Public bug reported:
When the guest session launches, bamfdaemon triggers denials on reading
/proc/<PID>/stat:
apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-
guest-session" name="/proc/863/stat" pid=1816 comm="bamfdaemon"
requested_mask="r" denied_mask="r" fsuid=117 ouid=0
and common utilities, such as ps and killall, trigger the same types of
denials:
apparmor="DENIED" operation="open"
profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/11/stat" pid=2827
comm="ps" requested_mask="r" denied_mask="r" fsuid=117 ouid=0
apparmor="DENIED" operation="open"
profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/12/stat" pid=2813
comm="killall" requested_mask="r" denied_mask="r" fsuid=117 ouid=0
We already grant some read permissions on /proc/ <PID>/*:
owner @{PROC}/** rm,
# needed for gnome-keyring-daemon
@{PROC}/*/status r,
but non-owned /proc/<PID>/stat files are not covered.
We should either grant the permission to read the files or quiet the
denials, as they can generate quite a few log entries. Since we already
grant read permissions on /proc/<PID>/status, it seems like adding read
permissions on /proc/<PID>/stat is appropriate.
** Affects: lightdm (Ubuntu)
Importance: Low
Assignee: Tyler Hicks (tyhicks)
Status: In Progress
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to lightdm in Ubuntu.
https://bugs.launchpad.net/bugs/1301625
Title:
Guest session emits AppArmor denials about reading /proc/<PID>/stat
Status in “lightdm” package in Ubuntu:
In Progress
Bug description:
When the guest session launches, bamfdaemon triggers denials on
reading /proc/<PID>/stat:
apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-
guest-session" name="/proc/863/stat" pid=1816 comm="bamfdaemon"
requested_mask="r" denied_mask="r" fsuid=117 ouid=0
and common utilities, such as ps and killall, trigger the same types
of denials:
apparmor="DENIED" operation="open"
profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/11/stat" pid=2827
comm="ps" requested_mask="r" denied_mask="r" fsuid=117 ouid=0
apparmor="DENIED" operation="open"
profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/12/stat" pid=2813
comm="killall" requested_mask="r" denied_mask="r" fsuid=117 ouid=0
We already grant some read permissions on /proc/ <PID>/*:
owner @{PROC}/** rm,
# needed for gnome-keyring-daemon
@{PROC}/*/status r,
but non-owned /proc/<PID>/stat files are not covered.
We should either grant the permission to read the files or quiet the
denials, as they can generate quite a few log entries. Since we
already grant read permissions on /proc/<PID>/status, it seems like
adding read permissions on /proc/<PID>/stat is appropriate.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/lightdm/+bug/1301625/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
