I did a quick test with apparmor focal-yoga and -proposed this morning to verify it fixes https://bugs.launchpad.net/cloud-archive/+bug/1988270
# testing with focal-yoga Apparmor version tested - 2.13.3-7ubuntu5.2 generate focal-yoga instance juju ssh nova-compute/0 sudo apt-cache policy apparmor sudo vim /etc/apt/sources.list # add -proposed deb http://nova.clouds.archive.ubuntu.com/ubuntu/ focal-proposed main universe # save and exit sudo apt-get upgrade apparmor sudo systemctl restart apparmor tail -n 1000 /var/log/syslog # no errors are thrown by apparmor Jan 9 15:27:40 juju-3151fe-testapparmor-9 apparmor.systemd[62260]: Restarting AppArmor Jan 9 15:27:40 juju-3151fe-testapparmor-9 apparmor.systemd[62260]: Reloading AppArmor profiles Jan 9 15:27:40 juju-3151fe-testapparmor-9 apparmor.systemd[62274]: Skipping profile in /etc/apparmor.d/disable: usr.bin.nova-compute Jan 9 15:27:40 juju-3151fe-testapparmor-9 kernel: [ 1440.404862] audit: type=1400 audit(1673278060.118:74): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="virt-aa-helper" pid=62273 comm="apparmor_parser" Jan 9 15:27:40 juju-3151fe-testapparmor-9 kernel: [ 1440.406888] audit: type=1400 audit(1673278060.118:75): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="/usr/bin/man" pid=62275 comm="apparmor_parser" Jan 9 15:27:40 juju-3151fe-testapparmor-9 kernel: [ 1440.406890] audit: type=1400 audit(1673278060.118:76): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="man_filter" pid=62275 comm="apparmor_parser" Jan 9 15:27:40 juju-3151fe-testapparmor-9 kernel: [ 1440.406892] audit: type=1400 audit(1673278060.118:77): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="man_groff" pid=62275 comm="apparmor_parser" Jan 9 15:27:40 juju-3151fe-testapparmor-9 kernel: [ 1440.408833] audit: type=1400 audit(1673278060.122:78): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="/usr/lib/snapd/snap-confine" pid=62276 comm="apparmor_parser" Jan 9 15:27:40 juju-3151fe-testapparmor-9 kernel: [ 1440.408838] audit: type=1400 audit(1673278060.122:79): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="/usr/lib/snapd/snap-confine//mount-namespace-capture-helper" pid=62276 comm="apparmor_parser" Jan 9 15:27:40 juju-3151fe-testapparmor-9 kernel: [ 1440.415917] audit: type=1400 audit(1673278060.130:80): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=62277 comm="apparmor_parser" Jan 9 15:27:40 juju-3151fe-testapparmor-9 kernel: [ 1440.415921] audit: type=1400 audit(1673278060.130:81): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-helper" pid=62277 comm="apparmor_parser" Jan 9 15:27:40 juju-3151fe-testapparmor-9 kernel: [ 1440.415924] audit: type=1400 audit(1673278060.130:82): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="/usr/lib/connman/scripts/dhclient-script" pid=62277 comm="apparmor_parser" Jan 9 15:27:40 juju-3151fe-testapparmor-9 kernel: [ 1440.415926] audit: type=1400 audit(1673278060.130:83): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="/{,usr/}sbin/dhclient" pid=62277 comm="apparmor_parser" Jan 9 15:27:40 juju-3151fe-testapparmor-9 apparmor.systemd[62279]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd Jan 9 15:27:40 juju-3151fe-testapparmor-9 systemd[1]: Finished Load AppArmor profiles. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1964636 Title: Incorrect handling of apparmor `bpf` capability Status in apparmor package in Ubuntu: In Progress Status in snapd package in Ubuntu: Incomplete Status in apparmor source package in Focal: Fix Committed Bug description: [ Impact ] The apparmor_parser before the 3.0 release would build its capability list from the installed kernel headers. The apparmor_parser was built against a kernel without support for cap 'bpf' This was fixed in 3.0 by having a static caps list (with full mapping info) and the dynamic auto-generated list (against the kernel headers) that is used to check that the static list has not become stale. In addition the parser can pull kernel supported caps straight from the apparmor kernel module (it will however be missing the mapping info). Backporting the patches from 3.0 fixes the issue. [ Test Plan ] Before the fix, the following profile fails loading: # echo "profile foo { capability bpf, }" | apparmor_parser -Q AppArmor parser error, in stdin line 1: Invalid capability bpf. # echo $? 1 After the fix, it works as expected: # echo "profile foo { capability bpf, }" | apparmor_parser -Q # echo $? 0 [ Where problems could occur ] With these changes, the parser can change its behavior based on a few things. 1. the kernel its built against. This would not change behavior when run in a container vs at system level. 2. If a feature-file is specified, via --features-file, --policy- features, or --kernel-features. This allows overriding the normal policy and kernel examination that the parser does when compiling policy. 3. If /sys/kernel/security/apparmor/features is not available. The parser will fallback to an old set of features available in a kernel before the kernel module started exporting what the kernel module supports on the running kernel. [ Other Info ] The patches for focal (apparmor-2.13) can be found at: https://launchpad.net/~georgiag/+archive/ubuntu/mqueue-sru/ As mentioned before, these patches are already running on apparmor-3.0. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1964636/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
