[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
@Andrew: Simon is correct. This update deliberately had an unusual roll- out where it went to updates first so that it could be phased, and we could roll back if the phasing showed a problem. The security pocket was not updated specifically to provide a users a way to easily revert the update. As mentioned this state is only going to exist for a week (planned) or two, and then the update will be synced to the security pocket once we are sure the update has not caused significant issues. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Released Status in apparmor source package in Jammy: Fix Released Bug description: [Impact] * The mount rules in apparmor grant excessive permissions. See Original Report below. [Test Plan] * https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor See comment 26 for context. [Other Info] SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. [Risk of Regression] The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
@Simon, thank you for the link, that also clarifies Steve's comment (https://bugs.launchpad.net/apparmor/+bug/1597017/comments/25) earlier in this thread which I didn't interpret appropriately during first read through. Based on the linked thread the plan was to publish to the security repository last week, but I have my questions answered and will sit tight until that takes place. Appreciate your help! -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Released Status in apparmor source package in Jammy: Fix Released Bug description: [Impact] * The mount rules in apparmor grant excessive permissions. See Original Report below. [Test Plan] * https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor See comment 26 for context. [Other Info] SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. [Risk of Regression] The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
@Andrew, I think publishing to -updates first and then to -security was intentional per https://discourse.ubuntu.com/t/upcoming-apparmor- security-update-for-cve-2016-1585/44268/3 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Released Status in apparmor source package in Jammy: Fix Released Bug description: [Impact] * The mount rules in apparmor grant excessive permissions. See Original Report below. [Test Plan] * https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor See comment 26 for context. [Other Info] SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. [Risk of Regression] The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
I am running Focal Fossa and noticed that AppArmor was vulnerable (CVE-2016-1585). My automatic upgrade attempts were not upgrading from the vulnerable version 2.13.3-7ubuntu5.3build2 to the latest version 2.13.3-7ubuntu5.4. When investigating further it is because my systems are configured to only pull updates out of the security repository, which does not include this update. I posted a question in the general AppArmor area and it was suggested to bring this up in this specific bug thread. The thought is that the version released around this bug should be included in the security repository, not just the update repository. If this is indeed an issue, the same can be said for the jammy releases as well. Link to my question: https://answers.launchpad.net/ubuntu/+source/apparmor/+question/818906 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Released Status in apparmor source package in Jammy: Fix Released Bug description: [Impact] * The mount rules in apparmor grant excessive permissions. See Original Report below. [Test Plan] * https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor See comment 26 for context. [Other Info] SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. [Risk of Regression] The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
This bug was fixed in the package apparmor - 2.13.3-7ubuntu5.4 --- apparmor (2.13.3-7ubuntu5.4) focal-security; urgency=medium * SECURITY UPDATE: Excessive permissions with mount rules (LP: #1597017) - d/p/CVE-2016-1585/parser-Fix-expansion-of-variables-in-unix-rules-addr.patch: add calls to filter_slashes() in parser/af_unix.cc, make it external in parser/parser.h and change it to void in parser/parser_regex.c. - d/p/CVE-2016-1585/parser-enable-variable-expansion-for-mount-type-and-.patch: add variable expansion with expand_entry_variables() in parser/mount.cc. - d/p/CVE-2016-1585/parser-call-filter-slashes-for-mount-conditionals.patch: add calls to filter_slashes() in parser/mount.cc. - d/p/CVE-2016-1585/Support-rule-qualifiers-in-regression-tests.patch: update rule qualifiers in regression tests in tests/regression/apparmor/mkprofile.pl and tests/regression/apparmor/capabilities.sh. - d/p/CVE-2016-1585/Merge-Fix-mount-rules-encoding.patch: fix mount rules encoding in parser/mount.cc, parser/mount.h, parser/parser.h and fix multiple test cases in parser/tst/simple_tests/mount/*. - d/p/CVE-2016-1585/Merge-expand-mount-tests.patch: expand mount regression tests in tests/regression/apparmor/Makefile, tests/regression/apparmor/mount.c, tests/regression/apparmor/mount.sh and tests/regression/apparmor/mkprofile.pl. - d/p/CVE-2016-1585/Merge-Issue-312-added-missing-kernel-mount-options.patch: add missing kernel mount options flag in parser/apparmor.d.pod, parser/mount.cc, parser/mount.h, tests/regression/apparmor/mount.sh and parser/tst/simple_tests/mount/*. - d/p/CVE-2016-1585/Merge-extend-test-profiles-for-mount.patch: update test profiles in parser/tst/simple_tests/mount/*. - d/p/CVE-2016-1585/Merge-parser-fix-parsing-of-source-as-mount-point-fo.patch: update gen_policy_change_mount_type() in parser/mount.cc and also updated tests on parser/tst/simple_tests/mount/* and tests/regression/apparmor/mount.sh. - d/p/CVE-2016-1585/parser-fix-rule-flag-generation-change_mount-type-ru.patch: add device checks in gen_flag_rules() in parser/mount.cc and tests in parser/tst/simple_tests/mount/*, parser/tst/equality.sh, tests/regression/apparmor/mount.sh and utils/test/test-parser-simple-tests.py. - d/p/CVE-2016-1585/Fix-build-failure-in-df4ed537e-allow-reading-of-etc-.patch: remove the WARN_DEPRECATED flag in pwarn call in parser/mount.cc. - d/p/CVE-2016-1585/parser-Deprecation-warning-should-not-have-been-back.patch: remove deprecation warning message in parser/mount.cc. - CVE-2016-1585 -- Rodrigo Figueiredo Zaiden Tue, 06 Mar 2024 15:40:00 -0300 ** Changed in: apparmor (Ubuntu Focal) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Released Status in apparmor source package in Jammy: Fix Released Bug description: [Impact] * The mount rules in apparmor grant excessive permissions. See Original Report below. [Test Plan] * https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor See comment 26 for context. [Other Info] SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. [Risk of Regression] The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpa
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
This bug was fixed in the package apparmor - 3.0.4-2ubuntu2.4 --- apparmor (3.0.4-2ubuntu2.4) jammy-security; urgency=medium * SECURITY UPDATE: Excessive permissions with mount rules (LP: #1597017) - d/p/CVE-2016-1585/Merge-Fix-mount-rules-encoding.patch: fix mount rules encoding in parser/mount.cc, parser/mount.h, parser/parser.h and fix multiple test cases in parser/tst/simple_tests/mount/*. - d/p/CVE-2016-1585/Support-rule-qualifiers-in-regression-tests.patch: update rule qualifiers in regression tests in tests/regression/apparmor/mkprofile.pl and tests/regression/apparmor/capabilities.sh. - d/p/CVE-2016-1585/Merge-expand-mount-tests.patch: expand mount regression tests in tests/regression/apparmor/mount.c, tests/regression/apparmor/mount.sh and tests/regression/apparmor/mkprofile.pl. - d/p/CVE-2016-1585/Check-for-newer-mount-options-in-regression-test.patch: add check for newer mount options in regression tests in tests/regression/apparmor/Makefile, tests/regression/apparmor/mount.c and tests/regression/apparmor/mount.sh. - d/p/CVE-2016-1585/Merge-Issue-312-added-missing-kernel-mount-options.patch: add missing kernel mount options flag in parser/apparmor.d.pod, parser/mount.cc, parser/mount.h, tests/regression/apparmor/mount.sh and parser/tst/simple_tests/mount/*. - d/p/CVE-2016-1585/Merge-extend-test-profiles-for-mount.patch: update test profiles in parser/tst/simple_tests/mount/*. - d/p/CVE-2016-1585/Merge-parser-fix-parsing-of-source-as-mount-point-fo.patch: update gen_policy_change_mount_type() in parser/mount.cc and also updated tests on parser/tst/simple_tests/mount/* and tests/regression/apparmor/mount.sh. - d/p/CVE-2016-1585/parser-Deprecation-warning-should-not-have-been-back.patch: remove deprecation warning message in parser/mount.cc. - d/p/CVE-2016-1585/parser-fix-rule-flag-generation-change_mount-type-ru.patch: add device checks in gen_flag_rules() in parser/mount.cc and tests in parser/tst/simple_tests/mount/*, parser/tst/equality.sh, tests/regression/apparmor/mount.sh and utils/test/test-parser-simple-tests.py. - CVE-2016-1585 -- Rodrigo Figueiredo Zaiden Tue, 06 Mar 2024 15:35:00 -0300 ** Changed in: apparmor (Ubuntu Jammy) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Released Status in apparmor source package in Jammy: Fix Released Bug description: [Impact] * The mount rules in apparmor grant excessive permissions. See Original Report below. [Test Plan] * https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor See comment 26 for context. [Other Info] SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. [Risk of Regression] The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
Autopkgtests preventing migration look good now. All have passed and cleared up in update_excuses (only libreoffice/jammy/armhf running; expecting it to pass based on previous history and results from same package/version in other architectures). Proceeding with release to Jammy and Focal. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Released Status in apparmor source package in Jammy: Fix Released Bug description: [Impact] * The mount rules in apparmor grant excessive permissions. See Original Report below. [Test Plan] * https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor See comment 26 for context. [Other Info] SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. [Risk of Regression] The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
** Description changed: + [Impact] + + * The mount rules in apparmor grant excessive permissions. +See Original Report below. + + [Test Plan] + + * https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor +See comment 26 for context. + + [Other Info] + SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. - Risk of Regression: + [Risk of Regression] The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Committed Bug description: [Impact] * The mount rules in apparmor grant excessive permissions. See Original Report below. [Test Plan] * https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor See comment 26 for context. [Other Info] SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. [Risk of Regression] The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
Thanks, Rodrigo! There are outdated autopkgtests (i.e., ran against reverse-test-deps that now have newer versions in -updates), which I triggered reruns for. Once that looks good (hopefully during my shift today, or maybe tomorrow), I'll take a look for release. Details: --- jammy: https://ubuntu-archive-team.ubuntu.com/proposed-migration/jammy/update_excuses.html#apparmor adsys/0.9.2~22.04.2 cups/2.4.1op1-1ubuntu4.8 dovecot/1:2.3.16+dfsg1-3ubuntu2.2 libreoffice/1:7.3.7-0ubuntu0.22.04.4 libvirt/8.0.0-1ubuntu7.8 libvirt/8.0.0-1ubuntu7.9 php8.1/8.1.2-1ubuntu2.14 snapd/2.61.3+22.04 squid/5.7-0ubuntu0.22.04.3 focal: https://ubuntu-archive-team.ubuntu.com/proposed-migration/focal/update_excuses.html#apparmor dovecot/1:2.3.7.2-1ubuntu3.6 libreoffice/1:6.4.7-0ubuntu0.20.04.9 libvirt/6.0.0-0ubuntu8.16 php7.4/7.4.3-4ubuntu2.20 snapd/2.61.3+20.04 squid/4.10-1ubuntu1.9 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Committed Bug description: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
Testing Documentation: This update was tested following the guidelines available at: https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor In summary, they are: - AppArmor cache files verification; - Basic Ubuntu login tests: network, browser, apt; - LXC, LXD, Docker basic operations and apparmor behavior; - snapd hello-world confinement testing; - qa-regression-testing suite for apparmor, libvirt and dbus -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Committed Bug description: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
** Tags removed: verification-needed-focal verification-needed-jammy ** Tags added: verification-done-focal verification-done-jammy ** Tags removed: verification-needed ** Tags added: verification-done -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Committed Bug description: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
Actual fixed versions for this issue are still sitting in focal-proposed and jammy-proposed. However, we did a no-change rebuild ofthe current versions in the respective updates pockets to the security pocket, so that the version in proposed could be published first in the updates pocket, but leaving people who experience possible issues the opportunity for an easy downgrade path to the prior version (via apt install apparmor/jammy-security or apparmor/focal-security as the case may be). ** Changed in: apparmor (Ubuntu Focal) Status: Fix Released => Fix Committed ** Changed in: apparmor (Ubuntu Jammy) Status: Fix Released => Fix Committed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Committed Bug description: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
This bug was fixed in the package apparmor - 2.13.3-7ubuntu5.3build2 --- apparmor (2.13.3-7ubuntu5.3build2) focal-security; urgency=medium * No-change re-build upload for the focal-security pocket as part of the preparation for addressing CVE-2016-1585 (LP: #1597017) -- Steve Beattie Tue, 27 Aug 2024 14:51:30 -0700 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Released Status in apparmor source package in Jammy: Fix Released Bug description: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
This bug was fixed in the package apparmor - 3.0.4-2ubuntu2.3build2 --- apparmor (3.0.4-2ubuntu2.3build2) jammy-security; urgency=medium * No-change re-build upload for the jammy-security pocket as part of the preparation for addressing CVE-2016-1585 (LP: #1597017) -- Steve Beattie Tue, 27 Aug 2024 14:48:42 -0700 ** Changed in: apparmor (Ubuntu Jammy) Status: Fix Committed => Fix Released ** Changed in: apparmor (Ubuntu Focal) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Released Status in apparmor source package in Jammy: Fix Released Bug description: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
Hi, gentle ping on this; is there an ETA for this to land in 22.04? Let me know if I can help with testing. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Committed Bug description: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
Hello John, or anyone else affected, Accepted apparmor into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/apparmor/3.0.4-2ubuntu2.4 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed- jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification- failed-jammy. In either case, without details of your testing we will not be able to proceed. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping! N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days. ** Description changed: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu - archive, but conainter managers outside of the ubunty archive may run + archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag ** Changed in: apparmor (Ubuntu Jammy) Status: In Progress => Fix Committed ** Tags added: verification-needed verification-needed-jammy ** Changed in: apparmor (Ubuntu Focal) Status: In Progress => Fix Committed ** Tags added: verification-needed-focal -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Committed Bug description: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but container managers outside of the ubuntu archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : ht
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
It is in the SRU queue and the current ETA is April 15 to land in the proposed pocket (archive proposed not security proposed ppa), there is a caveat that the recent xz backdoor has caused some "fun" on the archive side and could potentially cause some delays. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: In Progress Status in apparmor source package in Jammy: In Progress Bug description: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but conainter managers outside of the ubunty archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
Hello, A gentle ping on this issue, it still shows up on jammy security report and looks like 2ubuntu2.3 here https://changelogs.ubuntu.com/changelogs/pool/main/a/apparmor/apparmor_3.0.4-2ubuntu2.3/changelog doesn't have the fix. @jjohansen can we please advise on when the fix will be backported to ubuntu 22.04? thanks -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: In Progress Status in apparmor source package in Jammy: In Progress Bug description: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but conainter managers outside of the ubunty archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
** Description changed: + SRU Team; the packages for focal-proposed and jammy-proposed are + intended as security updates prepared by the Ubuntu Security team (and + have built in a ppa with only the security pockets enabled). However, + because the fix makes mount rules in apparmor policy be treated more + restrictively than they were prior to this update, we would like these + packages to gain more widespread testing. + + Risk of Regression: + + The update for this issue causes the apparmor parser, the tool that + translates written policy into the enforcement data structures used by + the kernel, to generate more strict policy for mount rules, like the + example below. They are not common in apparmor policy generally, but can + appear in policies written for container managers to restrict + containers, and thus can potentially break container startup. + + The packages prepared for focal-proposed and jammy-proposed have tested + with the versions of snapd, lxc, libvirt, and docker in the ubuntu + archive, but conainter managers outside of the ubunty archive may run + into issues, hence the need for testing and policy adjustments. + + Original Report: + The rule - mount options=(rw,make-slave) -> **, + mount options=(rw,make-slave) -> **, ends up allowing - mount -t proc proc /mnt + mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: In Progress Status in apparmor source package in Jammy: In Progress Bug description: SRU Team; the packages for focal-proposed and jammy-proposed are intended as security updates prepared by the Ubuntu Security team (and have built in a ppa with only the security pockets enabled). However, because the fix makes mount rules in apparmor policy be treated more restrictively than they were prior to this update, we would like these packages to gain more widespread testing. Risk of Regression: The update for this issue causes the apparmor parser, the tool that translates written policy into the enforcement data structures used by the kernel, to generate more strict policy for mount rules, like the example below. They are not common in apparmor policy generally, but can appear in policies written for container managers to restrict containers, and thus can potentially break container startup. The packages prepared for focal-proposed and jammy-proposed have tested with the versions of snapd, lxc, libvirt, and docker in the ubuntu archive, but conainter managers outside of the ubunty archive may run into issues, hence the need for testing and policy adjustments. Original Report: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
FYI This is now in the jammy and focal upload queues to go to -proposed. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: In Progress Status in apparmor source package in Jammy: In Progress Bug description: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions
** Also affects: apparmor (Ubuntu) Importance: Undecided Status: New ** Also affects: apparmor (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: apparmor (Ubuntu Focal) Importance: Undecided Status: New ** Changed in: apparmor (Ubuntu) Status: New => Fix Released ** Changed in: apparmor (Ubuntu Focal) Status: New => In Progress ** Changed in: apparmor (Ubuntu Jammy) Status: New => In Progress -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1597017 Title: mount rules grant excessive permissions Status in AppArmor: Fix Released Status in apparmor package in Ubuntu: Fix Released Status in apparmor source package in Focal: In Progress Status in apparmor source package in Jammy: In Progress Bug description: The rule mount options=(rw,make-slave) -> **, ends up allowing mount -t proc proc /mnt which it shouldn't as it should be restricted to commands with a make- slave flag To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1597017/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
