This is not a disconnect between the capability framework (which is integrated into the LSM), nor the devs who implemented AppArmor.
Calls to capable() can have side effects, it is an LSM hook and linux capabilities are implemented as an LSM module that is stacked with the other LSMs. So if an LSM chooses to mediate a capability, it can. AppArmor, Smack, and SELinux all mediate capable calls, which is done in addition to the regular capable subsystem check. Unless the call to capable() is marked with the option CAP_OPT_NOAUDIT, an LSM may generate audit messages. The solution is that the caller of capable() needs to pass the option CAP_OPT_NOAUDIT if there really shouldn't be an audit message generated. If userspace code doesn't want an audit message generated then it needs to work with the LSMs policy to make sure an audit message is not generated. AppArmor policy by default quiets auditing of capability messages if the capability is granted by policy, it also allows disabling of auditing of a message if the capability should be denied. -- You received this bug notification because you are a member of Desktop Packages, which is subscribed to cups-filters in Ubuntu. https://bugs.launchpad.net/bugs/1897369 Title: apparmor: Allow cups-browsed to change nice value (CAP_SYS_NICE) Status in cups-filters package in Ubuntu: Triaged Status in cups-filters package in Debian: New Bug description: In Ubuntu 20.04.1 with *cups-browsed* 1.27.4-1, apparmor prevents `/usr/sbin/cups-browsed` to change its nice value. $ sudo dmesg | grep apparmor [541870.509461] audit: type=1400 audit(1600898428.089:60): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=62030 comm="cups-browsed" capability=23 capname="sys_nice" [628298.779668] audit: type=1400 audit(1600984854.115:61): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=66850 comm="cups-browsed" capability=23 capname="sys_nice" [714667.424963] audit: type=1400 audit(1601071220.527:62): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=76828 comm="cups-browsed" capability=23 capname="sys_nice" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups-filters/+bug/1897369/+subscriptions -- Mailing list: https://launchpad.net/~desktop-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~desktop-packages More help : https://help.launchpad.net/ListHelp
