[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-04-13 Thread Robie Basak 
The fix was landed in the apparmor package and no change was needed to
the ntp or tor packages in the end. If I'm wrong, please reopen those
tasks.

** Changed in: ntp (Ubuntu)
   Status: Confirmed => Fix Released

** Changed in: ntp (Ubuntu)
   Status: Fix Released => Invalid

** Changed in: tor (Ubuntu)
   Status: Confirmed => Invalid

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Invalid
Status in tor package in Ubuntu:
  Invalid
Status in apparmor source package in Xenial:
  Fix Released

Bug description:
  [Impact]

   * The base abstraction in xenial  misses some ways programs can push 
 logs to journald

   * Backport the fix form Artful to:
 1. get rid of the Denies making logs less readable
 2. get users to see the actual log entries will help to unbreak many 
other cases

  [Test Case]

   * Install one of the affected packages (in a xenial container is enough)
   * For the case of ntp just install and then run
 systemctl restart ntp
   * in Dmesg you'll see apparmor Denies like
   apparmor="DENIED"
   operation="file_inherit"
   profile="/usr/sbin/ntpd" 
   name="/run/systemd/journal/stdout"
   * Each case is different, in this (ntp) case also some log entries are 
 missed due to the block
   * After installing the fixed package there is no Deny anymore and 
 programs are able to correctly log.

  [Regression Potential]

   * The change is in ubuntu as-is since artful and we are only opening up, 
 but not limiting the access - so there should be nothing that is denied 
 after the update that was not before.
 Vice versa there could be changes due to things now working correcrly, 
 but I'd not see that as a regression.

  [Other Info]
   
   * affects many packages ntp, tor - I even heard examples of mysql.
 But the fix is in apparmor through base abstraction

  ---

  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:

  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.

  There are two AppArmor denials in the kernel log:

  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr" fsuid=10 ouid=10

  Mar  6 15:53:12 zesty-test kernel: [  102.702418] audit: type=1400
  audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m"
  denied_mask="m" fsuid=10 ouid=10

  Workaround: add the following two lines to /etc/apparmor.d/system_tor:

  /usr/bin/tor m,
  /run/systemd/journal/stdout rw,

  I couldn't remember how to that that profile reloaded, so I rebooted,
  and after the reboot tor does start up successfully. "systemctl
  tor@default" reports it as running.

  I haven't checked to see if only one or other rule is actually
  required.

  Importance -> High since this bug makes the package unusable in its
  default configuration on Zesty. Since the AppArmor profile comes from
  Debian's 0.2.9.9-1, this should probably be fixed in Debian.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1670408/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp

[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-03-12 Thread Launchpad Bug Tracker 
This bug was fixed in the package apparmor - 2.10.95-0ubuntu2.9

---
apparmor (2.10.95-0ubuntu2.9) xenial; urgency=medium

  * debian/patches/base-journald-updates.patch: update base abstraction
for additional journald sockets (LP: #1670408)
Backport from 2.11.0-2ubuntu5 by Jamie Strandboge 

 -- Christian Ehrhardt   Tue, 20 Feb
2018 16:04:02 +0100

** Changed in: apparmor (Ubuntu Xenial)
   Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Confirmed
Status in tor package in Ubuntu:
  Confirmed
Status in apparmor source package in Xenial:
  Fix Released

Bug description:
  [Impact]

   * The base abstraction in xenial  misses some ways programs can push 
 logs to journald

   * Backport the fix form Artful to:
 1. get rid of the Denies making logs less readable
 2. get users to see the actual log entries will help to unbreak many 
other cases

  [Test Case]

   * Install one of the affected packages (in a xenial container is enough)
   * For the case of ntp just install and then run
 systemctl restart ntp
   * in Dmesg you'll see apparmor Denies like
   apparmor="DENIED"
   operation="file_inherit"
   profile="/usr/sbin/ntpd" 
   name="/run/systemd/journal/stdout"
   * Each case is different, in this (ntp) case also some log entries are 
 missed due to the block
   * After installing the fixed package there is no Deny anymore and 
 programs are able to correctly log.

  [Regression Potential]

   * The change is in ubuntu as-is since artful and we are only opening up, 
 but not limiting the access - so there should be nothing that is denied 
 after the update that was not before.
 Vice versa there could be changes due to things now working correcrly, 
 but I'd not see that as a regression.

  [Other Info]
   
   * affects many packages ntp, tor - I even heard examples of mysql.
 But the fix is in apparmor through base abstraction

  ---

  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:

  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.

  There are two AppArmor denials in the kernel log:

  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr" fsuid=10 ouid=10

  Mar  6 15:53:12 zesty-test kernel: [  102.702418] audit: type=1400
  audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m"
  denied_mask="m" fsuid=10 ouid=10

  Workaround: add the following two lines to /etc/apparmor.d/system_tor:

  /usr/bin/tor m,
  /run/systemd/journal/stdout rw,

  I couldn't remember how to that that profile reloaded, so I rebooted,
  and after the reboot tor does start up successfully. "systemctl
  tor@default" reports it as running.

  I haven't checked to see if only one or other rule is actually
  required.

  Importance -> High since this bug makes the package unusable in its
  default configuration on Zesty. Since the AppArmor profile comes from
  Debian's 0.2.9.9-1, this should probably be fixed in Debian.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1670408/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp

[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-02-21 Thread ChristianEhrhardt 
Xenial as is on ntp restart:
[2618636.253807] audit: type=1400 audit(1519220834.240:5311): apparmor="DENIED" 
operation="file_inherit" namespace="root//lxd-x_" 
profile="/usr/sbin/ntpd" name="/run/systemd/journal/stdout" pid=24452 
comm="ntpd" requested_mask="wr" denied_mask="wr" fsuid=100 ouid=100
[2618636.253817] audit: type=1400 audit(1519220834.240:5312): apparmor="DENIED" 
operation="file_inherit" namespace="root//lxd-x_" 
profile="/usr/sbin/ntpd" name="/run/systemd/journal/stdout" pid=24452 
comm="ntpd" requested_mask="wr" denied_mask="wr" fsuid=100 ouid=100

With updates from proposed
# sudo apt install apparmor
Reading package lists... Done
Building dependency tree   
Reading state information... Done
The following package was automatically installed and is no longer required:
  libfreetype6
Use 'sudo apt autoremove' to remove it.
Suggested packages:
  apparmor-profiles apparmor-profiles-extra apparmor-docs apparmor-utils
The following packages will be upgraded:
  apparmor
1 upgraded, 0 newly installed, 0 to remove and 29 not upgraded.
Need to get 450 kB of archives.
After this operation, 1024 B of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu xenial-proposed/main amd64 apparmor 
amd64 2.10.95-0ubuntu2.9 [450 kB]
Fetched 450 kB in 0s (2291 kB/s)
Preconfiguring packages ...
(Reading database ... 25611 files and directories currently installed.)
Preparing to unpack .../apparmor_2.10.95-0ubuntu2.9_amd64.deb ...
Unpacking apparmor (2.10.95-0ubuntu2.9) over (2.10.95-0ubuntu2.8) ...
Processing triggers for systemd (229-4ubuntu21.1) ...
Processing triggers for ureadahead (0.100.0-19) ...
Processing triggers for man-db (2.7.5-1) ...
Setting up apparmor (2.10.95-0ubuntu2.9) ...
Installing new version of config file /etc/apparmor.d/abstractions/base ...
update-rc.d: warning: start and stop actions are no longer supported; falling 
back to defaults
Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd


# No issues anymore when restarting the service.
Also found no other apparmor related issues restarting a few services that I 
had on there.

** Tags removed: verification-needed verification-needed-xenial
** Tags added: verification-done verification-done-xenial

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Confirmed
Status in tor package in Ubuntu:
  Confirmed
Status in apparmor source package in Xenial:
  Fix Committed

Bug description:
  [Impact]

   * The base abstraction in xenial  misses some ways programs can push 
 logs to journald

   * Backport the fix form Artful to:
 1. get rid of the Denies making logs less readable
 2. get users to see the actual log entries will help to unbreak many 
other cases

  [Test Case]

   * Install one of the affected packages (in a xenial container is enough)
   * For the case of ntp just install and then run
 systemctl restart ntp
   * in Dmesg you'll see apparmor Denies like
   apparmor="DENIED"
   operation="file_inherit"
   profile="/usr/sbin/ntpd" 
   name="/run/systemd/journal/stdout"
   * Each case is different, in this (ntp) case also some log entries are 
 missed due to the block
   * After installing the fixed package there is no Deny anymore and 
 programs are able to correctly log.

  [Regression Potential]

   * The change is in ubuntu as-is since artful and we are only opening up, 
 but not limiting the access - so there should be nothing that is denied 
 after the update that was not before.
 Vice versa there could be changes due to things now working correcrly, 
 but I'd not see that as a regression.

  [Other Info]
   
   * affects many packages ntp, tor - I even heard examples of mysql.
 But the fix is in apparmor through base abstraction

  ---

  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:

  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.

  There are two AppArmor denials in the kernel log:

  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr"

[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-02-21 Thread Chris J Arges 
Hello Robie, or anyone else affected,

Accepted apparmor into xenial-proposed. The package will build now and
be available at
https://launchpad.net/ubuntu/+source/apparmor/2.10.95-0ubuntu2.9 in a
few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-xenial to verification-done-xenial. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-xenial. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance!

** Changed in: apparmor (Ubuntu Xenial)
   Status: Triaged => Fix Committed

** Tags added: verification-needed verification-needed-xenial

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Confirmed
Status in tor package in Ubuntu:
  Confirmed
Status in apparmor source package in Xenial:
  Fix Committed

Bug description:
  [Impact]

   * The base abstraction in xenial  misses some ways programs can push 
 logs to journald

   * Backport the fix form Artful to:
 1. get rid of the Denies making logs less readable
 2. get users to see the actual log entries will help to unbreak many 
other cases

  [Test Case]

   * Install one of the affected packages (in a xenial container is enough)
   * For the case of ntp just install and then run
 systemctl restart ntp
   * in Dmesg you'll see apparmor Denies like
   apparmor="DENIED"
   operation="file_inherit"
   profile="/usr/sbin/ntpd" 
   name="/run/systemd/journal/stdout"
   * Each case is different, in this (ntp) case also some log entries are 
 missed due to the block
   * After installing the fixed package there is no Deny anymore and 
 programs are able to correctly log.

  [Regression Potential]

   * The change is in ubuntu as-is since artful and we are only opening up, 
 but not limiting the access - so there should be nothing that is denied 
 after the update that was not before.
 Vice versa there could be changes due to things now working correcrly, 
 but I'd not see that as a regression.

  [Other Info]
   
   * affects many packages ntp, tor - I even heard examples of mysql.
 But the fix is in apparmor through base abstraction

  ---

  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:

  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.

  There are two AppArmor denials in the kernel log:

  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr" fsuid=10 ouid=10

  Mar  6 15:53:12 zesty-test kernel: [  102.702418] audit: type=1400
  audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m"
  denied_mask="m" fsuid=10 ouid=10

  Workaround: add the following two lines to /etc/apparmor.d/system_tor:

  /usr/bin/tor m,
  /run/systemd/journal/stdout rw,

  I couldn't remember how to that that profile reloaded, so I rebooted,
  and after the reboot tor does start up successfully. "systemctl
  tor@default" reports it as running.

  I haven't checked to see if only one or other rule is actually
  required.

  Importance -> High since this bug makes the package unusable in its
  default configuration on Zesty. Since the AppArmor profile comes from
  Debian's 0.2.9.9-1, this should probably be fixed in Debian.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1670408/+subscriptions

-- 
Mailing list:

[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-02-21 Thread ChristianEhrhardt 
- Tested 2.10.95-0ubuntu2.9 from PPA (working as expected
- Added SRU Template
- Uploaded for consideration by the SRU team

** Description changed:

+ [Impact]
+ 
+  * The base abstraction in xenial  misses some ways programs can push 
+logs to journald
+ 
+  * Backport the fix form Artful to:
+1. get rid of the Denies making logs less readable
+2. get users to see the actual log entries will help to unbreak many 
+   other cases
+ 
+ [Test Case]
+ 
+  * Install one of the affected packages (in a xenial container is enough)
+  * For the case of ntp just install and then run
+systemctl restart ntp
+  * in Dmesg you'll see apparmor Denies like
+  apparmor="DENIED"
+  operation="file_inherit"
+  profile="/usr/sbin/ntpd" 
+  name="/run/systemd/journal/stdout"
+  * Each case is different, in this (ntp) case also some log entries are 
+missed due to the block
+  * After installing the fixed package there is no Deny anymore and 
+programs are able to correctly log.
+ 
+ [Regression Potential]
+ 
+  * The change is in ubuntu as-is since artful and we are only opening up, 
+but not limiting the access - so there should be nothing that is denied 
+after the update that was not before.
+Vice versa there could be changes due to things now working correcrly, 
+but I'd not see that as a regression.
+ 
+ [Other Info]
+  
+  * affects many packages ntp, tor - I even heard examples of mysql.
+But the fix is in apparmor through base abstraction
+ 
+ ---
+ 
  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:
  
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.
  
  There are two AppArmor denials in the kernel log:
  
  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr" fsuid=10 ouid=10
  
  Mar  6 15:53:12 zesty-test kernel: [  102.702418] audit: type=1400
  audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m"
  denied_mask="m" fsuid=10 ouid=10
  
  Workaround: add the following two lines to /etc/apparmor.d/system_tor:
  
  /usr/bin/tor m,
  /run/systemd/journal/stdout rw,
  
  I couldn't remember how to that that profile reloaded, so I rebooted,
  and after the reboot tor does start up successfully. "systemctl
  tor@default" reports it as running.
  
  I haven't checked to see if only one or other rule is actually required.
  
  Importance -> High since this bug makes the package unusable in its
  default configuration on Zesty. Since the AppArmor profile comes from
  Debian's 0.2.9.9-1, this should probably be fixed in Debian.

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Confirmed
Status in tor package in Ubuntu:
  Confirmed
Status in apparmor source package in Xenial:
  Triaged

Bug description:
  [Impact]

   * The base abstraction in xenial  misses some ways programs can push 
 logs to journald

   * Backport the fix form Artful to:
 1. get rid of the Denies making logs less readable
 2. get users to see the actual log entries will help to unbreak many 
other cases

  [Test Case]

   * Install one of the affected packages (in a xenial container is enough)
   * For the case of ntp just install and then run
 systemctl restart ntp
   * in Dmesg you'll see apparmor Denies like
   apparmor="DENIED"
   operation="file_inherit"
   profile="/usr/sbin/ntpd" 
   name="/run/systemd/journal/stdout"
   * Each case is different, in this (ntp) case also some log entries are 
 missed due to the block
   * After installing the fixed package there is no Deny anymore and 
 programs are able to correctly log.

  [Regression Potential]

   * The change is in ubuntu as-is since artful and we are only opening up, 
 but not limiting the access - so there should be nothing that is denied 
 after the update that was not before.
 Vice versa there could be changes due to things now working correcrly, 
 but

[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-02-20 Thread ChristianEhrhardt 
Thanks Jamie, I'm now testing the fix from https://launchpad.net/~ci-
train-ppa-service/+archive/ubuntu/3169 before pushing as SRU.

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Confirmed
Status in tor package in Ubuntu:
  Confirmed
Status in apparmor source package in Xenial:
  Triaged

Bug description:
  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:

  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.

  There are two AppArmor denials in the kernel log:

  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr" fsuid=10 ouid=10

  Mar  6 15:53:12 zesty-test kernel: [  102.702418] audit: type=1400
  audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m"
  denied_mask="m" fsuid=10 ouid=10

  Workaround: add the following two lines to /etc/apparmor.d/system_tor:

  /usr/bin/tor m,
  /run/systemd/journal/stdout rw,

  I couldn't remember how to that that profile reloaded, so I rebooted,
  and after the reboot tor does start up successfully. "systemctl
  tor@default" reports it as running.

  I haven't checked to see if only one or other rule is actually
  required.

  Importance -> High since this bug makes the package unusable in its
  default configuration on Zesty. Since the AppArmor profile comes from
  Debian's 0.2.9.9-1, this should probably be fixed in Debian.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1670408/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp

[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-02-20 Thread Ubuntu Foundations Team Bug Bot 
** Tags added: patch

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Confirmed
Status in tor package in Ubuntu:
  Confirmed
Status in apparmor source package in Xenial:
  Triaged

Bug description:
  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:

  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.

  There are two AppArmor denials in the kernel log:

  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr" fsuid=10 ouid=10

  Mar  6 15:53:12 zesty-test kernel: [  102.702418] audit: type=1400
  audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m"
  denied_mask="m" fsuid=10 ouid=10

  Workaround: add the following two lines to /etc/apparmor.d/system_tor:

  /usr/bin/tor m,
  /run/systemd/journal/stdout rw,

  I couldn't remember how to that that profile reloaded, so I rebooted,
  and after the reboot tor does start up successfully. "systemctl
  tor@default" reports it as running.

  I haven't checked to see if only one or other rule is actually
  required.

  Importance -> High since this bug makes the package unusable in its
  default configuration on Zesty. Since the AppArmor profile comes from
  Debian's 0.2.9.9-1, this should probably be fixed in Debian.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1670408/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp

[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-02-20 Thread Jamie Strandboge 
This is fine for SRU. Thanks!

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Confirmed
Status in tor package in Ubuntu:
  Confirmed
Status in apparmor source package in Xenial:
  Triaged

Bug description:
  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:

  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.

  There are two AppArmor denials in the kernel log:

  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr" fsuid=10 ouid=10

  Mar  6 15:53:12 zesty-test kernel: [  102.702418] audit: type=1400
  audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m"
  denied_mask="m" fsuid=10 ouid=10

  Workaround: add the following two lines to /etc/apparmor.d/system_tor:

  /usr/bin/tor m,
  /run/systemd/journal/stdout rw,

  I couldn't remember how to that that profile reloaded, so I rebooted,
  and after the reboot tor does start up successfully. "systemctl
  tor@default" reports it as running.

  I haven't checked to see if only one or other rule is actually
  required.

  Importance -> High since this bug makes the package unusable in its
  default configuration on Zesty. Since the AppArmor profile comes from
  Debian's 0.2.9.9-1, this should probably be fixed in Debian.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1670408/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp

[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-02-20 Thread ChristianEhrhardt 
More or less adirect backport of Jamies changes in Artful.
Only opening up rules slightly, so regression risk low.
But I clearly want a security Team ack/review before sponsoring it.

** Patch added: "Backport of 2.11.0-2ubuntu5 fix to Xenial to fix 1670408"
   
https://bugs.launchpad.net/ubuntu/+source/tor/+bug/1670408/+attachment/5058995/+files/xenial-base-journald-updates.debdiff

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Confirmed
Status in tor package in Ubuntu:
  Confirmed
Status in apparmor source package in Xenial:
  Triaged

Bug description:
  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:

  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.

  There are two AppArmor denials in the kernel log:

  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr" fsuid=10 ouid=10

  Mar  6 15:53:12 zesty-test kernel: [  102.702418] audit: type=1400
  audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m"
  denied_mask="m" fsuid=10 ouid=10

  Workaround: add the following two lines to /etc/apparmor.d/system_tor:

  /usr/bin/tor m,
  /run/systemd/journal/stdout rw,

  I couldn't remember how to that that profile reloaded, so I rebooted,
  and after the reboot tor does start up successfully. "systemctl
  tor@default" reports it as running.

  I haven't checked to see if only one or other rule is actually
  required.

  Importance -> High since this bug makes the package unusable in its
  default configuration on Zesty. Since the AppArmor profile comes from
  Debian's 0.2.9.9-1, this should probably be fixed in Debian.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1670408/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp

[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-02-20 Thread ChristianEhrhardt 
This is already fixed as backport in other releases - here apparmor
2.11.0-2ubuntu5 in Artful

apparmor (2.11.0-2ubuntu5) artful; urgency=medium   
 

 
  * debian/patches/base-journald-updates.patch: update base abstraction for 
 
additional journald sockets 
 

 
 -- Jamie Strandboge   Thu, 27 Apr 2017 16:09:50 +

We can use that as it already has some adaption for backports don (like
var, run)

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Confirmed
Status in tor package in Ubuntu:
  Confirmed
Status in apparmor source package in Xenial:
  Triaged

Bug description:
  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:

  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.

  There are two AppArmor denials in the kernel log:

  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr" fsuid=10 ouid=10

  Mar  6 15:53:12 zesty-test kernel: [  102.702418] audit: type=1400
  audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m"
  denied_mask="m" fsuid=10 ouid=10

  Workaround: add the following two lines to /etc/apparmor.d/system_tor:

  /usr/bin/tor m,
  /run/systemd/journal/stdout rw,

  I couldn't remember how to that that profile reloaded, so I rebooted,
  and after the reboot tor does start up successfully. "systemctl
  tor@default" reports it as running.

  I haven't checked to see if only one or other rule is actually
  required.

  Importance -> High since this bug makes the package unusable in its
  default configuration on Zesty. Since the AppArmor profile comes from
  Debian's 0.2.9.9-1, this should probably be fixed in Debian.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1670408/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp

[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-02-20 Thread ChristianEhrhardt 
@jdstrand - I subscribed you and would ask for your review of the
proposed debdiff.

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Confirmed
Status in tor package in Ubuntu:
  Confirmed
Status in apparmor source package in Xenial:
  Triaged

Bug description:
  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:

  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.

  There are two AppArmor denials in the kernel log:

  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr" fsuid=10 ouid=10

  Mar  6 15:53:12 zesty-test kernel: [  102.702418] audit: type=1400
  audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m"
  denied_mask="m" fsuid=10 ouid=10

  Workaround: add the following two lines to /etc/apparmor.d/system_tor:

  /usr/bin/tor m,
  /run/systemd/journal/stdout rw,

  I couldn't remember how to that that profile reloaded, so I rebooted,
  and after the reboot tor does start up successfully. "systemctl
  tor@default" reports it as running.

  I haven't checked to see if only one or other rule is actually
  required.

  Importance -> High since this bug makes the package unusable in its
  default configuration on Zesty. Since the AppArmor profile comes from
  Debian's 0.2.9.9-1, this should probably be fixed in Debian.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1670408/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp

[Touch-packages] [Bug 1670408] Re: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...)

2018-02-14 Thread ChristianEhrhardt 
** Changed in: apparmor (Ubuntu Xenial)
   Importance: Undecided => High

** Changed in: tor (Ubuntu)
   Status: Invalid => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1670408

Title:
  apparmor base abstraction needs backport of rev 3658 to fix several
  denies (tor, ntp, ...)

Status in apparmor package in Ubuntu:
  Fix Released
Status in ntp package in Ubuntu:
  Confirmed
Status in tor package in Ubuntu:
  Confirmed
Status in apparmor source package in Xenial:
  Triaged

Bug description:
  Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor
  fails to start after installing the tor package. "systemctl status
  tor@default" reports:

  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, 
code=killed, status=11/SEGV
  Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network 
for TCP.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed 
state.
  Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 
'signal'.

  There are two AppArmor denials in the kernel log:

  Mar  6 15:53:12 zesty-test kernel: [  102.699647] audit: type=1400
  audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/run/systemd/journal/stdout" pid=3520 comm="tor"
  requested_mask="wr" denied_mask="wr" fsuid=10 ouid=10

  Mar  6 15:53:12 zesty-test kernel: [  102.702418] audit: type=1400
  audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap"
  namespace="root//lxd-zesty_" profile="system_tor"
  name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m"
  denied_mask="m" fsuid=10 ouid=10

  Workaround: add the following two lines to /etc/apparmor.d/system_tor:

  /usr/bin/tor m,
  /run/systemd/journal/stdout rw,

  I couldn't remember how to that that profile reloaded, so I rebooted,
  and after the reboot tor does start up successfully. "systemctl
  tor@default" reports it as running.

  I haven't checked to see if only one or other rule is actually
  required.

  Importance -> High since this bug makes the package unusable in its
  default configuration on Zesty. Since the AppArmor profile comes from
  Debian's 0.2.9.9-1, this should probably be fixed in Debian.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1670408/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp