Public bug reported:
If you exec libreoffice with no_new_privs (e.g. by running it under rr,
https://rr-project.org/), the launch fails. It tries to exec
/usr/lib/libreoffice/program/javaldx, but the exec returns EPERM because
AppArmor has libreoffice in the libreoffice-oopslash profile, while
/usr/lib/libreoffice/program/javaldx is unconfined, and transitioning to
unconfined is not allowed with no_new_privs *even though the
libreoffice-oopslash profile is only in complain mode*. (See
profile_onexec in security/apparmor/domain.c... not clear whether
enforcing this in complain mode is an AppArmor bug or not.)
Maybe this could be fixed by putting
/usr/lib/libreoffice/program/javaldx in the same confinement profile as
libreoffice-oopslash?
Ubuntu 18.04 LTS, libreoffice 6.0.3-0ubuntu1
** Affects: libreoffice (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1773497
Title:
libreoffice fails when launched with no_new_privs
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/1773497/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
