** Description changed: [ Impact ] AppArmor generates noisy denial logs in CPC's Resolute and Noble testing pipelines. The profile ubuntu_pro_esm_cache_systemd_detect_virt lacks permission for capability perfmon, resulting in audit denials in system logs whenever systemd-detect-virt attempts to check process capability. The fix is to add capability perfmon to the ubuntu_pro_esm_cache_systemd_detect_virt AppArmor sub-profile. [ Test Plan ] - On a system running Noble (24.04) or Resolute (26.04) without the fix, - trigger esm-cache.service or run systemd-detect-virt under the - ubuntu_pro_esm_cache_systemd_detect_virt AppArmor profile. - - Check dmesg or journalctl -k and observe the AppArmor denial log: - apparmor="DENIED" operation="capable" class="cap" profile="ubuntu_pro_esm_cache_systemd_detect_virt" ... capname="perfmon" - - Install the updated package from -proposed. - - Trigger esm-cache.service or run systemd-detect-virt again. - - Check dmesg or journalctl -k and verify that no perfmon AppArmor denials - are logged. + The full integration test suite provides coverage. On top of this, the + CPC team has manually tested this fix and verified that it is working. [ Where problems could occur ] Adding permissions to an AppArmor profile brings the risk of allowing more access than intended. To minimize the concern, capability perfmon is strictly granted to the ubuntu_pro_esm_cache_systemd_detect_virt sub-profile for capability checks required by systemd-detect-virt, without granting extra file or process access. [ Other Info ] Here is the original description of the bug: We are seeing an apparmor DENIED audit message in CPC's Resolute and Noble testing pipelines: 'Mar 01 21:52:18 alan-resolute-tpqofsymyu kernel: audit: type=1400 audit(1772401938.245:192): apparmor="DENIED" operation="capable" class="cap" profile="ubuntu_pro_esm_cache_systemd_detect_virt" pid=3768 comm="systemd-detect-" capability=38 capname="perfmon"' From the apparmor team: That denial is for capabilities (7). It seems that `ubuntu_pro_esm_cache_systemd_detect_virt` needs a rule in the following syntax: ``` capability perfmon, ``` Locally reproduced with the latest Resolute daily image (https://cloud- images.ubuntu.com/resolute/20260221/): Description: Ubuntu Resolute Raccoon (development branch) Release: 26.04 Package: linux-virtual Version: 6.19.0-6.6 Package: systemd Version: 259-1ubuntu3 Package: apparmor Version: 5.0.0~beta1-0ubuntu2 Logs: ubuntu@ubuntu:~$ journalctl --no-pager | grep DENIED Mar 04 18:03:59 ubuntu kernel: audit: type=1400 audit(1772647439.196:190): apparmor="DENIED" operation="capable" class="cap" profile="ubuntu_pro_esm_cache_systemd_detect_virt" pid=1127 comm="systemd-detect-" capability=38 capname="perfmon" [ Changelog ] ubuntu-advantage-tools (38ubuntu0) stonking; urgency=medium - * d/apparmor: add cap perfmon to cloud_id AppArmor profile (LP: #2153472) - * d/apparmor: add perfmon systemctl unix socket in AppArmor profiles - (LP: #2143251) - * d/apparmor: fix denied audit messages when devicetree exists - (LP: #2131292) - * d/apparmor: include PID directory in ubuntu_pro_esm_cache profile (GH: #3555) - * d/apparmor: allow /usr/share/coreutils/locales/** in ubuntu_pro_esm_cache - profile (GH: #3570) - * New upstream release 38: - - security: - + fix CVE-2026-12391 - + fix CVE-2026-11386 - + fix CVE-2026-9494 - - clouds: - + add support for GCE Marketplace Pro licenses (GH: #3573) - + add resolute GCP license IDs (GH: #3532) - + map aws-gov to aws for correct FIPS flavor (LP: #2144693) + * d/apparmor: add cap perfmon to cloud_id AppArmor profile (LP: #2153472) + * d/apparmor: add perfmon systemctl unix socket in AppArmor profiles + (LP: #2143251) + * d/apparmor: fix denied audit messages when devicetree exists + (LP: #2131292) + * d/apparmor: include PID directory in ubuntu_pro_esm_cache profile (GH: #3555) + * d/apparmor: allow /usr/share/coreutils/locales/** in ubuntu_pro_esm_cache + profile (GH: #3570) + * New upstream release 38: + - security: + + fix CVE-2026-12391 + + fix CVE-2026-11386 + + fix CVE-2026-9494 + - clouds: + + add support for GCE Marketplace Pro licenses (GH: #3573) + + add resolute GCP license IDs (GH: #3532) + + map aws-gov to aws for correct FIPS flavor (LP: #2144693)
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2143251 Title: ubuntu_pro_esm_cache_systemd_detect_virt apparmor DENIED audit messages for perfmon capability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2143251/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
