apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

Bug #1670408 reported by Robie Basak on 2017-03-06
20
This bug affects 2 people
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
Undecided
Unassigned
Xenial
High
Unassigned
ntp (Ubuntu)
High
Unassigned
tor (Ubuntu)
High
Unassigned

Bug Description

[Impact]

 * The base abstraction in xenial misses some ways programs can push
   logs to journald

 * Backport the fix form Artful to:
   1. get rid of the Denies making logs less readable
   2. get users to see the actual log entries will help to unbreak many
      other cases

[Test Case]

 * Install one of the affected packages (in a xenial container is enough)
 * For the case of ntp just install and then run
   systemctl restart ntp
 * in Dmesg you'll see apparmor Denies like
     apparmor="DENIED"
     operation="file_inherit"
     profile="/usr/sbin/ntpd"
     name="/run/systemd/journal/stdout"
 * Each case is different, in this (ntp) case also some log entries are
   missed due to the block
 * After installing the fixed package there is no Deny anymore and
   programs are able to correctly log.

[Regression Potential]

 * The change is in ubuntu as-is since artful and we are only opening up,
   but not limiting the access - so there should be nothing that is denied
   after the update that was not before.
   Vice versa there could be changes due to things now working correcrly,
   but I'd not see that as a regression.

[Other Info]

 * affects many packages ntp, tor - I even heard examples of mysql.
   But the fix is in apparmor through base abstraction

---

Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor fails to start after installing the tor package. "systemctl status tor@default" reports:

Mar 06 16:04:00 zesty systemd[1]: <email address hidden>: Main process exited, code=killed, status=11/SEGV
Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network for TCP.
Mar 06 16:04:00 zesty systemd[1]: <email address hidden>: Unit entered failed state.
Mar 06 16:04:00 zesty systemd[1]: <email address hidden>: Failed with result 'signal'.

There are two AppArmor denials in the kernel log:

Mar 6 15:53:12 zesty-test kernel: [ 102.699647] audit: type=1400 audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit" namespace="root//lxd-zesty_<var-lib-lxd>" profile="system_tor" name="/run/systemd/journal/stdout" pid=3520 comm="tor" requested_mask="wr" denied_mask="wr" fsuid=100000 ouid=100000

Mar 6 15:53:12 zesty-test kernel: [ 102.702418] audit: type=1400 audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap" namespace="root//lxd-zesty_<var-lib-lxd>" profile="system_tor" name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m" denied_mask="m" fsuid=100000 ouid=100000

Workaround: add the following two lines to /etc/apparmor.d/system_tor:

/usr/bin/tor m,
/run/systemd/journal/stdout rw,

I couldn't remember how to that that profile reloaded, so I rebooted, and after the reboot tor does start up successfully. "systemctl tor@default" reports it as running.

I haven't checked to see if only one or other rule is actually required.

Importance -> High since this bug makes the package unusable in its default configuration on Zesty. Since the AppArmor profile comes from Debian's 0.2.9.9-1, this should probably be fixed in Debian.

Robie Basak (racb) wrote :

I wonder if "/run/systemd/journal/stdout rw" should be in an abstraction - perhaps base?

Robie Basak (racb) wrote :

Adding an AppArmor task for that second question.

John Johansen (jjohansen) wrote :

For now yes, but I think going forward we are going to want to split the systemd bits in a subabstraction.

Robie Basak (racb) wrote :

I can no longer reproduce the original problem on current Zesty. I also tried downgrading to what I think would have been active at the time of my original report (tor and kernel versions known; I hadn't noted the apparmor version though). This is as below, but I still cannot reproduce.

root@test:~# dpkg-query -W tor
tor 0.2.9.9-1ubuntu1
root@test:~# dpkg-query -W apparmor
apparmor 2.11.0-2ubuntu1
root@test:~# uname -a
Linux test 4.10.0-9-generic #11-Ubuntu SMP Mon Feb 20 13:47:35 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

It definitely was reproducible in my original report. I have not been able to pin down what changed, so marking Incomplete for now, as it could be me or my environment. But for now, tor appears to be working correctly by default on Zesty, which was my goal in tackling this.

Changed in tor (Ubuntu):
status: New → Incomplete

I saw the same with ntp on Xenial, but can also confirm that >=Zesty things seem to be fixed.
Before I had:
audit: type=1400 audit(1497945497.701:6958): apparmor="DENIED" operation="file_inherit" namespace="root//lxd-xenial-ntp_<var-lib-lxd>" profile="/usr/sbin/ntpd" name="/run/systemd/journal/stdout" pid=27776 comm="ntpd" requested_mask="wr" denied_mask="wr" fsuid=165536 ouid=165536

So it seems fixed, maybe an SRU needed of something in apparmor / abstractions?

Changed in apparmor (Ubuntu):
status: New → Confirmed

Also the bugs I refer were around other things but it seems to be not limited to those services
smb: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1666748
freshclam: mysql: dhclient: https://github.com/lxc/lxd/issues/3255

Jamie Strandboge (jdstrand) wrote :

As mentioned in other comments, this is fixed in 17.04, so marking the tor task as Invalid (it is an issue in the apparmor abstractions, not tor) and marking the apparmor task as Fix Released. If someone wants to perform the SRU or supply debdiffs, please open tasks against the particular releases to be SRU'd.

Changed in apparmor (Ubuntu):
status: Confirmed → Fix Released
Changed in tor (Ubuntu):
status: Incomplete → Invalid

Yeah Jamie, thanks for the status update - absolutely right for apparmor (ubuntu).

Yet - at least I - have no idea what to backport in regard to provide debdiffs in that case.
I would have hoped you(r team) would know what that was about in particular and might have discussed/considered/rejected that as an SRU already.
I read the apparmor changelog but couldn't spot anything since xenial which pointed towards this or a similar issue that could be backported.

I'll nominate a Xenial/Yakkety task to let you consider what would need to be backported.
If nobody knows then these tasks will go "confirmed / low" I guess :-/

no longer affects: tor (Ubuntu Xenial)
no longer affects: tor (Ubuntu Yakkety)
Jamie Strandboge (jdstrand) wrote :

This is what someone needs to backport: http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3658. If you want the security team to do it, please use the stakeholder process to get this prioritized.

Thanks to find the related commit Jamie, I we can put the preparation of debdiffs on our backlog for now.

Tagged server-next because Patch known, benefit high fixing various distracting noise and log reporting in multiple packages when running in LXD.

@Rbasak please jump in and change triaging if you disagree

tags: added: bitesize server-next

Correctly added a bug task for ntp to also be affected.
Dropping Artful (EOL)

no longer affects: apparmor (Ubuntu Yakkety)
Changed in apparmor (Ubuntu Xenial):
status: New → Triaged
Changed in ntp (Ubuntu):
status: New → Confirmed
Changed in ntp (Ubuntu):
importance: Undecided → High
summary: - Missing apparmor rules cause tor to fail to start
+ apparmor base abstraction needs backport of rev 3658 to fix several
+ denies (tor, ntp, ...)
Changed in apparmor (Ubuntu Xenial):
importance: Undecided → High
Changed in tor (Ubuntu):
status: Invalid → Confirmed

This is already fixed as backport in other releases - here apparmor 2.11.0-2ubuntu5 in Artful

apparmor (2.11.0-2ubuntu5) artful; urgency=medium

  * debian/patches/base-journald-updates.patch: update base abstraction for
    additional journald sockets

 -- Jamie Strandboge <email address hidden> Thu, 27 Apr 2017 16:09:50 +0000

We can use that as it already has some adaption for backports don (like var, run)

More or less adirect backport of Jamies changes in Artful.
Only opening up rules slightly, so regression risk low.
But I clearly want a security Team ack/review before sponsoring it.

@jdstrand - I subscribed you and would ask for your review of the proposed debdiff.

Jamie Strandboge (jdstrand) wrote :

This is fine for SRU. Thanks!

tags: added: patch

Thanks Jamie, I'm now testing the fix from https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3169 before pushing as SRU.

- Tested 2.10.95-0ubuntu2.9 from PPA (working as expected
- Added SRU Template
- Uploaded for consideration by the SRU team

description: updated

Hello Robie, or anyone else affected,

Accepted apparmor into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/apparmor/2.10.95-0ubuntu2.9 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in apparmor (Ubuntu Xenial):
status: Triaged → Fix Committed
tags: added: verification-needed verification-needed-xenial

Xenial as is on ntp restart:
[2618636.253807] audit: type=1400 audit(1519220834.240:5311): apparmor="DENIED" operation="file_inherit" namespace="root//lxd-x_<var-snap-lxd-common-lxd>" profile="/usr/sbin/ntpd" name="/run/systemd/journal/stdout" pid=24452 comm="ntpd" requested_mask="wr" denied_mask="wr" fsuid=1000000 ouid=1000000
[2618636.253817] audit: type=1400 audit(1519220834.240:5312): apparmor="DENIED" operation="file_inherit" namespace="root//lxd-x_<var-snap-lxd-common-lxd>" profile="/usr/sbin/ntpd" name="/run/systemd/journal/stdout" pid=24452 comm="ntpd" requested_mask="wr" denied_mask="wr" fsuid=1000000 ouid=1000000

With updates from proposed
# sudo apt install apparmor
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
  libfreetype6
Use 'sudo apt autoremove' to remove it.
Suggested packages:
  apparmor-profiles apparmor-profiles-extra apparmor-docs apparmor-utils
The following packages will be upgraded:
  apparmor
1 upgraded, 0 newly installed, 0 to remove and 29 not upgraded.
Need to get 450 kB of archives.
After this operation, 1024 B of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu xenial-proposed/main amd64 apparmor amd64 2.10.95-0ubuntu2.9 [450 kB]
Fetched 450 kB in 0s (2291 kB/s)
Preconfiguring packages ...
(Reading database ... 25611 files and directories currently installed.)
Preparing to unpack .../apparmor_2.10.95-0ubuntu2.9_amd64.deb ...
Unpacking apparmor (2.10.95-0ubuntu2.9) over (2.10.95-0ubuntu2.8) ...
Processing triggers for systemd (229-4ubuntu21.1) ...
Processing triggers for ureadahead (0.100.0-19) ...
Processing triggers for man-db (2.7.5-1) ...
Setting up apparmor (2.10.95-0ubuntu2.9) ...
Installing new version of config file /etc/apparmor.d/abstractions/base ...
update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults
Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd

# No issues anymore when restarting the service.
Also found no other apparmor related issues restarting a few services that I had on there.

tags: added: verification-done verification-done-xenial
removed: verification-needed verification-needed-xenial
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.10.95-0ubuntu2.9

---------------
apparmor (2.10.95-0ubuntu2.9) xenial; urgency=medium

  * debian/patches/base-journald-updates.patch: update base abstraction
    for additional journald sockets (LP: #1670408)
    Backport from 2.11.0-2ubuntu5 by Jamie Strandboge <email address hidden>

 -- Christian Ehrhardt <email address hidden> Tue, 20 Feb 2018 16:04:02 +0100

Changed in apparmor (Ubuntu Xenial):
status: Fix Committed → Fix Released

The verification of the Stable Release Update for apparmor has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Robie Basak (racb) wrote :

The fix was landed in the apparmor package and no change was needed to the ntp or tor packages in the end. If I'm wrong, please reopen those tasks.

Changed in ntp (Ubuntu):
status: Confirmed → Fix Released
status: Fix Released → Invalid
Changed in tor (Ubuntu):
status: Confirmed → Invalid
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.