** Description changed: [ Impact ] On 26.04 Resolute, the AppArmor `lsusb` profile can produce denials when libudev walks from USB devices to their PCI parent devices and reads parent `uevent` files under `/sys/devices/`, resulting in denial noise from normal `lsusb` usage. This fix is ported from the upstream AppArmor `lsusb` profile, and updates only the `lsusb` profile: https://gitlab.com/apparmor/apparmor/-/commit/af7d610531c85fea620c05d6c2ae3af8cc0160c9 The new rule resolving this is: ``` @{sys}/devices/@{pci_bus}/uevent r, @{sys}/devices/@{pci_bus}/**/uevent r, ``` The upstream commit being backported here also includes `<abstractions/consoles>` and adds a root read rule `/ r`, which are also present in the Stonking version of this profile. [ Test Plan ] These steps should be run on Ubuntu 26.04 Resolute with AppArmor enabled. The pre-fix reproduction is most useful on hardware where `lsusb`/libudev walks USB controllers through PCI parent devices. A package with these changes is staged in the following PPA: - https://launchpad.net/~ks0/+archive/ubuntu/apparmor-lsusb-fix + https://launchpad.net/~ks0/+archive/ubuntu/apparmor-lsusb-fix Adding it: - sudo add-apt-repository ppa:ks0/apparmor-lsusb-fix - sudo apt update + sudo add-apt-repository ppa:ks0/apparmor-lsusb-fix + sudo apt update 1. Confirm the baseline package and profile: ``` apt-cache policy apparmor usbutils sudo aa-status | grep -E '(^|/)lsusb\b' || true ``` 2. Reproduce the denial with the release package: ``` sudo dmesg -C sudo lsusb >/dev/null sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb".*/sys/devices/.*uevent' ``` Expected before the fix on affected hardware: one or more denials for PCI parent `uevent` paths, for example `/sys/devices/pci.../.../uevent`. - 3. Install `apparmor` version `5.0.0~beta1-0ubuntu7.1~ppa1` from the - PPA, or the corresponding version once in -proposed, then reload - AppArmor: - ``` - apt-cache policy apparmor - sudo systemctl reload apparmor - sudo apparmor_parser -Q -K /etc/apparmor.d/lsusb + 3. Install the new AppArmor version from -proposed. + ``` 4. Verify the denial is gone: ``` sudo dmesg -C sudo lsusb >/dev/null sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb".*/sys/devices/.*uevent' ``` Expected after the fix: `grep` returns no matching denials. 5. Run basic regression checks: ``` lsusb >/dev/null lsusb -t >/dev/null sudo lsusb -v >/dev/null sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb"' || true ``` Expected result: the commands complete successfully and no new `lsusb` profile denials are logged. [ Where problems could occur ] If the new rules related to `lsusb` are too narrow, users will continue to see `lsusb` AppArmor denials as reported in this bug. If the new rules are too broad, the `lsusb` process gets additional read access. The added file rules are read-only, aside from the addition of <abstractions/consoles> which is rw. A regression would most likely appear as new or continuing AppArmor denials while running `lsusb`, or in the worst case, as `lsusb` failing to show USB devices normally. [ Other Info ] The upstream AppArmor task is Fix Released. 26.10 Stonking carries a version of AppArmor which contain the upstream commits which this fix backports, though it was still `In Progress` when this was originally triaged. So marking this `Fix Released` for Stonking, while an SRU is still needed for Resolute.
** Description changed: [ Impact ] On 26.04 Resolute, the AppArmor `lsusb` profile can produce denials when libudev walks from USB devices to their PCI parent devices and reads parent `uevent` files under `/sys/devices/`, resulting in denial noise from normal `lsusb` usage. This fix is ported from the upstream AppArmor `lsusb` profile, and updates only the `lsusb` profile: https://gitlab.com/apparmor/apparmor/-/commit/af7d610531c85fea620c05d6c2ae3af8cc0160c9 The new rule resolving this is: ``` @{sys}/devices/@{pci_bus}/uevent r, @{sys}/devices/@{pci_bus}/**/uevent r, ``` The upstream commit being backported here also includes `<abstractions/consoles>` and adds a root read rule `/ r`, which are also present in the Stonking version of this profile. [ Test Plan ] These steps should be run on Ubuntu 26.04 Resolute with AppArmor enabled. The pre-fix reproduction is most useful on hardware where `lsusb`/libudev walks USB controllers through PCI parent devices. - A package with these changes is staged in the following PPA: - https://launchpad.net/~ks0/+archive/ubuntu/apparmor-lsusb-fix - Adding it: - sudo add-apt-repository ppa:ks0/apparmor-lsusb-fix - sudo apt update - 1. Confirm the baseline package and profile: ``` apt-cache policy apparmor usbutils sudo aa-status | grep -E '(^|/)lsusb\b' || true ``` 2. Reproduce the denial with the release package: ``` sudo dmesg -C sudo lsusb >/dev/null sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb".*/sys/devices/.*uevent' ``` Expected before the fix on affected hardware: one or more denials for PCI parent `uevent` paths, for example `/sys/devices/pci.../.../uevent`. - 3. Install the new AppArmor version from -proposed. ``` 4. Verify the denial is gone: ``` sudo dmesg -C sudo lsusb >/dev/null sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb".*/sys/devices/.*uevent' ``` Expected after the fix: `grep` returns no matching denials. 5. Run basic regression checks: ``` lsusb >/dev/null lsusb -t >/dev/null sudo lsusb -v >/dev/null sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb"' || true ``` Expected result: the commands complete successfully and no new `lsusb` profile denials are logged. [ Where problems could occur ] If the new rules related to `lsusb` are too narrow, users will continue to see `lsusb` AppArmor denials as reported in this bug. If the new rules are too broad, the `lsusb` process gets additional read access. The added file rules are read-only, aside from the addition of <abstractions/consoles> which is rw. A regression would most likely appear as new or continuing AppArmor denials while running `lsusb`, or in the worst case, as `lsusb` failing to show USB devices normally. [ Other Info ] The upstream AppArmor task is Fix Released. 26.10 Stonking carries a version of AppArmor which contain the upstream commits which this fix backports, though it was still `In Progress` when this was originally triaged. So marking this `Fix Released` for Stonking, while an SRU is still needed for Resolute. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2158939 Title: lsusb profile denies PCI parent uevent reads for USB controllers To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/2158939/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
