[Touch-packages] [Bug 2011628] Re: Apparmor Disallows Disabling Dhclient Scripts
Ubuntu 23.04 (Lunar Lobster) has reached end of life, so this bug will not be fixed for that specific release. ** Changed in: isc-dhcp (Ubuntu Lunar) Status: New => Won't Fix -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu. https://bugs.launchpad.net/bugs/2011628 Title: Apparmor Disallows Disabling Dhclient Scripts Status in isc-dhcp package in Ubuntu: Fix Released Status in isc-dhcp source package in Focal: New Status in isc-dhcp source package in Jammy: New Status in isc-dhcp source package in Lunar: Won't Fix Status in isc-dhcp package in Debian: New Bug description: In some cases, it may be desirable to disable dhclient scripts. By default /sbin/dhclient-script is used, and some others are allowed by the apparmor profile. Without Apparmor, disabling hook scripts can be accomplished with flags -sf /bin/true, but with apparmor enabled this gets blocked: execve (/bin/true, ...): Permission denied Unfortunately dhclient doesn't appear to provide any other mechanism for disabling hook scripts. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/2011628/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 2011628] Re: Apparmor Disallows Disabling Dhclient Scripts
> Cloud-init users on these releases that wish to see no apparmour warnings
> might locally include this rule themselves via:
>
> echo " /bin/true Uxr," > /etc/apparmor.d/local/sbin.dhclient
Note for other users finding their way here via googling for error
messages: On jammy (22.04) at least, you will need to account for /bin
being a symlink to /usr/bin, and thus the line becomes (following the
standard brace syntax and also the ordering conventions in the default
apparmor profiles):
echo ' /{,usr/}bin/true Uxr,' > /etc/apparmor.d/local/sbin.dhclient
This will silence the execve warnings in 22.04.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu.
https://bugs.launchpad.net/bugs/2011628
Title:
Apparmor Disallows Disabling Dhclient Scripts
Status in isc-dhcp package in Ubuntu:
Fix Released
Status in isc-dhcp source package in Focal:
New
Status in isc-dhcp source package in Jammy:
New
Status in isc-dhcp source package in Lunar:
New
Status in isc-dhcp package in Debian:
New
Bug description:
In some cases, it may be desirable to disable dhclient scripts. By
default /sbin/dhclient-script is used, and some others are allowed by
the apparmor profile.
Without Apparmor, disabling hook scripts can be accomplished with
flags -sf /bin/true, but with apparmor enabled this gets blocked:
execve (/bin/true, ...): Permission denied
Unfortunately dhclient doesn't appear to provide any other mechanism
for disabling hook scripts.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/2011628/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 2011628] Re: Apparmor Disallows Disabling Dhclient Scripts
This bubbled back up in the sponsorship queue due to the recent comment activity. However, you say: > this "fix" just eliminates harmless warnings, which is not worth backporting to old releases. It appears there is nothing here to be sponsored currently, so I am unsubscribing the ubuntu-sponsors team. Please resubscribe us if that changes. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu. https://bugs.launchpad.net/bugs/2011628 Title: Apparmor Disallows Disabling Dhclient Scripts Status in isc-dhcp package in Ubuntu: Fix Released Status in isc-dhcp source package in Focal: New Status in isc-dhcp source package in Jammy: New Status in isc-dhcp source package in Lunar: New Status in isc-dhcp package in Debian: New Bug description: In some cases, it may be desirable to disable dhclient scripts. By default /sbin/dhclient-script is used, and some others are allowed by the apparmor profile. Without Apparmor, disabling hook scripts can be accomplished with flags -sf /bin/true, but with apparmor enabled this gets blocked: execve (/bin/true, ...): Permission denied Unfortunately dhclient doesn't appear to provide any other mechanism for disabling hook scripts. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/2011628/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 2011628] Re: Apparmor Disallows Disabling Dhclient Scripts
Actually, it popped back up in our queue because Christian had targeted the bug to the stable releases - not because of the comment activity. In any case, nothing currently here for sponsorship. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu. https://bugs.launchpad.net/bugs/2011628 Title: Apparmor Disallows Disabling Dhclient Scripts Status in isc-dhcp package in Ubuntu: Fix Released Status in isc-dhcp source package in Focal: New Status in isc-dhcp source package in Jammy: New Status in isc-dhcp source package in Lunar: New Status in isc-dhcp package in Debian: New Bug description: In some cases, it may be desirable to disable dhclient scripts. By default /sbin/dhclient-script is used, and some others are allowed by the apparmor profile. Without Apparmor, disabling hook scripts can be accomplished with flags -sf /bin/true, but with apparmor enabled this gets blocked: execve (/bin/true, ...): Permission denied Unfortunately dhclient doesn't appear to provide any other mechanism for disabling hook scripts. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/2011628/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 2011628] Re: Apparmor Disallows Disabling Dhclient Scripts
This bug was fixed in the package isc-dhcp - 4.4.3-P1-1ubuntu2 --- isc-dhcp (4.4.3-P1-1ubuntu2) mantic; urgency=medium * debian/apparmor/sbin.dhclient: Allow disabling dhclient hooks. LP: #2011628 -- Brett Holman Fri, 17 Mar 2023 15:38:35 -0600 ** Changed in: isc-dhcp (Ubuntu) Status: Triaged => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu. https://bugs.launchpad.net/bugs/2011628 Title: Apparmor Disallows Disabling Dhclient Scripts Status in isc-dhcp package in Ubuntu: Fix Released Status in isc-dhcp package in Debian: New Bug description: In some cases, it may be desirable to disable dhclient scripts. By default /sbin/dhclient-script is used, and some others are allowed by the apparmor profile. Without Apparmor, disabling hook scripts can be accomplished with flags -sf /bin/true, but with apparmor enabled this gets blocked: execve (/bin/true, ...): Permission denied Unfortunately dhclient doesn't appear to provide any other mechanism for disabling hook scripts. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/2011628/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 2011628] Re: Apparmor Disallows Disabling Dhclient Scripts
** Changed in: isc-dhcp (Debian) Status: Unknown => New -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu. https://bugs.launchpad.net/bugs/2011628 Title: Apparmor Disallows Disabling Dhclient Scripts Status in isc-dhcp package in Ubuntu: Triaged Status in isc-dhcp package in Debian: New Bug description: In some cases, it may be desirable to disable dhclient scripts. By default /sbin/dhclient-script is used, and some others are allowed by the apparmor profile. Without Apparmor, disabling hook scripts can be accomplished with flags -sf /bin/true, but with apparmor enabled this gets blocked: execve (/bin/true, ...): Permission denied Unfortunately dhclient doesn't appear to provide any other mechanism for disabling hook scripts. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/2011628/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 2011628] Re: Apparmor Disallows Disabling Dhclient Scripts
** Bug watch added: Debian Bug tracker #1033597 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033597 ** Also affects: isc-dhcp (Debian) via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033597 Importance: Unknown Status: Unknown -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu. https://bugs.launchpad.net/bugs/2011628 Title: Apparmor Disallows Disabling Dhclient Scripts Status in isc-dhcp package in Ubuntu: Triaged Status in isc-dhcp package in Debian: Unknown Bug description: In some cases, it may be desirable to disable dhclient scripts. By default /sbin/dhclient-script is used, and some others are allowed by the apparmor profile. Without Apparmor, disabling hook scripts can be accomplished with flags -sf /bin/true, but with apparmor enabled this gets blocked: execve (/bin/true, ...): Permission denied Unfortunately dhclient doesn't appear to provide any other mechanism for disabling hook scripts. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/2011628/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 2011628] Re: Apparmor Disallows Disabling Dhclient Scripts
I wondered if this needed an FFe, but then I considered that we're fixing an Apparmor profile to do what the command would allow anyway, and I think that fixing Apparmor profiles is not something that generally would violate feature freeze. So I'm not bothering the release team with this one and am instead documenting why :-) ** Merge proposal linked: https://code.launchpad.net/~holmanb/ubuntu/+source/isc-dhcp/+git/isc-dhcp/+merge/439186 ** Changed in: isc-dhcp (Ubuntu) Status: New => Triaged ** Changed in: isc-dhcp (Ubuntu) Importance: Undecided => Medium -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu. https://bugs.launchpad.net/bugs/2011628 Title: Apparmor Disallows Disabling Dhclient Scripts Status in isc-dhcp package in Ubuntu: Triaged Bug description: In some cases, it may be desirable to disable dhclient scripts. By default /sbin/dhclient-script is used, and some others are allowed by the apparmor profile. Without Apparmor, disabling hook scripts can be accomplished with flags -sf /bin/true, but with apparmor enabled this gets blocked: execve (/bin/true, ...): Permission denied Unfortunately dhclient doesn't appear to provide any other mechanism for disabling hook scripts. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/2011628/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 2011628] Re: Apparmor Disallows Disabling Dhclient Scripts
The attachment "isc-dhcp-apparmor-scripts-disable-fix.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team. [This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.] ** Tags added: patch -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu. https://bugs.launchpad.net/bugs/2011628 Title: Apparmor Disallows Disabling Dhclient Scripts Status in isc-dhcp package in Ubuntu: New Bug description: In some cases, it may be desirable to disable dhclient scripts. By default /sbin/dhclient-script is used, and some others are allowed by the apparmor profile. Without Apparmor, disabling hook scripts can be accomplished with flags -sf /bin/true, but with apparmor enabled this gets blocked: execve (/bin/true, ...): Permission denied Unfortunately dhclient doesn't appear to provide any other mechanism for disabling hook scripts. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/2011628/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 2011628] Re: Apparmor Disallows Disabling Dhclient Scripts
Debdiff in the attached enables dhclient to execute dhclient with -sf /bin/true ** Patch added: "isc-dhcp-apparmor-scripts-disable-fix.debdiff" https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/2011628/+attachment/5654529/+files/isc-dhcp-apparmor-scripts-disable-fix.debdiff -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu. https://bugs.launchpad.net/bugs/2011628 Title: Apparmor Disallows Disabling Dhclient Scripts Status in isc-dhcp package in Ubuntu: New Bug description: In some cases, it may be desirable to disable dhclient scripts. By default /sbin/dhclient-script is used, and some others are allowed by the apparmor profile. Without Apparmor, disabling hook scripts can be accomplished with flags -sf /bin/true, but with apparmor enabled this gets blocked: execve (/bin/true, ...): Permission denied Unfortunately dhclient doesn't appear to provide any other mechanism for disabling hook scripts. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/2011628/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
