[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
Just to summarize for simpletons like me: 1) A normal/stock Ubuntu 24.04 has broken apparmor (4.0.1really4.0.1-0ubuntu0.24.04.7), specifically the aa- tools like aa- logprof. 2) The attached patch fixed it for me. ** Patch added: "aa.patch" https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+attachment/5975092/+files/aa.patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065685 Title: aa-logprof fails with 'runbindable' error To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
There is currently no plan to SRU this fix to 4.0.1 (used by noble). So currently, either manually removing empty mount sources or updating apparmor-utils to 4.0.2+ remains the preferred approaches to fix this issue on Noble. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065685 Title: aa-logprof fails with 'runbindable' error To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
+1 to sean mooney We are still on noble and implementing Openstack. Whats even worse is, this "fix" breaks other packages especially QEMU/Containers. These rely on passt and pasta to create network namespaces. As soon as the profiles are in complain mode, the docker/podman start to have permission errors while trying to create namespaces for new containers. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065685 Title: aa-logprof fails with 'runbindable' error To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
it woudl be good to fix this in noble for people workink on openstack. we are hitting this wehn we deploy on noble with devstack so given noble is our main development distro currently it would be nice to avoid manually patching this. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065685 Title: aa-logprof fails with 'runbindable' error To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
This issue is fixed by 1f33fc9b29c174698fdf0116a4a9f50680ec4fdb, however it is not included in the 4.0 branch used by noble. Oracular and Plucky are not affected by this bug. To fix that locally, you can either: - Replace `mount "" -> "/tmp/",` by `mount -> "/tmp/",` (and similarly for other empty mount sources), as pointed out by @jyrg. - Use a more recent version of AppArmor that includes this commit (or cherry-pick it). @jjohansen Do you think it is worth applying a fix for this in noble? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065685 Title: aa-logprof fails with 'runbindable' error To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
When this fix is commited next complain is: ERROR: Can't parse mount rule mount "" -> "/tmp/", That is the next row. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065685 Title: aa-logprof fails with 'runbindable' error To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
Fresh install of Ubuntu 24.04.1 LTS gives the following
# aa-logprof
ERROR: Operation {'runbindable'} cannot have a source. Source =
AARE('/')
Implementing the fix from 3ff3a8a467fff1d4b234949e4dd3db618a9f8ed2
commit in /etc/apparmor.d/abstractions/passt
- mount options=(rw, runbindable) /,
+ mount options=(rw, runbindable) -> /,
gives the following
# aa-logprof
ERROR: Can't parse mount rule mount "" -> "/tmp/",
Commenting out that line in /etc/apparmor.d/abstractions/passt gives the
following
# aa-logprof
ERROR: Can't parse mount rule mount "" -> "/proc/",
Commenting out that line from /etc/apparmor.d/abstractions/pasta gives the
following
# aa-logprof
Updating AppArmor profiles in /etc/apparmor.d.
Reading log entries from /var/log/syslog.
Complain-mode changes:
Enforce-mode changes:
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2065685
Title:
aa-logprof fails with 'runbindable' error
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
** Changed in: apparmor (Ubuntu) Status: New => Fix Committed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065685 Title: aa-logprof fails with 'runbindable' error To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
@Christian Thank you for pointing this out. After investigation, I found that this bug stems from the following restriction not being implemented consistently in aa-* and apparmor_parser. > $ man 2 mount > > If mountflags includes one of MS_SHARED, MS_PRIVATE, MS_SLAVE, or > MS_UNBINDABLE [...] The source, and filesystemtype [...] arguments are > ignored. - In aa-* : source must be empty, or it will trigger an error (cf. this bug). - In apparmor_parser : source and destination cannot be set simultaneously (leading to the behavior you described). Also setting the source or the destination is equivalent. That means that `mount options=(unbindable) /a,` and `mount options=(unbindable) -> /a,` are equivalent This bug should be fixed by https://gitlab.com/apparmor/apparmor/-/merge_requests/1236, which aligns the behavior of aa-* to apparmor_parser, since this the latter is more permissive. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065685 Title: aa-logprof fails with 'runbindable' error To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
I'm afraid apparmor_parser is not fully aware of this restriction.
# cat foo
/usr/bin/foo {
# mount options=(rw, runbindable) / -> /bar, # causes error
mount options=(rw, runbindable) -> /bar, # accepted as valid (as
expected)
mount options=(rw, runbindable) /, # accepted as valid, but shouldn't
}
# apparmor_parser -r foo
#
This means a rule with only a source (but no target mountpoint) gets
accepted by the parser and loaded into the kernel, even if it should
raise an error.
.
BTW: The commented-out rule that indeed triggers an error results in a
not-so-useful error message:
Encoding of mount rule failed
ERROR processing policydb rules for profile /usr/bin/foo, failed to load
A more detailed error message that points out the invalid rule would be
nice.
** Changed in: apparmor (Ubuntu)
Status: Fix Committed => New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2065685
Title:
aa-logprof fails with 'runbindable' error
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
So, the error was related to passt, not apparmor. This is because it uses an incorrect rule in abstractions/passt. By design, rules containing some options, such as runbindable, cannot include a source. I just sent the following patch for passt that should solve your issue https://archives.passt.top/passt- dev/[email protected]/T/#u , i.e. you need to modify `mount options=(rw, runbindable) /,` in /etc/apparmor.d/abstractions/passt to `mount options=(rw, runbindable) -> /,` That being said, I will probably send a merge request to apparmor so that if in similar cases the source is '/', mount does not fail, thereby preventing similar future errors. ** Changed in: apparmor (Ubuntu) Status: New => Fix Committed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065685 Title: aa-logprof fails with 'runbindable' error To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
ubuntu@srv-9vqc0:~$ sudo grep -r "runbindable*/*" /etc/apparmor.d
/etc/apparmor.d/abstractions/passt: mount options=(rw, runbindable) /,
ubuntu@srv-9vqc0:~$ sudo aa-logprof
ERROR: Operation {'runbindable'} cannot have a source. Source =
AARE('/')
HTH
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2065685
Title:
aa-logprof fails with 'runbindable' error
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
I have implemented a patch for this issue, but before submitting it, I want to understand its origin to determine if other edge cases need to be addressed. Do you know which profile created this issue? Perhaps running sudo grep -r "runbindable*/*" /etc/apparmor.d could help identify the source of this issue. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065685 Title: aa-logprof fails with 'runbindable' error To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2065685] Re: aa-logprof fails with 'runbindable' error
** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Maxime Bélair (mbelair) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065685 Title: aa-logprof fails with 'runbindable' error To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
