Thanks Chris. I completed SRU verification for Noble:
Test environment:
- Noble HWE kernel (7.0.0-31-generic)
- Noble LXD container (Ubuntu 24.04.5 LTS) nested inside a VM
My original report used 7.0.0-28-generic, but the bug is still present
in 7.0.0-31-generic with AppArmor 4.0.1really4.0.1-0ubuntu0.24.04.7.
Using the same aa-repro profile:
root@c1:~# aa-exec -p aa-repro -- \
python3 -c 'import socket; socket.socket(socket.AF_INET,
socket.SOCK_STREAM); socket.socket(socket.AF_INET6, socket.SOCK_STREAM);
print("ok")'
Traceback (most recent call last):
File "<string>", line 1, in <module>
File "/usr/lib/python3.12/socket.py", line 233, in __init__
_socket.socket.__init__(self, family, type, proto, fileno)
PermissionError: [Errno 13] Permission denie
I then installed AppArmor 4.0.1really4.0.1-0ubuntu0.24.04.8 from noble-
proposed and reloaded the profile with the patched parser:
root@c1:~# apt update
root@c1:~# apt install -y \
apparmor=4.0.1really4.0.1-0ubuntu0.24.04.8 \
apparmor-utils=4.0.1really4.0.1-0ubuntu0.24.04.8 \
libapparmor1=4.0.1really4.0.1-0ubuntu0.24.04.8
root@c1:~# apparmor_parser -r /etc/apparmor.d/aa-repro
root@c1:~# aa-exec -p aa-repro -- \
python3 -c 'import socket; socket.socket(socket.AF_INET,
socket.SOCK_STREAM); socket.socket(socket.AF_INET6, socket.SOCK_STREAM);
print("ok")'
ok
The proposed package fixes the issue on Noble.
I also verified pivot_root still passes as before:
root@c1:~# aa-exec -p aa-repro -- unshare --mount --propagation private -- bash
-c '
mkdir -p /mnt/newroot
mount -t tmpfs tmpfs /mnt/newroot
mkdir -p /mnt/newroot/put_old
cd /mnt/newroot
pivot_root . put_old && echo ok'
ok
** Tags removed: sts verification-needed-noble
** Tags added: verification-done-noble
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162134
Title:
Unconfined profile blocks socket_create
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2162134/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
