[Kernel-packages] [Bug 1696369] Re: linux: 4.10.0-23.25 -proposed tracker

2017-06-19 Thread John Johansen
Looks good ** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1696369 Title: linux:

[Kernel-packages] [Bug 1696365] Re: linux: 4.8.0-55.58 -proposed tracker

2017-06-19 Thread John Johansen
Looks good ** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1696365 Title: linux:

[Kernel-packages] [Bug 1696362] Re: linux-aws: 4.4.0-1019.28 -proposed tracker

2017-06-19 Thread John Johansen
Looks good -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-aws in Ubuntu. https://bugs.launchpad.net/bugs/1696362 Title: linux-aws: 4.4.0-1019.28 -proposed tracker Status in Kernel SRU Workflow: In Progress Status in Kernel

[Kernel-packages] [Bug 1696362] Re: linux-aws: 4.4.0-1019.28 -proposed tracker

2017-06-19 Thread John Johansen
Looks good ** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-aws in Ubuntu. https://bugs.launchpad.net/bugs/1696362 Title: linux-aws:

[Kernel-packages] [Bug 1696357] Re: linux: 4.4.0-80.101 -proposed tracker

2017-06-19 Thread John Johansen
Loooks good ** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1696357 Title: linux:

[Kernel-packages] [Bug 1696352] Re: linux: 3.13.0-120.167 -proposed tracker

2017-06-19 Thread John Johansen
Looks good ** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1696352 Title: linux:

[Kernel-packages] [Bug 1698919] Re: CVE-2017-1000364

2017-06-19 Thread John Johansen
CVE-2017-1000364 ** Also affects: linux (Ubuntu Artful) Importance: Undecided Status: New ** Also affects: linux-ti-omap4 (Ubuntu Artful) Importance: Undecided Status: New ** Also affects: linux-raspi2 (Ubuntu Artful) Importance: Undecided Status: New ** Also

[Kernel-packages] [Bug 1698919] [NEW] CVE-2017-1000364

2017-06-19 Thread John Johansen
*** This bug is a security vulnerability *** Public security bug reported: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be jumped over Break-Fix: 320b2b8de12698082609ebbc1a17165727f4c893 - ** Affects:

[Kernel-packages] [Bug 1684481] Re: KVM guest execution start apparmor blocks on /dev/ptmx now (regression?)

2017-04-21 Thread John Johansen
Thanks Stéphane, @Christian, it looks like adding a rule /dev/pts/ptmx rw, to the profile is necessary for now. -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1684481 Title: KVM

[Kernel-packages] [Bug 1684481] Re: KVM guest execution start apparmor blocks on /dev/ptmx now (regression?)

2017-04-21 Thread John Johansen
Hey Christian, thanks for the profiles, I haven't had a chance to dig into them yet, but after a quick first pass they look as expected. so very interesting. First up apparmor has always done mediation post symlink resolution, this is not new with stacking. What is new with stacking is we are

[Kernel-packages] [Bug 1684481] Re: KVM guest execution start apparmor blocks on /dev/ptmx now (regression?)

2017-04-20 Thread John Johansen
Its true there are a few issues with apparmor profiles being loaded as part of a stack when namespacing is involved. However this does not appear to be one of them. However the application may be behaving slightly differently resulting in the profile needed to be extended. Can you please attach

[Kernel-packages] [Bug 1678048] Re: apparmor: oops on boot if parameters set on grub command line

2017-03-31 Thread John Johansen
This is because boot params are processed before apparmor is fully initialized and policy_view_capable() will oops because the rootns is not setup. We should by-pass policy_view_capable() for params being set at boot. -- You received this bug notification because you are a member of Kernel

[Kernel-packages] [Bug 1678048] [NEW] apparmor: oops on boot if parameters set on grub command line

2017-03-31 Thread John Johansen
Public bug reported: When an apparmor parameter is set on the grub kernel line it results in an oops and failure to boot. eg. setting apparmor.audit=noquiet will cause the kernel to fail to boot. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Affects: linux

[Kernel-packages] [Bug 1678030] [NEW] apparmor query interface does not make supported query info available

2017-03-31 Thread John Johansen
Public bug reported: The apparmor query interface does not make available information about what is currently supported. Add the base set of information for label queries through the apparmorfs features subtree. Note: this will be needed to support user space permission caching used by trusted

[Kernel-packages] [Bug 1678032] [NEW] apparmor: does not provide a way to detect policy updataes

2017-03-31 Thread John Johansen
Public bug reported: User space trusted helpers have no way to detect when policy changes have been loaded into the kernel. This prevents the applications from being able to cache permission queries. Currently trusted helpers have not done caching (wish list feature), however the gsetting proxy

[Kernel-packages] [Bug 1678023] [NEW] apparmor does not make support of query data visible

2017-03-31 Thread John Johansen
Public bug reported: gsettings mediation needs to be able to determine if apparmor supports label data queries. A label data query can be done to test for support but its failure is indistinguishable from other failures, making it an unreliable indicator. Fix by making support of label data

[Kernel-packages] [Bug 1677959] [NEW] change_profile incorrect when using namespaces with a compound stack

2017-03-30 Thread John Johansen
Public bug reported: When a compound label is used as part of a target namespace the change profile will result in a bad change a task confined by profile lxd doing change_profile(&:ns://foo//) results in a change_profile to :ns://foo and unconfined causing the local system profile to

[Kernel-packages] [Bug 1658219] Re: flock not mediated by 'k'

2017-03-30 Thread John Johansen
Note: this bug affects more than just lock mediation permissions. It at a minimum can also affect the mmap executable (m) permission. Further work is required to resubmit this fix -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in

[Kernel-packages] [Bug 1648143] Re: tor in lxd: apparmor="DENIED" operation="change_onexec" namespace="root//CONTAINERNAME_" profile="unconfined" name="system_tor"

2017-03-30 Thread John Johansen
The entire apparmor patch series was reverted regardless of whether the patch had any link to a regression, or security fix. The majority of the patches will be reapplied and go through the SRU cycle again. -- You received this bug notification because you are a member of Kernel Packages, which

[Kernel-packages] [Bug 1638996] Re: apparmor's raw_data file in securityfs is sometimes truncated

2017-03-05 Thread John Johansen
** Tags removed: verification-needed-xenial verification-needed-yakkety ** Tags added: verification-done-xenial verification-done-yakkety -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu.

[Kernel-packages] [Bug 1660832] Re: unix domain socket cross permission check failing with nested namespaces

2017-03-05 Thread John Johansen
** Tags removed: verification-needed-yakkety ** Tags added: verification-done-yakkety -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1660832 Title: unix domain socket cross permission

[Kernel-packages] [Bug 1660834] Re: apparmor label leak when new label is unused

2017-03-05 Thread John Johansen
** Tags removed: verification-needed-xenial verification-needed-yakkety ** Tags added: verification-done-xenial verification-done-yakkety -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu.

[Kernel-packages] [Bug 1660833] Re: apparmor reference count bug in label_merge_insert()

2017-03-05 Thread John Johansen
** Tags removed: verification-needed-xenial verification-needed-yakkety ** Tags added: verification-done-xenial verification-done-yakkety -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu.

[Kernel-packages] [Bug 1660836] Re: apparmor auditing denied access of special apparmor .null fi\ le

2017-03-05 Thread John Johansen
** Tags removed: verification-needed-xenial verification-needed-yakkety ** Tags added: verification-done-xenial verification-done-yakkety -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu.

[Kernel-packages] [Bug 1660840] Re: apparmor oops in bind_mnt when dev_path lookup fails

2017-03-05 Thread John Johansen
** Tags removed: verification-needed-xenial verification-needed-yakkety ** Tags added: verification-done-xenial verification-done-yakkety -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu.

[Kernel-packages] [Bug 1648143] Re: tor in lxd: apparmor="DENIED" operation="change_onexec" namespace="root//CONTAINERNAME_" profile="unconfined" name="system_tor"

2017-03-05 Thread John Johansen
Please describe the failure, including the logs so I can analyze. Just because the container fails to start does not mean that the fix is bad. There can be other issues that result in the failure. Specifically this bug is for the denial message seen in comment #5 and not the denied messages

[Kernel-packages] [Bug 1660849] Re: apparmor refcount leak of profile namespace when removing profiles

2017-03-05 Thread John Johansen
** Tags removed: verification-needed-xenial verification-needed-yakkety ** Tags added: verification-done-xenial verification-done-yakkety -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu.

[Kernel-packages] [Bug 1656121] Re: unexpected errno=13 and disconnected path when trying to open /proc/1/ns/mnt from a unshared mount namespace

2017-03-05 Thread John Johansen
** Tags removed: verification-needed-xenial verification-needed-yakkety ** Tags added: verification-done-xenial verification-done-yakkety -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu.

[Kernel-packages] [Bug 1664912] Re: linux-lts-xenial 4.4.0-63.84~14.04.2 ADT test failure with linux-lts-xenial 4.4.0-63.84~14.04.2

2017-03-04 Thread John Johansen
** Tags removed: verification-needed-xenial verification-needed-yakkety ** Tags added: verification-done-xenial verification-done-yakkety -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu.

[Kernel-packages] [Bug 1669611] Re: Regression in 4.4.0-65-generic causes very frequent system crashes

2017-03-03 Thread John Johansen
The issue appears to be refcount related, I am still chasing this one down but for this release we should revert UBUNTU: SAUCE: apparmor: fix lock ordering for mkdir UBUNTU: SAUCE: apparmor: fix leak on securityfs pin count UBUNTU: SAUCE: apparmor: fix reference count leak when

[Kernel-packages] [Bug 1664912] Re: linux-lts-xenial 4.4.0-63.84~14.04.2 ADT test failure with linux-lts-xenial 4.4.0-63.84~14.04.2

2017-02-16 Thread John Johansen
A patch has been submitted to the kernel-t...@lists.ubuntu.com mail list ** Changed in: linux (Ubuntu Xenial) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Yakkety) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Zesty) Status: Incomplete =>

[Kernel-packages] [Bug 1664912] Re: linux-lts-xenial 4.4.0-63.84~14.04.2 ADT test failure with linux-lts-xenial 4.4.0-63.84~14.04.2

2017-02-15 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Also affects: linux-lts-xenial (Ubuntu Xenial) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Zesty)

[Kernel-packages] [Bug 1660833] Re: apparmor reference count bug in label_merge_insert()

2017-02-01 Thread John Johansen
** Changed in: linux (Ubuntu Xenial) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Yakkety) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Zesty) Status: Incomplete => In Progress -- You received this bug notification because you are a

[Kernel-packages] [Bug 1660840] Re: apparmor oops in bind_mnt when dev_path lookup fails

2017-02-01 Thread John Johansen
** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Zesty) Importance: Undecided Status: Incomplete ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Zesty)

[Kernel-packages] [Bug 1660846] Re: apparmor leaking securityfs pin count

2017-02-01 Thread John Johansen
** Changed in: linux (Ubuntu Xenial) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Yakkety) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Zesty) Status: Incomplete => In Progress -- You received this bug notification because you are a

[Kernel-packages] [Bug 1660834] Re: apparmor label leak when new label is unused

2017-02-01 Thread John Johansen
** Changed in: linux (Ubuntu Xenial) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Yakkety) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Zesty) Status: Incomplete => In Progress -- You received this bug notification because you are a

[Kernel-packages] [Bug 1660836] Re: apparmor auditing denied access of special apparmor .null fi\ le

2017-02-01 Thread John Johansen
** Changed in: linux (Ubuntu Xenial) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Yakkety) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Zesty) Status: Incomplete => In Progress -- You received this bug notification because you are a

[Kernel-packages] [Bug 1660842] Re: apparmor not checking error if security_pin_fs() fails

2017-02-01 Thread John Johansen
** Changed in: linux (Ubuntu Xenial) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Yakkety) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Zesty) Status: Incomplete => In Progress -- You received this bug notification because you are a

[Kernel-packages] [Bug 1660845] Re: apparmor reference count leak when securityfs_setup_d_inode\ () fails

2017-02-01 Thread John Johansen
** Changed in: linux (Ubuntu Xenial) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Yakkety) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Zesty) Status: Incomplete => In Progress -- You received this bug notification because you are a

[Kernel-packages] [Bug 1660849] Re: apparmor refcount leak of profile namespace when removing profiles

2017-02-01 Thread John Johansen
** Changed in: linux (Ubuntu Xenial) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Yakkety) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Zesty) Status: Incomplete => In Progress -- You received this bug notification because you are a

[Kernel-packages] [Bug 1658625] Re: linux i386 ADT apparmor self-tests OOM machine with linux-4.9.0-12.13

2017-02-01 Thread John Johansen
I have sent pull requests to the kt mailing list with that include the current ref count leak fixes. This set however does not fix all the leaks and I am still working on nailing them down when I can. -- You received this bug notification because you are a member of Kernel Packages, which is

[Kernel-packages] [Bug 1660832] Re: unix domain socket cross permission check failing with nested namespaces

2017-02-01 Thread John Johansen
** Changed in: linux (Ubuntu Xenial) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Yakkety) Status: Incomplete => In Progress ** Changed in: linux (Ubuntu Zesty) Status: Incomplete => In Progress -- You received this bug notification because you are a

[Kernel-packages] [Bug 1660849] [NEW] apparmor refcount leak of profile namespace when removing profiles

2017-01-31 Thread John Johansen
Public bug reported: When doing profile removal, the parent ns of the profiles is taken, but the reference isn't being put, resulting in the ns never being freed even after it is removed. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Affects: linux (Ubuntu

[Kernel-packages] [Bug 1660845] [NEW] apparmor reference count leak when securityfs_setup_d_inode\ () fails

2017-01-31 Thread John Johansen
Public bug reported: apparmor is leaking the parent ns ref count, by directly returning the error ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Affects: linux (Ubuntu Yakkety)

[Kernel-packages] [Bug 1660846] [NEW] apparmor leaking securityfs pin count

2017-01-31 Thread John Johansen
Public bug reported: apparmor is leaking pinfs refcoutn when inode setup fails. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Affects: linux (Ubuntu Yakkety) Importance:

[Kernel-packages] [Bug 1660842] [NEW] apparmor not checking error if security_pin_fs() fails

2017-01-31 Thread John Johansen
Public bug reported: The error condition of security_pin_fs() was not being checked which will result can result in an oops or use after free, due to the fs pin count not being incremented. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Affects: linux (Ubuntu

[Kernel-packages] [Bug 1634753] Re: srcname from mount rule corrupted under load

2017-01-31 Thread John Johansen
** Changed in: apparmor Status: In Progress => Invalid -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1634753 Title: srcname from mount rule corrupted under load Status in

[Kernel-packages] [Bug 1660840] [NEW] apparmor oops in bind_mnt when dev_path lookup fails

2017-01-31 Thread John Johansen
Public bug reported: Bind mounts can oops when devname lookup fails because the devname is unintialized and used in auditing the denial. ** Affects: linux (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of

[Kernel-packages] [Bug 1660836] [NEW] apparmor auditing denied access of special apparmor .null fi\ le

2017-01-31 Thread John Johansen
Public bug reported: When an fd is disallowed from being inherited during exec, instead of closed it is duped to a special apparmor/.null file. This prevents the fd from being reused by another file in case the application expects the original file on a give fd

[Kernel-packages] [Bug 1660833] [NEW] apparmor reference count bug in label_merge_insert()

2017-01-31 Thread John Johansen
Public bug reported: @new does not have a reference taken locally and should not have its reference put locally either. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Affects: linux (Ubuntu Xenial) Importance: Undecided Status: New **

[Kernel-packages] [Bug 1660832] [NEW] unix domain socket cross permission check failing with nested namespaces

2017-01-31 Thread John Johansen
Public bug reported: When using nested namespaces policy within the nested namespace is trying to cross validate with policy outside of the namespace that is not visible to it. This results the access being denied and with no way to add a rule to policy that would

[Kernel-packages] [Bug 1660834] [NEW] apparmor label leak when new label is unused

2017-01-31 Thread John Johansen
Public bug reported: When a new label is created, it is created with a proxy in a circular ref count that is broken by replacement. However if the label is not used it will never be replaced and the circular ref count will never be broken resulting in a leak.

[Kernel-packages] [Bug 1658625] Re: linux i386 ADT apparmor self-tests OOM machine with linux-4.9.0-12.13

2017-01-23 Thread John Johansen
There are definitely, several ref count leaks that can lead to memory leaking during policy replacement. I haven't been able to trace down every leak yet, but the kernel in http://people.canonical.com/~jj/lp1656121/ contains several fixes that should help. I need to finish cleaning up the series

[Kernel-packages] [Bug 1630069] Re: Regression tests can not detect binfmt_elf mmpa semantic change

2017-01-10 Thread John Johansen
** Changed in: apparmor (Ubuntu) Status: New => Fix Released ** Changed in: apparmor Status: Fix Committed => Fix Released ** Changed in: linux (Ubuntu Xenial) Status: New => Invalid -- You received this bug notification because you are a member of Kernel Packages, which

[Kernel-packages] [Bug 1592547] Re: vmalloc failure leads to null ptr dereference in aa_dfa_next

2017-01-05 Thread John Johansen
** Changed in: apparmor Status: New => Invalid -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1592547 Title: vmalloc failure leads to null ptr dereference in aa_dfa_next Status

[Kernel-packages] [Bug 1651944] Re: Kernel panic when we call pipework to setup virtual network for docker containers

2017-01-05 Thread John Johansen
sudo snap refresh should refresh the kernel snap. However the suspected fix will not be in any snap kernel, nor can I atm build you a kernel snap to test with. -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu.

[Kernel-packages] [Bug 1651944] Re: Kernel panic when we call pipework to setup virtual network for docker containers

2017-01-03 Thread John Johansen
Ignore the request to test the upstream kernel, for the moment. In this case the apparmor code that is in the trace does not exist upstream. Instead could you test the kernel in http://people.canonical.com/~jj/lp1648143/ While listed as being for bug 1648143, it contains several fixes

[Kernel-packages] [Bug 1645037] Re: apparmor_parser hangs indefinitely when called by multiple threads

2016-12-08 Thread John Johansen
Christian, could you please try against my test kernel? It has fixed the issue with my local reproducer The packages are in http://people.canonical.com/~jj/linux+jj/ you can probably get away with just installing linux- image-4.8.0-30-generic_4.8.0-30.32+lp1645037_amd64.deb but the other

[Kernel-packages] [Bug 1645037] Re: apparmor_parser hangs indefinitely when called by multiple threads

2016-12-06 Thread John Johansen
I have fully replicated this with just the apparmor_parser, and bash. It requires using both the fs based namespace mkdir/rmdir namespace interface and regular profile replacement/removal at the same time. -- You received this bug notification because you are a member of Kernel Packages, which

[Kernel-packages] [Bug 1645037] Re: apparmor_parser hangs indefinitely when called by multiple threads

2016-12-03 Thread John Johansen
I think I may have replicated, in that I got log entries with task blocked for more than 120 seconds, very similar to the above logs. And the apparmor_parser could running ps on the system did show several apparmor_parsers waiting. However it did not crash nor did the apparmor_parser instances

[Kernel-packages] [Bug 1645037] Re: apparmor_parser hangs indefinitely when called by multiple threads

2016-12-03 Thread John Johansen
No, I haven't. I have been using the instructions you provided with no success. I have started some tests doing lower level direct calls of replace and reload so that I can have even more concurrency. -- You received this bug notification because you are a member of Kernel Packages, which is

[Kernel-packages] [Bug 1645037] Re: apparmor_parser hangs indefinitely when called by multiple threads

2016-12-03 Thread John Johansen
How reliable/repeatable is this for you? I have been hammering a machine for multiple days and not been able to trip this once. I have been using the 4.8 ubuntu kernel the ubuntu-lxc/daily and the ubuntu-lxc/stable ppas. Any more info you can provide? -- You received this bug notification

[Kernel-packages] [Bug 1645037] Re: apparmor_parser hangs indefinitely when called by multiple threads

2016-12-01 Thread John Johansen
** Changed in: linux (Ubuntu Xenial) Assignee: (unassigned) => John Johansen (jjohansen) ** Changed in: linux (Ubuntu Yakkety) Assignee: (unassigned) => John Johansen (jjohansen) ** Changed in: linux (Ubuntu Zesty) Assignee: (unassigned) => John Johansen (jjohansen) *

[Kernel-packages] [Bug 1634753] Re: srcname from mount rule corrupted under load

2016-11-28 Thread John Johansen
I have done some light testing on this, trying to develop a none snap based test to verify it. The test is no where near as reliable as the snappy test. I haven't been able to trigger the bug on the new kernel yet, with the caveat that it could just be the test. I am inclined to declare this

[Kernel-packages] [Bug 1611078] Re: Support snaps inside of lxd containers

2016-11-07 Thread John Johansen
note: that for xenial there are several pieces that must land as different SRUs. Just using the xenial SRU kernel is not sufficient. There is an apparmor userspace SRU that is required, and squashfuse sru ... -- You received this bug notification because you are a member of Kernel Packages,

[Kernel-packages] [Bug 1637437] Re: linux 3.13.0-101.148 ADT test failure with linux 3.13.0-101.148

2016-11-07 Thread John Johansen
This appears to be a problem with the test ** Changed in: linux (Ubuntu) Status: Confirmed => Invalid ** Also affects: apparmor (Ubuntu) Importance: Undecided Status: New ** Changed in: apparmor (Ubuntu) Status: New => Confirmed -- You received this bug notification

[Kernel-packages] [Bug 1637440] Re: linux 4.4.0-46.67 ADT test failure with linux 4.4.0-46.67

2016-11-07 Thread John Johansen
This appears to be an issue with the test. ** Changed in: linux (Ubuntu) Status: Confirmed => Invalid ** Also affects: apparmor (Ubuntu) Importance: Undecided Status: New ** Changed in: apparmor (Ubuntu) Status: New => Confirmed -- You received this bug notification

[Kernel-packages] [Bug 1638996] Re: apparmor's raw_data file in securityfs is sometimes truncated

2016-11-04 Thread John Johansen
I need more information about what else is going on, on the system when the this triggers is there profile replacement happening, what kind of load, ... so far I have been unable to trigger this, and the code looks good ** Changed in: linux (Ubuntu) Status: In Progress => Incomplete --

[Kernel-packages] [Bug 1638996] Re: apparmor's raw_data file in securityfs is sometimes truncated

2016-11-04 Thread John Johansen
** Changed in: linux (Ubuntu) Status: Incomplete => Confirmed ** Changed in: linux (Ubuntu) Status: Confirmed => In Progress ** Changed in: linux (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) -- You received this bug notification because you are

[Kernel-packages] [Bug 1634753] Re: srcname from mount rule corrupted under load

2016-10-19 Thread John Johansen
** Changed in: linux (Ubuntu Yakkety) Status: Triaged => Invalid ** Also affects: linux (Ubuntu Trusty) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Trusty) Status: New => Triaged ** Also affects: linux (Ubuntu Precise) Importance: Undecided

[Kernel-packages] [Bug 1611078] Re: Support snaps inside of lxd containers

2016-10-14 Thread John Johansen
** Also affects: apparmor (Ubuntu Yakkety) Importance: Critical Assignee: Tyler Hicks (tyhicks) Status: Fix Released ** Also affects: linux (Ubuntu Yakkety) Importance: Critical Assignee: John Johansen (jjohansen) Status: Fix Released ** Also affects: lxd (Ubuntu

[Kernel-packages] [Bug 1630069] Re: Regression tests can not detect binfmt_elf mmpa semantic change

2016-10-05 Thread John Johansen
** Changed in: apparmor Status: New => Fix Committed ** Changed in: linux (Ubuntu Yakkety) Status: Incomplete => In Progress -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu.

[Kernel-packages] [Bug 1630069] [NEW] Regression tests can not detect binfmt_elf mmpa semantic change

2016-10-03 Thread John Johansen
but it results in the test breaking for everyone using upstream releases against pre 4.8 kernels. ** Affects: apparmor Importance: Undecided Assignee: John Johansen (jjohansen) Status: New ** Affects: linux (Ubuntu) Importance: Undecided Assignee: John Johansen (jjohansen

[Kernel-packages] [Bug 1611078] Re: Support snaps inside of lxd containers

2016-09-28 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Changed in: linux (Ubuntu) Importance: Undecided => Critical ** Changed in: linux (Ubuntu) Status: New => In Progress ** Changed in: linux (Ubuntu) Assignee: (unassigned) => John Johansen (

[Kernel-packages] [Bug 1626984] Re: kernel BUG at /build/linux-lts-xenial-_hWfOZ/linux-lts-xenial-4.4.0/security/apparmor/include/context.h:69!

2016-09-23 Thread John Johansen
In testing I have not been able to reproduce. But from the oops it looks either like potentially like memory corruption, or corruption of the cred. The oops reports invalid opcode: [#1] SMP however the piece of code triggering this is used all the time, so the more likely scenario is

[Kernel-packages] [Bug 1615881] Re: The label build for onexec when stacking is wrong

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1615881 Title: The label build for onexec when

[Kernel-packages] [Bug 1593874] Re: warning stack trace while playing with apparmor namespaces

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1593874 Title: warning stack trace while playing with

[Kernel-packages] [Bug 1615878] Re: __label_update proxy comparison test is wrong

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1615878 Title: __label_update proxy comparison test is

[Kernel-packages] [Bug 1615880] Re: The inherit check for new to old label comparison for domain transitions is wrong

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1615880 Title: The inherit check for new to old label

[Kernel-packages] [Bug 1615882] Re: dfa is missing a bounds check which can cause an oops

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1615882 Title: dfa is missing a bounds check which can

[Kernel-packages] [Bug 1579135] Re: AppArmor profile reloading causes an intermittent kernel BUG

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1579135 Title: AppArmor profile reloading causes an

[Kernel-packages] [Bug 1615887] Re: profiles from different namespaces can block other namespaces from being able to load a profile

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1615887 Title: profiles from different namespaces can

[Kernel-packages] [Bug 1615889] Re: label vec reductions can result in reference labels instead of direct access to labels

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1615889 Title: label vec reductions can result in

[Kernel-packages] [Bug 1615895] Re: apparmor module parameters can be changed after the policy is locked

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1615895 Title: apparmor module parameters can be

[Kernel-packages] [Bug 1615890] Re: stacking to unconfined in a child namespace confuses mediation

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1615890 Title: stacking to unconfined in a child

[Kernel-packages] [Bug 1615893] Re: change_hat is logging failures during expected hat probing

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1615893 Title: change_hat is logging failures during

[Kernel-packages] [Bug 1615892] Re: deleted files outside of the namespace are not being treated as disconnected

2016-09-09 Thread John Johansen
** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1615892 Title: deleted files outside of the namespace

[Kernel-packages] [Bug 1615895] Re: apparmor module parameters can be changed after the policy is locked

2016-08-23 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status:

[Kernel-packages] [Bug 1615890] Re: stacking to unconfined in a child namespace confuses mediation

2016-08-23 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status:

[Kernel-packages] [Bug 1609885] Re: exec transitions to profiles with '.' in name don't work

2016-08-23 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status:

[Kernel-packages] [Bug 1615889] Re: label vec reductions can result in reference labels instead of direct access to labels

2016-08-23 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status:

[Kernel-packages] [Bug 1615887] Re: profiles from different namespaces can block other namespaces from being able to load a profile

2016-08-23 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status:

[Kernel-packages] [Bug 1615892] Re: deleted files outside of the namespace are not being treated as disconnected

2016-08-23 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status:

[Kernel-packages] [Bug 1615893] Re: change_hat is logging failures during expected hat probing

2016-08-23 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status:

[Kernel-packages] [Bug 1615878] Re: __label_update proxy comparison test is wrong

2016-08-23 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status:

[Kernel-packages] [Bug 1615880] Re: The inherit check for new to old label comparison for domain transitions is wrong

2016-08-23 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status:

[Kernel-packages] [Bug 1615881] Re: The label build for onexec when stacking is wrong

2016-08-23 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status:

[Kernel-packages] [Bug 1615882] Re: dfa is missing a bounds check which can cause an oops

2016-08-23 Thread John Johansen
** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status:

[Kernel-packages] [Bug 1579135] Re: AppArmor profile reloading causes an intermittent kernel BUG

2016-08-23 Thread John Johansen
) Importance: Critical Assignee: John Johansen (jjohansen) Status: Incomplete ** Also affects: linux (Ubuntu Yakkety) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status: New => Fix Committed ** Changed in: linux (Ubuntu Yakkety) Status:

[Kernel-packages] [Bug 1373070] Re: full fix for disconnected path (paths)

2016-07-25 Thread John Johansen
possibly. There isn't actually enough information in that bug to be sure if it is an actual namespacing issue or it is a separate bug to do with unix domain sockets. Unfortunately the workaround of attach_disconnect is still required to deal with these issues. -- You received this bug

<    1   2   3   4   5   6   7   8   9   10   >