Which AppArmor version are you using? (We had some fixes around the "unknown mode", however your error message indicates that rmask could be empty, which would be something new.)
For the crash, please try to find out which log line causes this, and paste or attach it. (Hint: split the log into 2 files, check which one causes the crash, split that again, ...) Bonus points if you checkout the latest AppArmor from bzr and test if it also crashes (cd $checkout_dir/utils && python3 aa-logprof). If it also crashes, please also attach the bugreport file it creates. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1525119 Title: Cannot permit some operations for sssd Status in apparmor package in Ubuntu: New Bug description: I am trying to write apparmor profile to match my sssd usage, unfortunately it seems I cannot tell sssd to permit things it needs. apparmor version 2.8.95~2430-0ubuntu5.3 Description: Ubuntu 14.04.3 LTS Release: 14.04 The complaints in log: Dec 11 10:24:07 gw-dc01 kernel: [2214272.643384] type=1400 audit(1449822247.281:21249): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/sbin/sssd" pid=7104 comm="apparmor_parser" Dec 11 10:24:07 gw-dc01 kernel: [2214272.912195] type=1400 audit(1449822247.549:21250): apparmor="ALLOWED" operation="exec" profile="/usr/sbin/sssd" pid=7112 comm="sssd_be" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 target="/usr/sbin/sssd//null-45" Dec 11 10:24:07 gw-dc01 kernel: [2214272.912766] type=1400 audit(1449822247.549:21251): apparmor="ALLOWED" operation="file_inherit" profile="/usr/sbin/sssd//null-45" name="/var/log/sssd/ldap_child.log" pid=7112 comm="nsupdate" requested_mask="" denied_mask="" fsuid=0 ouid=0 Dec 11 10:24:07 gw-dc01 kernel: [2214272.912773] type=1400 audit(1449822247.549:21252): apparmor="ALLOWED" operation="file_inherit" profile="/usr/sbin/sssd//null-45" name="/var/log/sssd/krb5_child.log" pid=7112 comm="nsupdate" requested_mask="" denied_mask="" fsuid=0 ouid=0 Dec 11 10:24:07 gw-dc01 kernel: [2214272.912871] type=1400 audit(1449822247.549:21253): apparmor="ALLOWED" operation="open" profile="/usr/sbin/sssd//null-45" name="/etc/ld.so.cache" pid=7112 comm="nsupdate" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Dec 11 10:24:07 gw-dc01 kernel: [2214272.912878] type=1400 audit(1449822247.549:21254): apparmor="ALLOWED" operation="getattr" profile="/usr/sbin/sssd//null-45" name="/etc/ld.so.cache" pid=7112 comm="nsupdate" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Dec 11 10:24:07 gw-dc01 kernel: [2214272.912898] type=1400 audit(1449822247.549:21255): apparmor="ALLOWED" operation="open" profile="/usr/sbin/sssd//null-45" name="/usr/lib/liblwres.so.90.0.7" pid=7112 comm="nsupdate" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Dec 11 10:24:07 gw-dc01 kernel: [2214272.912909] type=1400 audit(1449822247.549:21256): apparmor="ALLOWED" operation="getattr" profile="/usr/sbin/sssd//null-45" name="/usr/lib/liblwres.so.90.0.7" pid=7112 comm="nsupdate" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Dec 11 10:24:07 gw-dc01 kernel: [2214272.912915] type=1400 audit(1449822247.549:21257): apparmor="ALLOWED" operation="file_mmap" profile="/usr/sbin/sssd//null-45" name="/usr/lib/liblwres.so.90.0.7" pid=7112 comm="nsupdate" requested_mask="mr" denied_mask="mr" fsuid=0 ouid=0 Dec 11 10:24:07 gw-dc01 kernel: [2214272.912948] type=1400 audit(1449822247.549:21258): apparmor="ALLOWED" operation="open" profile="/usr/sbin/sssd//null-45" name="/usr/lib/libdns.so.100.2.2" pid=7112 comm="nsupdate" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Current profile: #include <tunables/global> /usr/sbin/sssd { #include <abstractions/base> #include <abstractions/kerberosclient> #include <abstractions/nameservice> #include <abstractions/user-tmp> capability dac_override, capability dac_read_search, capability setgid, capability setuid, capability sys_nice, @{PROC} r, @{PROC}/[0-9]*/status r, /etc/krb5.keytab k, /etc/ldap/ldap.conf r, /etc/localtime r, /etc/shells r, /etc/sssd/sssd.conf r, /usr/sbin/sssd rmix, /usr/lib/@{multiarch}/ldb/modules/ldb/* m, /usr/lib/@{multiarch}/sssd/* rix, /tmp/{,.}krb5cc_* rwk, /var/lib/sss/* rw, /var/lib/sss/db/* rwk, /var/lib/sss/pipes/* rw, /var/lib/sss/pipes/private/* rw, /var/lib/sss/pubconf/* rw, /var/log/sssd/* rw, /var/tmp/host_* rw, /{,var/}run/sssd.pid rw, # Site-specific additions and overrides. See local/README for details. #include <local/usr.sbin.sssd> } # Site-specific additions and overrides for usr.sbin.sssd. # For more details, please see /etc/apparmor.d/local/README. capability sys_admin, capability sys_resource, network inet dgram, network inet6 dgram, network inet stream, network inet6 stream, @{PROC}/[0-9]*/net/psched r, /etc/ld.so.cache r, /etc/libnl-3/classid r, /usr/sbin/sssd rmix, /usr/sbin/sssd/** rmix, /var/log/sssd/** lkrw, /var/lib/sss/** lkrw, /usr/lib/libdns.so.100.2.2 m, /usr/lib/liblwres.so.90.0.7 m, /usr/lib/x86_64-linux-gnu/krb5/plugins/authdata/* m, /usr/lib/x86_64-linux-gnu/samba/ldb/* m, /var/lib/sss/** lkrw, Also, running aa-genprof et al crashes: Reading log entries from /var/log/syslog. Traceback (most recent call last): File "/usr/sbin/aa-genprof", line 155, in <module> lp_ret = apparmor.do_logprof_pass(logmark, passno) File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 2280, in do_logprof_pass log = log_reader.read_log(logmark) File "/usr/lib/python3/dist-packages/apparmor/logparser.py", line 353, in read_log self.add_event_to_tree(event) File "/usr/lib/python3/dist-packages/apparmor/logparser.py", line 261, in add_event_to_tree raise AppArmorException(_('Log contains unknown mode %s') % rmask) apparmor.common.AppArmorException: 'Log contains unknown mode ' To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1525119/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
