Bug#980508: ntpsec: apparmor="DENIED" while trying to read /etc/ssl/openssl.cnf

2021-01-20 Thread Richard Laager

On 1/19/21 6:09 PM, Diederik de Haas wrote:

# journalctl -kaf --no-hostname | grep -w 'apparmor="DENIED"'
jan 20 00:45:32 kernel: audit: type=1400 audit(1611099932.689:41):
apparmor="DENIED" operation="open" profile="/usr/sbin/ntpd"
name="/etc/ssl/openssl.cnf" pid=43157 comm="ntpd" requested_mask="r"
denied_mask="r" fsuid=0 ouid=0
Thanks for your report! I've uploaded a new version which includes the 
openssl abstraction and thus fixes this.


--
Richard



Bug#980508: ntpsec: apparmor="DENIED" while trying to read /etc/ssl/openssl.cnf

2021-01-19 Thread Diederik de Haas
Package: ntpsec
Version: 1.2.0+dfsg1-2
Severity: normal
User: pkg-apparmor-t...@lists.alioth.debian.org

I just installed ntpsec (replacing ntp) and noticed the following error
msg wrt AppArmor. Single result broken up to keep below 80 char width.

# journalctl -kaf --no-hostname | grep -w 'apparmor="DENIED"'
jan 20 00:45:32 kernel: audit: type=1400 audit(1611099932.689:41): 
apparmor="DENIED" operation="open" profile="/usr/sbin/ntpd" 
name="/etc/ssl/openssl.cnf" pid=43157 comm="ntpd" requested_mask="r" 
denied_mask="r" fsuid=0 ouid=0

I don't have an indication that ntpsec doesn't do its job because of
this, but thought I'd report it nonetheless, especially given the 'sec'
in its name.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'testing-debug'), (500, 
'unstable'), (500, 'testing'), (101, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.0-1-amd64 (SMP w/16 CPU threads)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages ntpsec depends on:
ii  adduser  3.118
ii  init-system-helpers  1.60
ii  libbsd0  0.10.0-1
ii  libc62.31-9
ii  libcap2  1:2.44-1
ii  libssl1.11.1.1i-2
ii  lsb-base 11.1.0
ii  netbase  6.2
ii  python3  3.9.1-1
ii  python3-ntp  1.2.0+dfsg1-2
ii  tzdata   2020f-1

Versions of packages ntpsec recommends:
ii  cron [cron-daemon]  3.0pl1-136
ii  systemd 247.2-5

Versions of packages ntpsec suggests:
ii  apparmor   2.13.6-7
ii  certbot1.11.0-1
pn  ntpsec-doc 
pn  ntpsec-ntpviz  

-- no debconf information