AppArmor denied errors for ubuntu_pro_apt_news profile

[Jeffery To]

With ubuntu-advantage-tools 32.3.1~22.04 on jammy (22.04.4 LTS), I see these errors in my logs once a day:

Jul 8 17:43:08 yarn-labs kernel: [691764.876662] audit: type=1400 audit(1720431788.377:406): apparmor="DENIED" operation="open" profile="ubuntu_pro_apt_news" name="/var/lib/apt/lists/" pid=503520 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jul 8 17:43:08 yarn-labs kernel: [691764.881552] audit: type=1400 audit(1720431788.381:407): apparmor="DENIED" operation="exec" profile="ubuntu_pro_apt_news" name="/usr/bin/dpkg" pid=503936 comm="python3" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Jul 8 17:43:08 yarn-labs kernel: [691764.884141] audit: type=1400 audit(1720431788.385:408): apparmor="DENIED" operation="open" profile="ubuntu_pro_apt_news" name="/tmp/#24" pid=503520 comm="python3" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
Jul 8 17:43:08 yarn-labs kernel: [691764.884577] audit: type=1400 audit(1720431788.385:409): apparmor="DENIED" operation="mknod" profile="ubuntu_pro_apt_news" name="/tmp/clearsigned.message.Z4ikhX" pid=503520 comm="python3" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Jul 8 17:43:08 yarn-labs kernel: [691764.885759] audit: type=1400 audit(1720431788.385:410): apparmor="DENIED" operation="open" profile="ubuntu_pro_apt_news" name="/tmp/#24" pid=503520 comm="python3" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
Jul 8 17:43:08 yarn-labs kernel: [691764.885873] audit: type=1400 audit(1720431788.385:411): apparmor="DENIED" operation="mknod" profile="ubuntu_pro_apt_news" name="/tmp/clearsigned.message.Awmdfp" pid=503520 comm="python3" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Jul 8 17:43:08 yarn-labs kernel: [691764.886077] audit: type=1400 audit(1720431788.385:412): apparmor="DENIED" operation="open" profile="ubuntu_pro_apt_news" name="/tmp/#24" pid=503520 comm="python3" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
Jul 8 17:43:08 yarn-labs kernel: [691764.889614] audit: type=1400 audit(1720431788.389:413): apparmor="DENIED" operation="mknod" profile="ubuntu_pro_apt_news" name="/tmp/clearsigned.message.neWaMc" pid=503520 comm="python3" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Jul 8 17:43:08 yarn-labs kernel: [691764.889781] audit: type=1400 audit(1720431788.389:414): apparmor="DENIED" operation="open" profile="ubuntu_pro_apt_news" name="/tmp/#24" pid=503520 comm="python3" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
Jul 8 17:43:08 yarn-labs kernel: [691764.889816] audit: type=1400 audit(1720431788.389:415): apparmor="DENIED" operation="mknod" profile="ubuntu_pro_apt_news" name="/tmp/clearsigned.message.5aSBV3" pid=503520 comm="python3" requested_mask="c" denied_mask="c" fsuid=0 ouid=0

[Andreas Hasenack (ahasenack)]

Thanks for this report, I just saw that too. Unsure what changed, because we didn't see these "before", but we can address this.

[Andreas Hasenack (ahasenack)]

Filed upstream issue: https://github.com/canonical/ubuntu-pro-client/issues/3193

[Robie Basak (racb)]

Hello Jeffery, or anyone else affected,

Accepted ubuntu-advantage-tools into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/33.2~24.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Robie Basak (racb)]

Hello Jeffery, or anyone else affected,

Accepted ubuntu-advantage-tools into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/33.2~22.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Robie Basak (racb)]

Hello Jeffery, or anyone else affected,

Accepted ubuntu-advantage-tools into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/33.2~20.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Robie Basak (racb)]

Hello Jeffery, or anyone else affected,

Accepted ubuntu-advantage-tools into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/33.2~18.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Robie Basak (racb)]

Hello Jeffery, or anyone else affected,

Accepted ubuntu-advantage-tools into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/33.2~16.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted ubuntu-advantage-tools (33.2~24.04) for noble have finished running.
The following regressions have been reported in tests triggered by the package:

software-properties/unknown (amd64, i386, ppc64el, s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/noble/update_excuses.html#ubuntu-advantage-tools

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted ubuntu-advantage-tools (33.2~22.04) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

ubuntu-advantage-tools/unknown (armhf)
update-motd/unknown (armhf)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#ubuntu-advantage-tools

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 33.2

---------------
ubuntu-advantage-tools (33.2) oracular; urgency=medium

  * d/apparmor: add apt-news access to package information on the system
    (LP: #2072489) (GH: #3193)

 -- Lucas Moura <email address hidden> Wed, 17 Jul 2024 09:50:56 -0300