[Bug 1773223] Re: man -l local-file fails with Access Denied

[Colin Watson]

This is going to be a bit tricky.

The intent of the AppArmor confinement we do is to leave /usr/bin/man
itself mostly unconfined, but apply rather stricter confinement to
groff-related subprocesses and decompression filters.  It's easy enough
to allow /usr/bin/man itself to read from the network (although it seems
unfortunate that network filesystems require this; that ought to be an
implementation detail).  However, at the moment we have to allow
decompression filters to have filesystem read access because AppArmor
revalidates inherited file descriptors (which also seems an unfortunate
behaviour to me), and I really don't want to grant decompressors the
ability to talk to the network.

What I think we need to do is to launder the input data through the
internal equivalent of a "cat" pipe before sending it to the
decompressor, just to stop AppArmor from doing its annoying revalidation
thing (ideally we'd only do this if AppArmor confinement is in effect,
but that's an optimisation and isn't required).  It would then be
possible to tweak the /usr/bin/man profile and fix this bug.

** Changed in: man-db (Ubuntu)
   Status: New => Triaged

** Changed in: man-db (Ubuntu)
   Importance: Undecided => High

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1773223

Title:
  man -l local-file fails with Access Denied

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/man-db/+bug/1773223/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1773223] Re: man -l local-file fails with Access Denied

[Frank Denissen]

My home directory is indeed on NFSv4.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1773223

Title:
  man -l local-file fails with Access Denied

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/man-db/+bug/1773223/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1773223] Re: man -l local-file fails with Access Denied

[Andrew McKinlay]

Is your home directory on NFS? I am getting the exact same issue. Output
of dmesg:

```
[4399566.994763] audit: type=1400 audit(1537967487.910:1582): apparmor="DENIED" 
operation="sendmsg" profile="/usr/bin/man" pid=5981 comm="man" laddr= 
lport=744 faddr= fport=2049 family="inet" sock_type="stream" 
protocol=6 requested_mask="send" denied_mask="send"
[4399566.995173] nfs: RPC call returned error 13


Looks like an AppArmor config issue.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1773223

Title:
  man -l local-file fails with Access Denied

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/man-db/+bug/1773223/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs