 2016 11:37:31 +0000

Changed in im-config (Ubuntu Xenial):
status: Fix Committed → Fix Released

The verification of the Stable Release Update for im-config has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers