Your message dated Fri, 2 Sep 2016 13:20:01 +0200
with message-id <20160902112000.etwu3c52xwvpetmc@capeo>
and subject line Re: [pkg-apparmor] Bug#835826: Bug#835826: apparmor-profiles:
usr.lib.dovecot.imap issue?
has caused the Debian Bug report #835826,
regarding apparmor-profiles: usr.lib.dovecot.imap issue?
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
835826: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=835826
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: apparmor-profiles
Version: 2.10.95-4
Severity: normal
My logs are full of:
Aug 28 18:42:04 laptop audit[8899]: AVC apparmor="ALLOWED" operation="getattr"
profile="/usr/lib/dovecot/imap//null-8b//null-8c"
name="/home/user/mail/dovecot.index.log" pid=8899 comm="imap"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Is there an issue with usr.lib.dovecot.imap?
-- System Information:
Debian Release: stretch/sid
APT prefers unstable
APT policy: (990, 'unstable'), (600, 'testing'), (500, 'stable'), (100,
'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages apparmor-profiles depends on:
ii apparmor 2.10.95-4
apparmor-profiles recommends no packages.
apparmor-profiles suggests no packages.
-- no debconf information
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Thanks to sarnold or #apparmor, I succeeded in having a usable
configuration.
Here where the files (in /etc/apparmor.d/local/) I had to modify (see
attachements).
Thanks again!
On 2016-08-29 10:39-0700, Seth Arnold wrote:
> On Mon, Aug 29, 2016 at 09:01:08AM +0200, Félix Sipma wrote:
>> The logs are quite large... Here are the lines (only from the last minute)
>> without any "//null-*" in the profile name:
>>
>> Aug 29 08:50:02 laptop kernel: audit_printk_skb: 1218 callbacks suppressed
>> Aug 29 08:50:07 laptop audit[27369]: AVC apparmor="ALLOWED" operation="open"
>> profile="/usr/lib/dovecot/imap" name="/etc/ld.so.preload" pid=27369
>> comm="imap" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
>> Aug 29 08:50:07 laptop kernel: audit_printk_skb: 1218 callbacks suppressed
>
> I suspect this computer is performing pretty poorly at this point, it
> looks like a few thousand AppArmor issues being ALLOWED each second.
>
> A full repair is probably more than a bugmail should encourage; if you've
> got time to head to #apparmor on irc.oftc.net we'd be happy to walk you
> through fixing this up.
>
> A quick first step would add:
>
> /etc/ld.so.preload r,
>
> to the:
>
> /etc/apparmor.d/abstractions/base
>
> file. (This change was recently made upstream: see
> http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3497
> for the patch.)
>
> Then reload at least your dovecot imap profile, probably something like:
>
> apparmor_parser --reload /etc/apparmor.d/usr.lib.dovecot.imap
>
> Thanks
# Site-specific additions and overrides for usr.lib.dovecot.config.
# For more details, please see /etc/apparmor.d/local/README.
/usr/share/dovecot/** r,
# Site-specific additions and overrides for usr.lib.dovecot.imap.
# For more details, please see /etc/apparmor.d/local/README.
/usr/bin/doveconf rix,
/usr/lib/dovecot/imap rix,
/usr/share/dovecot/** r,
/etc/dovecot/dovecot.conf r,
/etc/dovecot/conf.d/** r,
/etc/dovecot/conf.d/ r,
# Site-specific additions and overrides for usr.lib.dovecot.auth.
# For more details, please see /etc/apparmor.d/local/README.
/run/dovecot/stats-user rw,
# Site-specific additions and overrides for usr.lib.dovecot.lmtp.
# For more details, please see /etc/apparmor.d/local/README.
@{HOME}/.dovecot.svbin r,
signature.asc
Description: PGP signature
--- End Message ---
