The new apparmor profile for esm-cache.service has sub profiles for subprocesses and some of them were incomplete, resulting in the following apparmor DENIED messages in the following situations:
These were caught by the automated verification tests for v32.1 in -proposed. If all of the automated verification tests pass for the version with this fix (32.2), then that will be considered a verification for this bug as well.
[ Where problems could occur ]
The fix edits the template for the ubuntu_pro_esm_cache apparmor profile. If mistakes were made, it may cause new apparmor denials or other related issues, ultimately meaning esm-cache.service wouldn't run properly, preventing esm update notifications from being displayed on unattached machines.
[ Impact ]
The new apparmor profile for esm-cache.service has sub profiles for subprocesses and some of them were incomplete, resulting in the following apparmor DENIED messages in the following situations:
On xenial, after a `pro attach`:
2024-05-21 15:22:29, 438:WARNING: root:XXX apparmor DENIED begin 438:WARNING: root:May 21 19:20:58 upro-behave- xenial- system- under-test- 0521-1519206828 65 kernel: [ 63.187079] audit: type=1400 audit(171631925 8.652:25) : apparmor="DENIED" operation="ptrace" profile= "ubuntu_ pro_esm_ cache_systemd_ detect_ virt" pid=3582 comm="systemd- detect- " requested_ mask="trace" denied_mask="trace" peer="unconfined" xenial- system- under-test- 0521-1519206828 65 kernel: [ 64.253406] audit: type=1400 audit(171631925 9.720:26) : apparmor="DENIED" operation="ptrace" profile= "ubuntu_ pro_esm_ cache// ps" pid=3589 comm="ps" requested_ mask="trace" denied_mask="trace" peer="unconfined" xenial- system- under-test- 0521-1519206828 65 kernel: [ 64.253671] audit: type=1400 audit(171631925 9.720:27) : apparmor="DENIED" operation="ptrace" profile= "ubuntu_ pro_esm_ cache// ps" pid=3589 comm="ps" requested_ mask="trace" denied_mask="trace" peer="unconfined" xenial- system- under-test- 0521-1519206828 65 kernel: [ 64.253817] audit: type=1400 audit(171631925 9.720:28) : apparmor="DENIED" operation="ptrace" profile= "ubuntu_ pro_esm_ cache// ps" pid=3589 comm="ps" requested_ mask="trace" denied_mask="trace" peer="unconfined" xenial- system- under-test- 0521-1519206828 65 kernel: [ 64.253952] audit: type=1400 audit(171631925 9.720:29) : apparmor="DENIED" operation="ptrace" profile= "ubuntu_ pro_esm_ cache// ps" pid=3589 comm="ps" requested_ mask="trace" denied_mask="trace" peer="unconfined" xenial- system- under-test- 0521-1519206828 65 kernel: [ 64.254086] audit: type=1400 audit(171631925 9.720:30) : apparmor="DENIED" operation="ptrace" profile= "ubuntu_ pro_esm_ cache// ps" pid=3589 comm="ps" requested_ mask="trace" denied_mask="trace" peer="unconfined" xenial- system- under-test- 0521-1519206828 65 kernel: [ 64.254247] audit: type=1400 audit(171631925 9.720:31) : apparmor="DENIED" operation="ptrace" profile= "ubuntu_ pro_esm_ cache// ps" pid=3589 comm="ps" requested_ mask="trace" denied_mask="trace" peer="unconfined" xenial- system- under-test- 0521-1519206828 65 kernel: [ 64.254406] audit: type=1400 audit(171631925 9.720:32) : apparmor="DENIED" operation="ptrace" profile= "ubuntu_ pro_esm_ cache// ps" pid=3589 comm="ps" requested_ mask="trace" denied_mask="trace" peer="unconfined" xenial- system- under-test- 0521-1519206828 65 kernel: [ 64.254537] audit: type=1400 audit(171631925 9.720:33) : apparmor="DENIED" operation="ptrace" profile= "ubuntu_ pro_esm_ cache// ps" pid=3589 comm="ps" requested_ mask="trace" denied_mask="trace" peer="unconfined" xenial- system- under-test- 0521-1519206828 65 kernel: [ 64.254665] audit: type=1400 audit(171631925 9.720:34) : apparmor="DENIED" operation="ptrace" profile= "ubuntu_ pro_esm_ cache// ps" pid=3589 comm="ps" requested_ mask="trace" denied_mask="trace" peer="unconfined" 438:WARNING: root:XXX apparmor DENIED end
2024-05-21 15:22:29,
May 21 19:20:59 upro-behave-
May 21 19:20:59 upro-behave-
May 21 19:20:59 upro-behave-
May 21 19:20:59 upro-behave-
May 21 19:20:59 upro-behave-
May 21 19:20:59 upro-behave-
May 21 19:20:59 upro-behave-
May 21 19:20:59 upro-behave-
May 21 19:20:59 upro-behave-
2024-05-21 15:22:29,
On focal, after a `pro attach`:
2024-05-21 15:25:25, 975:WARNING: root:XXX apparmor DENIED begin 975:WARNING: root:May 21 19:24:33 upro-behave- focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631947 3.279:43) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemd_ detect_ virt" name="/ sys/firmware/ efi/efivars/ SecureBoot- 8be4df61- 93ca-11d2- aa0d-00e098032b 8c" pid=3114 comm="systemd- detect- " requested_mask="r" denied_mask="r" fsuid=0 ouid=0 focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631947 3.447:44) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemctl " name="/ proc/1/ environ" pid=3115 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631947 3.447:45) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemctl " name="/ proc/1/ sched" pid=3115 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631947 3.447:46) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemctl " name="/ sys/firmware/ efi/efivars/ SecureBoot- 8be4df61- 93ca-11d2- aa0d-00e098032b 8c" pid=3115 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631947 3.447:47) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemctl " name="/ proc/1/ environ" pid=3115 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631947 3.447:48) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemctl " name="/ proc/1/ sched" pid=3115 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631948 4.553:49) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemd_ detect_ virt" name="/ sys/firmware/ efi/efivars/ SecureBoot- 8be4df61- 93ca-11d2- aa0d-00e098032b 8c" pid=3322 comm="systemd- detect- " requested_mask="r" denied_mask="r" fsuid=0 ouid=0 focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631948 4.709:50) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemctl " name="/ proc/1/ environ" pid=3323 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631948 4.713:51) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemctl " name="/ proc/1/ sched" pid=3323 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631948 4.717:52) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemctl " name="/ sys/firmware/ efi/efivars/ SecureBoot- 8be4df61- 93ca-11d2- aa0d-00e098032b 8c" pid=3323 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631948 4.717:53) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemctl " name="/ proc/1/ environ" pid=3323 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 focal-system- under-test- 0521-1522344005 02 kernel: audit: type=1400 audit(171631948 4.717:54) : apparmor="DENIED" operation="open" profile= "ubuntu_ pro_esm_ cache_systemctl " name="/ proc/1/ sched" pid=3323 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 975:WARNING: root:XXX apparmor DENIED end
2024-05-21 15:25:25,
May 21 19:24:33 upro-behave-
May 21 19:24:33 upro-behave-
May 21 19:24:33 upro-behave-
May 21 19:24:33 upro-behave-
May 21 19:24:33 upro-behave-
May 21 19:24:44 upro-behave-
May 21 19:24:44 upro-behave-
May 21 19:24:44 upro-behave-
May 21 19:24:44 upro-behave-
May 21 19:24:44 upro-behave-
May 21 19:24:44 upro-behave-
2024-05-21 15:25:25,
[ Test Plan ]
These were caught by the automated verification tests for v32.1 in -proposed. If all of the automated verification tests pass for the version with this fix (32.2), then that will be considered a verification for this bug as well.
[ Where problems could occur ]
The fix edits the template for the ubuntu_ pro_esm_ cache apparmor profile. If mistakes were made, it may cause new apparmor denials or other related issues, ultimately meaning esm-cache.service wouldn't run properly, preventing esm update notifications from being displayed on unattached machines.