** Description changed: + [ Impact ] + + On systems where /etc/os-release is an actual file instead of a symlink + to /usr/lib/os-release, the apparmor profile ubuntu_pro_esm_cache will + block access to it. The existing profile only allows access to + /usr/lib/os-release (via globbing rules written in other profiles that + are being included). + + This results in the esm-cache.service failing to run: + + May 13 19:17:29 j-uat-2065573 python3[3490]: ["2024-05-13T19:17:29.370", + "ERROR", "ubuntupro.lib.esm_cache", "main", 17, "Error updating the + cache: [Errno 13] Permission denied: '/etc/os-release'", {}] + + + [ Test Plan ] + + Keep sudo dmesg -wT | grep ubuntu_pro running in a terminal (in the same + VM, if testing in a VM, or in the host, if testing with a LXD + container), and then run this on the system being tested (LXD or VM): + + sudo rm /etc/os-release + sudo cp /usr/lib/os-release /etc + sudo rm -rf /var/lib/apt/periodic/* + sudo systemctl start esm-cache.service + + there should be no apparmor DENIED messages for an access to /etc/os- + release in the dmesg output. Additionally, /var/log/ubuntu-advantage.log + should not have a permission denied error referring to /etc/os-release. + + Additionally, for a more surgical test, also run these: + + sudo rm /etc/os-release + sudo cp /usr/lib/os-release /etc + sudo aa-exec -p ubuntu_pro_esm_cache cat /etc/os-release + + On a system with the fixed apparmor profile, you should see the contents + of /etc/os-release. With the bug, the last command above will return a + permission denied error and dmesg will show a corresponding apparmor + DENIED error. + + [ Where problems could occur ] + + The fix is to include a rule to allow access to /etc/os-release, and + /usr/lib/os-release too (even though that was covered already via other + apparmor abstractions being included). + + We don't think there is an additional security risk by this new allow + rule, and in fact, it should probably be covered by some base + abstraction in the future. + + The risk being introduced by this fix is a syntax error on the profile, + but that is covered by the package build which runs a syntax check. + + The other riks is that this rule could only be correct for certain + ubuntu releases, and not older ones like xenial, but this is a very + simple file access rule, which is something very old apparmor profiles + understand already. + + [ Other Info ] + This was found by the CI system of a contributor who happened to be including proposed packages in their testing, and that for some reason does not have /etc/os-release as a symlink. We are unsure why /etc/os-release is not a symlink, but nevertheless it's a valid scenario, and should be fixed in the apparmor profile. + + [ Original Description ] + We just caught a regression in our CI: https://github.com/cockpit- project/bots/pull/6373 An unexpected apparmor denial is logged in the journal: May 13 08:49:01 ubuntu systemd[1]: Starting Update APT News... May 13 08:49:01 ubuntu systemd[1]: Starting Update the local ESM caches... May 13 08:49:02 ubuntu PackageKit[2370]: refresh-cache transaction /17_aebebede from uid 0 finished with success after 384ms May 13 08:49:02 ubuntu audit[2667]: AVC apparmor="DENIED" operation="open" profile="ubuntu_pro_esm_cache" name="/etc/os-release" pid=2667 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 May 13 08:49:02 ubuntu kernel: kauditd_printk_skb: 59 callbacks suppressed May 13 08:49:02 ubuntu kernel: audit: type=1400 audit(1715590142.157:71): apparmor="DENIED" operation="open" profile="ubuntu_pro_esm_cache" name="/etc/os-release" pid=2667 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 May 13 08:49:02 ubuntu python3[2667]: ["2024-05-13T08:49:02.172", "ERROR", "ubuntupro.lib.esm_cache", "main", 17, "Error updating the cache: [Errno 13] Permission denied: '/etc/os-release'", {}] May 13 08:49:02 ubuntu systemd[1]: esm-cache.service: Deactivated successfully. May 13 08:49:02 ubuntu systemd[1]: Finished Update the local ESM caches. May 13 08:49:02 ubuntu systemd[1]: apt-news.service: Deactivated successfully. May 13 08:49:02 ubuntu systemd[1]: Finished Update APT News. + The relevant change since the last (working) state is that these + packages got updated: - The relevant change since the last (working) state is that these packages got updated: - - ubuntu-advantage-tools (31.2.3~22.04 -> 32~22.04) - ubuntu-pro-client (31.2.3~22.04 -> 32~22.04) - ubuntu-pro-client-l10n (31.2.3~22.04 -> 32~22.04) + ubuntu-advantage-tools (31.2.3~22.04 -> 32~22.04) + ubuntu-pro-client (31.2.3~22.04 -> 32~22.04) + ubuntu-pro-client-l10n (31.2.3~22.04 -> 32~22.04)
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065573 Title: esm-cache.service denied access to /etc/os-release by apparmor To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2065573/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs