[Kernel-packages] [Bug 1839037] Re: Stacked onexec transitions fail when under NO NEW PRIVS restrictions
This seems to cause bug 1844186 per the good/bad versions reported (4.15.0-58 and -60) being the only mention to nnp in the changelog, if I read it correctly. -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1839037 Title: Stacked onexec transitions fail when under NO NEW PRIVS restrictions Status in linux package in Ubuntu: Incomplete Status in linux source package in Xenial: Fix Released Status in linux source package in Bionic: Fix Released Bug description: running the apparmor nnp regression tests results in the following failure Error: transition failed. Test 'NNP (stack onexec - NNP)' was expected to 'pass'. Reason for failure 'FAIL - execv: Operation not permitted' with a log message of [ 1169.863302] audit: type=1400 audit(1565046042.144:280686): apparmor="DENIED" operation="exec" info="no new privs" error=-1 profile="/home/jj/apparmor.git/tests/regression/apparmor/transition" name="/home/jj/apparmor.git/tests/regression/apparmor/open" pid=1888 comm="transition" requested_mask="x" denied_mask="x" fsuid=0 ouid=1000 target="/home/jj/apparmor.git/tests/regression/apparmor/open" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1839037/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1839037] Re: Stacked onexec transitions fail when under NO NEW PRIVS restrictions
This bug was fixed in the package linux - 4.4.0-161.189 --- linux (4.4.0-161.189) xenial; urgency=medium * xenial/linux: 4.4.0-161.189 -proposed tracker (LP: #1841544) * flock not mediated by 'k' (LP: 1658219) - Revert "UBUNTU: SAUCE: apparmor: flock mediation is not being, enforced on cache check" * Packaging resync (LP: #1786013) - [Packaging] resync getabis linux (4.4.0-160.188) xenial; urgency=medium * xenial/linux: 4.4.0-160.188 -proposed tracker (LP: #1840021) * Packaging resync (LP: #1786013) - [Packaging] update helper scripts * EeePC 1005px laptop backlight is off after system boot up (LP: #1837117) - platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi * CVE-2019-10638 - [Config] CONFIG_TEST_HASH=n - siphash: add cryptographically secure PRF - inet: switch IP ID generator to siphash * Stacked onexec transitions fail when under NO NEW PRIVS restrictions (LP: #1839037) - SAUCE: apparmor: fix nnp subset check failure, when stacking * AppArmor onexec transition causes WARN kernel stack trace (LP: #1838627) - SAUCE: apparmor: fix audit failures when performing profile transitions * flock not mediated by 'k' (LP: 1658219) // Ubuntu 16.04: read access incorrectly implies 'm' rule (LP: 1838090) - SAUCE: apparmor: flock mediation is not being, enforced on cache check * bcache: bch_allocator_thread(): hung task timeout (LP: #1784665) // Tight timeout for bcache removal causes spurious failures (LP: #1796292) - SAUCE: bcache: fix deadlock in bcache_allocator * bcache: bch_allocator_thread(): hung task timeout (LP: #1784665) - bcache: improve bcache_reboot() - bcache: add journal statistic - bcache: fix high CPU occupancy during journal - bcache: fix incorrect sysfs output value of strip size - bcache: fix error return value in memory shrink - bcache: fix using of loop variable in memory shrink - bcache: Fix indentation - bcache: Add __printf annotation to __bch_check_keys() - bcache: Annotate switch fall-through - bcache: Fix kernel-doc warnings - bcache: Remove an unused variable - bcache: Suppress more warnings about set-but-not-used variables - bcache: Reduce the number of sparse complaints about lock imbalances - bcache: Move couple of functions to sysfs.c * CVE-2019-3900 - vhost: introduce vhost_vq_avail_empty() - vhost_net: tx batching - vhost_net: do not stall on zerocopy depletion - vhost-net: set packet weight of tx polling to 2 * vq size - vhost_net: use packet weight for rx handler, too - vhost_net: introduce vhost_exceeds_weight() - vhost: introduce vhost_exceeds_weight() - vhost_net: fix possible infinite loop - vhost: scsi: add weight support * Xenial: ZFS deadlock in shrinker path with xattrs (LP: #1839521) - SAUCE: (noup) Update zfs to 0.6.5.6-0ubuntu28 * CVE-2019-13648 - powerpc/tm: Fix oops on sigreturn on systems without TM * CVE-2018-20856 - block: blk_init_allocated_queue() set q->fq as NULL in the fail case * CVE-2019-14283 - floppy: fix out-of-bounds read in copy_buffer * CVE-2019-14284 - floppy: fix div-by-zero in setup_format_params * Xenial update: 4.4.186 upstream stable release (LP: #1838467) - Input: elantech - enable middle button support on 2 ThinkPads - samples, bpf: fix to change the buffer size for read() - mac80211: mesh: fix RCU warning - dt-bindings: can: mcp251x: add mcp25625 support - can: mcp251x: add support for mcp25625 - Input: imx_keypad - make sure keyboard can always wake up system - ARM: davinci: da850-evm: call regulator_has_full_constraints() - ARM: davinci: da8xx: specify dma_coherent_mask for lcdc - md: fix for divide error in status_resync - bnx2x: Check if transceiver implements DDM before access - udf: Fix incorrect final NOT_ALLOCATED (hole) extent length - x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() - x86/tls: Fix possible spectre-v1 in do_get_thread_area() - mwifiex: Abort at too short BSS descriptor element - fscrypt: don't set policy for a dead directory - mwifiex: Don't abort on small, spec-compliant vendor IEs - USB: serial: ftdi_sio: add ID for isodebug v1 - USB: serial: option: add support for GosunCn ME3630 RNDIS mode - usb: gadget: ether: Fix race between gether_disconnect and rx_submit - usb: renesas_usbhs: add a workaround for a race condition of workqueue - staging: comedi: dt282x: fix a null pointer deref on interrupt - staging: comedi: amplc_pci230: fix null pointer deref on interrupt - carl9170: fix misuse of device driver API - VMCI: Fix integer overflow in VMCI handle arrays - MIPS: Remove superfluous check for __linux__ - e1000e: start network tx queue only when link is up - perf/core: Fix perf_sample_regs_user() mm check -
[Kernel-packages] [Bug 1839037] Re: Stacked onexec transitions fail when under NO NEW PRIVS restrictions
** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1839037 Title: Stacked onexec transitions fail when under NO NEW PRIVS restrictions Status in linux package in Ubuntu: Incomplete Status in linux source package in Xenial: Fix Committed Status in linux source package in Bionic: Fix Committed Bug description: running the apparmor nnp regression tests results in the following failure Error: transition failed. Test 'NNP (stack onexec - NNP)' was expected to 'pass'. Reason for failure 'FAIL - execv: Operation not permitted' with a log message of [ 1169.863302] audit: type=1400 audit(1565046042.144:280686): apparmor="DENIED" operation="exec" info="no new privs" error=-1 profile="/home/jj/apparmor.git/tests/regression/apparmor/transition" name="/home/jj/apparmor.git/tests/regression/apparmor/open" pid=1888 comm="transition" requested_mask="x" denied_mask="x" fsuid=0 ouid=1000 target="/home/jj/apparmor.git/tests/regression/apparmor/open" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1839037/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1839037] Re: Stacked onexec transitions fail when under NO NEW PRIVS restrictions
** Tags removed: verification-needed-bionic verification-needed-xenial ** Tags added: verification-done-bionic -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1839037 Title: Stacked onexec transitions fail when under NO NEW PRIVS restrictions Status in linux package in Ubuntu: Incomplete Status in linux source package in Xenial: Fix Committed Status in linux source package in Bionic: Fix Committed Bug description: running the apparmor nnp regression tests results in the following failure Error: transition failed. Test 'NNP (stack onexec - NNP)' was expected to 'pass'. Reason for failure 'FAIL - execv: Operation not permitted' with a log message of [ 1169.863302] audit: type=1400 audit(1565046042.144:280686): apparmor="DENIED" operation="exec" info="no new privs" error=-1 profile="/home/jj/apparmor.git/tests/regression/apparmor/transition" name="/home/jj/apparmor.git/tests/regression/apparmor/open" pid=1888 comm="transition" requested_mask="x" denied_mask="x" fsuid=0 ouid=1000 target="/home/jj/apparmor.git/tests/regression/apparmor/open" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1839037/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1839037] Re: Stacked onexec transitions fail when under NO NEW PRIVS restrictions
This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed- xenial' to 'verification-done-xenial'. If the problem still exists, change the tag 'verification-needed-xenial' to 'verification-failed- xenial'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: verification-needed-xenial -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1839037 Title: Stacked onexec transitions fail when under NO NEW PRIVS restrictions Status in linux package in Ubuntu: Incomplete Status in linux source package in Xenial: Fix Committed Status in linux source package in Bionic: Fix Committed Bug description: running the apparmor nnp regression tests results in the following failure Error: transition failed. Test 'NNP (stack onexec - NNP)' was expected to 'pass'. Reason for failure 'FAIL - execv: Operation not permitted' with a log message of [ 1169.863302] audit: type=1400 audit(1565046042.144:280686): apparmor="DENIED" operation="exec" info="no new privs" error=-1 profile="/home/jj/apparmor.git/tests/regression/apparmor/transition" name="/home/jj/apparmor.git/tests/regression/apparmor/open" pid=1888 comm="transition" requested_mask="x" denied_mask="x" fsuid=0 ouid=1000 target="/home/jj/apparmor.git/tests/regression/apparmor/open" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1839037/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1839037] Re: Stacked onexec transitions fail when under NO NEW PRIVS restrictions
This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed- bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed- bionic'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: verification-needed-bionic -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1839037 Title: Stacked onexec transitions fail when under NO NEW PRIVS restrictions Status in linux package in Ubuntu: Incomplete Status in linux source package in Xenial: Fix Committed Status in linux source package in Bionic: Fix Committed Bug description: running the apparmor nnp regression tests results in the following failure Error: transition failed. Test 'NNP (stack onexec - NNP)' was expected to 'pass'. Reason for failure 'FAIL - execv: Operation not permitted' with a log message of [ 1169.863302] audit: type=1400 audit(1565046042.144:280686): apparmor="DENIED" operation="exec" info="no new privs" error=-1 profile="/home/jj/apparmor.git/tests/regression/apparmor/transition" name="/home/jj/apparmor.git/tests/regression/apparmor/open" pid=1888 comm="transition" requested_mask="x" denied_mask="x" fsuid=0 ouid=1000 target="/home/jj/apparmor.git/tests/regression/apparmor/open" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1839037/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1839037] Re: Stacked onexec transitions fail when under NO NEW PRIVS restrictions
** Changed in: linux (Ubuntu Xenial) Status: Confirmed => Fix Committed -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1839037 Title: Stacked onexec transitions fail when under NO NEW PRIVS restrictions Status in linux package in Ubuntu: Incomplete Status in linux source package in Xenial: Fix Committed Status in linux source package in Bionic: Fix Committed Bug description: running the apparmor nnp regression tests results in the following failure Error: transition failed. Test 'NNP (stack onexec - NNP)' was expected to 'pass'. Reason for failure 'FAIL - execv: Operation not permitted' with a log message of [ 1169.863302] audit: type=1400 audit(1565046042.144:280686): apparmor="DENIED" operation="exec" info="no new privs" error=-1 profile="/home/jj/apparmor.git/tests/regression/apparmor/transition" name="/home/jj/apparmor.git/tests/regression/apparmor/open" pid=1888 comm="transition" requested_mask="x" denied_mask="x" fsuid=0 ouid=1000 target="/home/jj/apparmor.git/tests/regression/apparmor/open" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1839037/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1839037] Re: Stacked onexec transitions fail when under NO NEW PRIVS restrictions
** Changed in: linux (Ubuntu Bionic) Status: Confirmed => Fix Committed -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1839037 Title: Stacked onexec transitions fail when under NO NEW PRIVS restrictions Status in linux package in Ubuntu: Incomplete Status in linux source package in Xenial: Confirmed Status in linux source package in Bionic: Fix Committed Bug description: running the apparmor nnp regression tests results in the following failure Error: transition failed. Test 'NNP (stack onexec - NNP)' was expected to 'pass'. Reason for failure 'FAIL - execv: Operation not permitted' with a log message of [ 1169.863302] audit: type=1400 audit(1565046042.144:280686): apparmor="DENIED" operation="exec" info="no new privs" error=-1 profile="/home/jj/apparmor.git/tests/regression/apparmor/transition" name="/home/jj/apparmor.git/tests/regression/apparmor/open" pid=1888 comm="transition" requested_mask="x" denied_mask="x" fsuid=0 ouid=1000 target="/home/jj/apparmor.git/tests/regression/apparmor/open" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1839037/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1839037] Re: Stacked onexec transitions fail when under NO NEW PRIVS restrictions
** Changed in: linux (Ubuntu Bionic) Status: Incomplete => Confirmed ** Changed in: linux (Ubuntu Bionic) Importance: Undecided => Medium ** Changed in: linux (Ubuntu Xenial) Status: Incomplete => Confirmed ** Changed in: linux (Ubuntu Xenial) Importance: Undecided => Medium -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1839037 Title: Stacked onexec transitions fail when under NO NEW PRIVS restrictions Status in linux package in Ubuntu: Incomplete Status in linux source package in Xenial: Confirmed Status in linux source package in Bionic: Confirmed Bug description: running the apparmor nnp regression tests results in the following failure Error: transition failed. Test 'NNP (stack onexec - NNP)' was expected to 'pass'. Reason for failure 'FAIL - execv: Operation not permitted' with a log message of [ 1169.863302] audit: type=1400 audit(1565046042.144:280686): apparmor="DENIED" operation="exec" info="no new privs" error=-1 profile="/home/jj/apparmor.git/tests/regression/apparmor/transition" name="/home/jj/apparmor.git/tests/regression/apparmor/open" pid=1888 comm="transition" requested_mask="x" denied_mask="x" fsuid=0 ouid=1000 target="/home/jj/apparmor.git/tests/regression/apparmor/open" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1839037/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
