Your message dated Sun, 27 Dec 2020 08:48:25 +0000
with message-id <[email protected]>
and subject line Bug#969114: fixed in apparmor 2.13.6-1
has caused the Debian Bug report #969114,
regarding apparmor-profiles: usr.sbin.dovecot does not allow reading
/usr/share/dovecot/dh.pem (dovecot fails to start)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
969114: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969114
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: apparmor-profiles
Version: 2.13.2-10
Severity: normal
Tags: upstream
Dear Maintainer,
This is produced if usr.sbin.dovecot is copied to /etc/apparmor.d:
```
type=AVC msg=audit(1598556536.092:901): apparmor="DENIED" operation="open"
profile="dovecot" name="/usr/share/dovecot/dh.pem" pid=12625 comm="doveconf"
requested_mask="r" denied_mask="r" fsuid=0 ouid=0
```
This results in dovecot failing to start:
```
Aug 27 22:31:47 systemd[1]: Started Dovecot IMAP/POP3 email server.
Aug 27 22:31:47 dovecot[13693]: doveconf: Fatal: Error in configuration file
/etc/dovecot/conf.d/10-ssl.conf line 50: ssl_dh: Can't open file /usr/share/dove
Aug 27 22:31:47 systemd[1]: dovecot.service: Main process exited, code=exited,
status=89/n/a
Aug 27 22:31:47 systemd[1]: dovecot.service: Failed with result 'exit-code'.
```
It is fixed by adding single rule:
```
/usr/share/dovecot/dh.pem r,
```
-- System Information:
Debian Release: 10.5
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: armhf (armv7l)
Kernel: Linux 4.19.0-10-armmp-lpae (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages apparmor-profiles depends on:
ii apparmor 2.13.2-10
apparmor-profiles recommends no packages.
apparmor-profiles suggests no packages.
-- Configuration Files:
/etc/apparmor.d/bin.ping changed [not included]
/etc/apparmor.d/sbin.klogd changed [not included]
/etc/apparmor.d/sbin.syslog-ng changed [not included]
/etc/apparmor.d/sbin.syslogd changed [not included]
/etc/apparmor.d/usr.sbin.avahi-daemon changed [not included]
/etc/apparmor.d/usr.sbin.dnsmasq changed [not included]
/etc/apparmor.d/usr.sbin.identd changed [not included]
/etc/apparmor.d/usr.sbin.mdnsd changed [not included]
/etc/apparmor.d/usr.sbin.nmbd changed [not included]
/etc/apparmor.d/usr.sbin.nscd changed [not included]
/etc/apparmor.d/usr.sbin.smbd changed [not included]
/etc/apparmor.d/usr.sbin.smbldap-useradd changed [not included]
/etc/apparmor.d/usr.sbin.traceroute changed [not included]
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: apparmor
Source-Version: 2.13.6-1
Done: intrigeri <[email protected]>
We believe that the bug you reported is fixed in the latest version of
apparmor, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
intrigeri <[email protected]> (supplier of updated apparmor package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 27 Dec 2020 08:00:50 +0000
Source: apparmor
Architecture: source
Version: 2.13.6-1
Distribution: unstable
Urgency: medium
Maintainer: Debian AppArmor Team <[email protected]>
Changed-By: intrigeri <[email protected]>
Closes: 930031 969114 972883
Changes:
apparmor (2.13.6-1) unstable; urgency=medium
.
* New upstream release (Closes: #969114, #930031)
* Improve long descriptions:
- apparmor-utils: fix typos
- libapparmor1, libapparmor-dev: don't try to list all functionality
* autopkgtest: don't try to compile kopano policies (kopanocore is not
in testing and was orphaned)
* Adjust to the fact 3.0.x was released upstream and packaged in
experimental:
- debian/watch: use the Launchpad page with all downloads
- gbp: use upstream/2.13.x as the upstream branch
* Drop obsolete patches
* apparmor-profiles: install usr.lib.dovecot.script-login (Closes: #972883)
* Drop dh_perl custom invocation
Checksums-Sha1:
009969221132507ea1662b78c9a11adfdfffe19d 3039 apparmor_2.13.6-1.dsc
403235a3923efd51a574ac7f833d5518894bc91b 7399438 apparmor_2.13.6.orig.tar.gz
ae1e68dd97710a2a63f1d70ba06fb9d530e0d8e1 870 apparmor_2.13.6.orig.tar.gz.asc
5d42469bed25f225991ecc133c4d0aafaa3f5dc4 100760 apparmor_2.13.6-1.debian.tar.xz
Checksums-Sha256:
90911ebabef968d61491be18a35f1a8f58e34819d7433a202f24efc7397e04cc 3039
apparmor_2.13.6-1.dsc
4426b8b73f368889aea69cbc224ae666d4145b9520a2866cc2a915908e87ba8f 7399438
apparmor_2.13.6.orig.tar.gz
74f180f2108043842a64671239aa408062eae3681b60602801246d4e6f63eccf 870
apparmor_2.13.6.orig.tar.gz.asc
20194d3084b65505e3e06d89ceb35e343378913a79aa8c54eebff64d63413218 100760
apparmor_2.13.6-1.debian.tar.xz
Files:
cf7ea44271cf502cea5811721ede6198 3039 admin optional apparmor_2.13.6-1.dsc
377545626db2278ef5d1319b68611c84 7399438 admin optional
apparmor_2.13.6.orig.tar.gz
be7031dff39357b76824e4b7ea8b09bc 870 admin optional
apparmor_2.13.6.orig.tar.gz.asc
7d642ce2360b7d4ee6a00b79e2e76431 100760 admin optional
apparmor_2.13.6-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iIsEARYKADMWIQSGvLSmLC5eAlTqE6j4rL85wumaPgUCX+hFDRUcaW50cmlnZXJp
QGRlYmlhbi5vcmcACgkQ+Ky/OcLpmj6SrAD9EfycvlfK7jMVpSsJkC5F4yzZ03oc
n1U3NzJZC9Z1n9IA/156KwzIPH+UXS5KXGtmPmqrb4I5aC4S3cwAmdKy6uIL
=kD3g
-----END PGP SIGNATURE-----
--- End Message ---
