Deviations from the test plan:
- Install the new AppArmor from -proposed instead of from the linked PPA
- Skip the manual systemctl or apparmor_parser commands to reload profiles
$ apt policy apparmor # before enabling -proposed
apparmor:
Installed: 5.0.0~beta1-0ubuntu7
Candidate: 5.0.0~beta1-0ubuntu7
Version table:
*** 5.0.0~beta1-0ubuntu7 500
500 http://archive.ubuntu.com/ubuntu resolute/main amd64 Packages
100 /var/lib/dpkg/status
$ sudo lsusb > /dev/null
$ sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb".*/sys/devices/.*uevent'
[ 564.961383] audit: type=1400 audit(1785201255.208:262): apparmor="DENIED"
operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0000:00/0000:00:04.1/uevent" pid=4190 comm="lsusb"
requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[ 564.961394] audit: type=1400 audit(1785201255.208:263): apparmor="DENIED"
operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0000:00/uevent" pid=4190 comm="lsusb" requested_mask="r"
denied_mask="r" fsuid=0 ouid=0
[ 564.961769] audit: type=1400 audit(1785201255.208:264): apparmor="DENIED"
operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0000:00/0000:00:04.7/uevent" pid=4190 comm="lsusb"
requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[ 564.961778] audit: type=1400 audit(1785201255.208:265): apparmor="DENIED"
operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0000:00/uevent" pid=4190 comm="lsusb" requested_mask="r"
denied_mask="r" fsuid=0 ouid=0
[ 564.962018] audit: type=1400 audit(1785201255.208:266): apparmor="DENIED"
operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0000:00/0000:00:04.0/uevent" pid=4190 comm="lsusb"
requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[ 564.962027] audit: type=1400 audit(1785201255.208:267): apparmor="DENIED"
operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0000:00/uevent" pid=4190 comm="lsusb" requested_mask="r"
denied_mask="r" fsuid=0 ouid=0
[ 564.962637] audit: type=1400 audit(1785201255.209:268): apparmor="DENIED"
operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0000:00/0000:00:04.2/uevent" pid=4190 comm="lsusb"
requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[ 564.962646] audit: type=1400 audit(1785201255.209:269): apparmor="DENIED"
operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0000:00/uevent" pid=4190 comm="lsusb" requested_mask="r"
denied_mask="r" fsuid=0 ouid=0
[ 564.962876] audit: type=1400 audit(1785201255.209:270): apparmor="DENIED"
operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0000:00/0000:00:04.7/uevent" pid=4190 comm="lsusb"
requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[ 564.962885] audit: type=1400 audit(1785201255.209:271): apparmor="DENIED"
operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0000:00/uevent" pid=4190 comm="lsusb" requested_mask="r"
denied_mask="r" fsuid=0 ouid=0
$ apt policy apparmor # after enabling -proposed
apparmor:
Installed: 5.0.2-0ubuntu1~26.04.1
Candidate: 5.0.2-0ubuntu1~26.04.1
Version table:
*** 5.0.2-0ubuntu1~26.04.1 100
100 http://archive.ubuntu.com/ubuntu resolute-proposed/main amd64 Packa>
100 /var/lib/dpkg/status
5.0.0~beta1-0ubuntu7 500
500 http://archive.ubuntu.com/ubuntu resolute/main amd64 Packages
$ sudo lsusb > /dev/null
$ sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb".*/sys/devices/.*uevent'
Denials are no longer being generated.
The subsequent commands lsusb, lsusb -t, and sudo lsusb -v also do not
generate denials.
** Tags removed: verification-needed-resolute
** Tags added: verification-done-resolute
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2158939
Title:
lsusb profile denies PCI parent uevent reads for USB controllers
To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/2158939/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
