python tools do not understand 'non-magic' include rules
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
AppArmor |
Fix Released
|
Undecided
|
Jamie Strandboge | ||
apparmor (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Trusty |
Won't Fix
|
Undecided
|
Jamie Strandboge | ||
Xenial |
Won't Fix
|
Undecided
|
Jamie Strandboge | ||
Zesty |
Won't Fix
|
Undecided
|
Jamie Strandboge | ||
Artful |
Won't Fix
|
Undecided
|
Jamie Strandboge | ||
Bionic |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
The apparmor parser supports 'include' and '#include' rules for specifying absolute paths, but the python tools only understand include rules for so called 'magic' '<>' file locations.
= test case #0 (testsuite) =
$ sudo apt-get install apparmor apparmor-utils # from proposed
$ sudo apt-get build-dep apparmor
$ sudo apt-get install quilt realpath pyflakes pyflakes3 # pyflakes3 on xenial and higher
$ apt-get source apparmor # from proposed
$ cd apparmor-*
$ quilt push -a
$ export PYTHONPATH=
$ export PYTHON=
$ export PYTHON_VERSION=3
$ export PYTHON_
$ cd libraries/
$ sh ./autogen.sh
$ sh ./configure --prefix=/usr --with-perl --with-python
$ make
$ cd ../../binutils
$ make
$ ../parser
$ make
$ cd ../utils
$ make
$ make check
= test case #1 (aa-enforce) =
This assumes test case #0 has been performed.
$ mkdir /tmp/test1 /tmp/test2
$ cat /etc/apparmor.
profile lp1733700 {
#include "/tmp/test1"
include "/tmp/test2"
}
$ apparmor_parser -QTK /etc/apparmor.
$ sudo aa-enforce /etc/apparmor.
= test case #2 (aa-genprof) =
This assumes test case #1 was already performed and /etc/apparmor.
$ cat /tmp/lp1733700
#!/bin/sh
set -e
sh -c "$@"
$ chmod 755 /tmp/lp1733700
# run without confinement:
$ /tmp/lp1733700 'cat /etc/fstab' | head -1
# /etc/fstab: static file system information.
# invoke genprof
$ sudo aa-genprof /tmp/lp1733700
...
[(S)can system log for AppArmor events] / (F)inish - PRESS 's' - currently fails
... don't exercise the application any so we just have the default profile ...
[(S)can system log for AppArmor events] / (F)inish - PRESS 'f'
...
Finished generating profile for /tmp/lp1733700.
$ sudo cat /etc/apparmor.
# Last Modified: Wed Dec 20 15:53:07 2017
#include <tunables/global>
/tmp/lp1733700 {
#include <abstractions/base>
#include <abstractions/bash>
/bin/dash ix,
/lib/
/tmp/lp1733700 r,
}
= test case #3 (aa-logprof) =
This assumes test case #1 was already performed and /etc/apparmor.
This also assumes test case #2 was already performed and /etc/apparmor.
Disable kernel rate limiting:
$ sudo sysctl -w kernel.
Create mark entry in syslog:
$ logger mark-lp1733700
Try running logprof with no new denials:
$ sudo aa-logprof -m mark-lp1733700 # currently fails
Reading log entries from /var/log/syslog.
Updating AppArmor profiles in /etc/apparmor.d.
$
Adjust /etc/apparmor.
#include "/tmp/test1"
include "/tmp/test2"
Load it into the kernel:
$ sudo apparmor_parser -r /etc/apparmor.
Create a new denial:
$ /tmp/lp1733700 'uptime'
sh: 1: uptime: Permission denied
$
Try running logprof:
$ sudo aa-logprof -m mark-lp1733700 # currently fails
Reading log entries from /var/log/syslog.
Updating AppArmor profiles in /etc/apparmor.d.
Profile: /tmp/lp1733700
Execute: /usr/bin/uptime
Severity: unknown
(I)nherit / (C)hild / (N)amed / (X) ix On / (D)eny / Abo(r)t / (F)inish
...
The following local profiles were changed. Would you like to save them?
<PRESS 'i'>
[1 - /tmp/lp1733700]
(S)ave Changes / Save Selec(t)ed Profile / [(V)iew Changes] / View Changes b/w (C)lean profiles / Abo(r)t
<PRESS 's'>
Writing updated profile for /tmp/lp1733700.
$
Verify the profile for 'uptime' addition and that the /tmp/test1 and /tmp/test2 includes were not removed (it is ok that they are both '#include'):
$ sudo cat /etc/apparmor.
# Last Modified: Wed Dec 20 16:19:19 2017
#include <tunables/global>
/tmp/lp1733700 {
#include "/tmp/test1"
#include "/tmp/test2"
#include <abstractions/base>
#include <abstractions/bash>
/bin/dash ix,
/lib/
/tmp/lp1733700 r,
/usr/bin/uptime mrix,
}
= test case #4 (aa-mergeprof) =
$ mkdir -p /tmp/aa-
$ mkdir /tmp/aa-
$ touch /tmp/aa-
$ cp -a /tmp/aa-
$ cat /tmp/aa-
#include <tunables/global>
/tmp/lp1733700 {
#include <abstractions/base>
#include <abstractions/bash>
#include "/tmp/test1"
/bin/dash ix,
/lib/
/tmp/lp1733700 r,
/usr/bin/uptime mrix,
}
$ cat /tmp/aa-
#include <tunables/global>
/tmp/lp1733700 {
#include <abstractions/base>
#include <abstractions/bash>
#include "/tmp/test2"
/bin/dash ix,
/lib/
/tmp/lp1733700 r,
/bin/cat ixr,
}
$ sudo aa-mergeprof -d /tmp/aa-
...
[1 - #include "/tmp/test1"]
[(A)llow] / (I)gnore / Abo(r)t / (F)inish
<PRESS 'a'>
...
[1 - /usr/bin/uptime mrix,]
(A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / Abo(r)t / (F)inish
<PRESS 'a'>
...
The following local profiles were changed. Would you like to save them?
[1 - /tmp/lp1733700]
(S)ave Changes / [(V)iew Changes] / Abo(r)t / (I)gnore - PRESS 's'
Writing updated profile for /tmp/lp1733700.
$
Verify /tmp/aa-
$ cat /tmp/aa-
# Last Modified: Wed Dec 20 17:16:34 2017
#include <tunables/global>
/tmp/lp1733700 {
#include "/tmp/test1"
#include "/tmp/test2"
#include <abstractions/base>
#include <abstractions/bash>
/bin/cat rix,
/bin/dash ix,
/lib/
/tmp/lp1733700 r,
/usr/bin/uptime mrix,
}
Note that the original description said that changing the rule from 'include' to '#include' fixed the issue when in reality it only allowed the rule to parse as a comment instead of erroring.
= Original description =
The apparmor_parser now supports 'include' rules in addition to '#include', but the python tools only understand '#include'. This manifested itself in Ubuntu in bug #1734038 (see https:/
Reproducer:
$ mkdir /tmp/test
$ cat /etc/apparmor.
profile lp1733700 {
include "/tmp/test"
}
$ apparmor_parser -QTK /etc/apparmor.
ok
$ sudo aa-enforce /etc/apparmor.
ERROR: Syntax Error: Missing '}' or ','. Reached end of file /etc/apparmor.
Changing the 'include' to '#include' results in:
$ sudo aa-enforce /etc/apparmor.
Setting /etc/apparmor.
At least aa-logprof is also affected.
= Original report =
On Ubuntu artful, I'm seeing the following behavior:
$ aa-enforce usr.bin.
ERROR: Syntax Error: Unknown line found in file /etc/apparmor.
include "/var/lib/
I have never touched snap.core.
This is snapd 2.28.5+17.10.
Changed in snapd (Ubuntu): | |
assignee: | nobody → Zygmunt Krynicki (zyga) |
status: | New → Triaged |
description: | updated |
summary: |
- aa-enforce fails due to syntax error in snapd.snap-confine profile + apparmor python tools do not understand 'include' rules |
Changed in apparmor (Ubuntu): | |
assignee: | Jamie Strandboge (jdstrand) → nobody |
Changed in apparmor: | |
status: | New → Triaged |
Changed in apparmor (Ubuntu Bionic): | |
status: | Triaged → New |
Changed in apparmor: | |
assignee: | nobody → Jamie Strandboge (jdstrand) |
status: | Triaged → In Progress |
summary: |
- apparmor python tools do not understand 'include' rules + python tools do not understand 'non-magic' include rules |
Changed in apparmor (Ubuntu Trusty): | |
status: | New → Triaged |
Changed in apparmor (Ubuntu Xenial): | |
status: | New → Triaged |
Changed in apparmor (Ubuntu Zesty): | |
status: | New → Triaged |
Changed in apparmor (Ubuntu Artful): | |
status: | New → Triaged |
Changed in apparmor (Ubuntu Bionic): | |
status: | New → Triaged |
description: | updated |
description: | updated |
description: | updated |
Changed in apparmor (Ubuntu Trusty): | |
assignee: | nobody → Jamie Strandboge (jdstrand) |
Changed in apparmor (Ubuntu Xenial): | |
assignee: | nobody → Jamie Strandboge (jdstrand) |
Changed in apparmor (Ubuntu Zesty): | |
assignee: | nobody → Jamie Strandboge (jdstrand) |
Changed in apparmor (Ubuntu Artful): | |
assignee: | nobody → Jamie Strandboge (jdstrand) |
description: | updated |
description: | updated |
description: | updated |
description: | updated |
Changed in apparmor (Ubuntu Artful): | |
status: | Triaged → In Progress |
Changed in apparmor (Ubuntu Xenial): | |
status: | Triaged → In Progress |
Changed in apparmor (Ubuntu Trusty): | |
status: | Triaged → In Progress |
Ok, the snapd issue is being tracked in bug #1734038 so I'm going to use this one for the apparmor-utils python utilities upstream bug and Ubuntu SRU. More details to come.