[Touch-packages] [Bug 1849554] Re: Please move cache files to a different location

2020-01-20 Thread Jamie Strandboge
"Upstream apparmor has moved to defaulting the location to /var/cache/apparmor. But Ubuntu has yet to make this move." As mentioned in comment #1: "2.13.2-9ubuntu1 moved the cache dir to /var/cache/apparmor". Ubuntu 19.04+ is using /var/cache/apparmor. -- You received this bug notification

[Touch-packages] [Bug 1859972] Re: UFW doesn't support SCTP

2020-01-20 Thread Jamie Strandboge
I'll take a look at this when preparing the next release, which should be in the coming weeks. ** Changed in: ufw (Ubuntu) Importance: Undecided => Wishlist ** Changed in: ufw (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu

[Touch-packages] [Bug 1858464] Re: iptable rules are still present after disabling ufw

2020-01-06 Thread Jamie Strandboge
Thank you for using Ubuntu and reporting a bug. Please note that 'sudo ufw disable' will flush the ufw chains and make them all 'pass through' (ie, think of them as NOPs) until reboot. On reboot, ufw won't run and even the pass through chains won't be added. Furthermore, unless MANAGE_BUILTINS

[Touch-packages] [Bug 1849680] Re: audit spam in dmesg (libreoffice)

2019-12-17 Thread Jamie Strandboge
libreoffice ships this profile, so the bug should be tracked there. ** Package changed: apparmor (Ubuntu) => libreoffice (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 1824812] Re: apparmor does not start in Disco LXD containers

2019-12-17 Thread Jamie Strandboge
This was fixed upstream in 61c27d8808f0589beb6a319cc04073e8bb32d860 ** Changed in: apparmor Status: Triaged => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 1682055] Re: dh_apparmor does not remove profiles(s) when purging package

2019-12-17 Thread Jamie Strandboge
Keeping the profiles in the running kernel is by design since there might be processes that are still running under the profile on package removal. dpkg doesn't do anything to guarantee that executables that the package ships aren't running, so we can't reasonably unload the profiles. Marking

[Touch-packages] [Bug 1667751] Re: Confined binaries running in namespaces unable to read their executable

2019-12-17 Thread Jamie Strandboge
John, what do you think about Seth's question in https://bugs.launchpad.net/apparmor/+bug/1667751/comments/5? ** Also affects: apparmor Importance: Undecided Status: New ** Changed in: apparmor Status: New => Incomplete -- You received this bug notification because you are a

[Touch-packages] [Bug 1834192] Re: apparmor mult_mount regression test fails in eoan

2019-12-17 Thread Jamie Strandboge
This was fixed in 2.13.3-5ubuntu1 which added upstream-tests-mult-mount- bump-size-of-created-disk.patch ** Changed in: apparmor (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed

[Touch-packages] [Bug 1830502] Re: apparmor uses excessive memory leading to oom kill

2019-12-17 Thread Jamie Strandboge
** Also affects: apparmor Importance: Undecided Status: New ** Changed in: apparmor Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 1518663] Re: Disconnected path errors

2019-12-17 Thread Jamie Strandboge
Ultimately this is a kernel issue and the limitations it puts on apparmor for tracking files with disconnected paths. There isn't anything that the apparmor package or abstractions can do to help with this, but people can update their profiles to use flags=(attach_disconnected), as mentioned. For

[Touch-packages] [Bug 1518663] Re: Disconnected path errors

2019-12-17 Thread Jamie Strandboge
Today, people experiencing this error need to use flags=(attach_disconnected) in the profile. Eg: /path/to/thing flags=(attach_disconnected) { ... } -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 1703821] Re: Dovecot and Apparmor complains at operation file_inherit

2019-12-17 Thread Jamie Strandboge
@Matyáš, this configuration seems like something you added: /etc/dovecot/conf.d/10-master.conf service auth { unix_listener auth-userdb { mode = 0666 user = vmail group = mail } unix_listener /var/spool/postfix/private/auth { mode = 0666 user =

[Touch-packages] [Bug 1764715] Re: /dev/pts/0 access detected as /0

2019-12-17 Thread Jamie Strandboge
This is the result of a disconnected path with how the container is being setup. This isn't something that should be added to the apparmor abstractions. Ultimately this is a kernel issue and the limitations it puts on apparmor for tracking files with disconnected paths. There isn't anything that

[Touch-packages] [Bug 1703821] Re: Dovecot and Apparmor complains at operation file_inherit

2019-12-17 Thread Jamie Strandboge
Marking the dovecot task as Invalid since it doesn't ship the profiles. ** Changed in: dovecot (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 1792027] Re: evince denied access to mimeapps.list

2019-12-17 Thread Jamie Strandboge
** Changed in: apparmor (Ubuntu) Status: New => In Progress ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Jamie Strandboge (jdstrand) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ap

[Touch-packages] [Bug 1797242] Re: apparmor package has inappropriate Breaks/Replaces

2019-12-17 Thread Jamie Strandboge
These were only needed for bionic and we can drop in focal. ** Changed in: apparmor (Ubuntu) Status: New => In Progress -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 1813339] Re: Apparmor is denying evince from running vivaldi

2019-12-17 Thread Jamie Strandboge
The path to vivaldi indicates that the application you are trying to launch is not in the Ubuntu repositories. To accommodate this sort of thing, apparmor profiles in Ubuntu ship files in /etc/apparmor.d/local for admins to modify. I suggest adding this to /etc/apparmor.d/local/usr.bin.evince:

[Touch-packages] [Bug 1831490] Re: kernel is out of memory and killed during a kernel sys_write operation

2019-12-17 Thread Jamie Strandboge
*** This bug is a duplicate of bug 1848567 *** https://bugs.launchpad.net/bugs/1848567 I'm going to mark the linux task as Invalid and then mark as a dupe of bug 1848567 ** Changed in: linux (Ubuntu) Status: Confirmed => Won't Fix ** Changed in: apparmor (Ubuntu) Status: New

[Touch-packages] [Bug 1808360] Re: AppArmor fails after MySQL installation using 18.04.1 LTS

2019-12-17 Thread Jamie Strandboge
The apparmor package provides this file: $ dpkg -S /etc/apparmor.d/abstractions/mysql apparmor: /etc/apparmor.d/abstractions/mysql It seems the file was accidentally deleted. Recreating it in the manner you did is the proper way to resolve the issue. ** Changed in: apparmor (Ubuntu)

[Touch-packages] [Bug 1849554] Re: Please move cache files to a different location

2019-12-17 Thread Jamie Strandboge
2.13.2-9ubuntu1 moved the cache dir to /var/cache/apparmor. ** Changed in: apparmor (Ubuntu) Status: New => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 1482852] Re: apparmor profile usr.bin.firefox missing abstractions/ubuntu-helpers

2019-12-17 Thread Jamie Strandboge
** Package changed: apparmor (Ubuntu) => firefox (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1482852 Title: apparmor profile usr.bin.firefox missing

[Touch-packages] [Bug 1580463] Re: Snap blocks access to system input methods (ibus, fcitx, ...)

2019-12-17 Thread Jamie Strandboge
@Gunnar - I am preparing the focal upload now, though there is a parser bug (bug 1856738) which means I cannot use @{HOME} in the rule and instead hardcode /home/*/. This will cover all typical situations (ie, not the atypical /root/.cache/ibus...) except when the user updates

[Touch-packages] [Bug 1856738] Re: access always denied when using @{HOME} tunable in peer_addr for abstract socket

2019-12-17 Thread Jamie Strandboge
** Also affects: apparmor (Ubuntu) Importance: Undecided Status: New ** Changed in: apparmor Status: New => Triaged ** Changed in: apparmor (Ubuntu) Status: New => Triaged ** Changed in: apparmor Importance: Undecided => Medium ** Changed in: apparmor (Ubuntu)

[Touch-packages] [Bug 1781428] Re: please enable snap mediation support

2019-12-12 Thread Jamie Strandboge
Note, there is a spread test in snapd that checks for if the mediation patches are dropped (or added). While it is fine for https://launchpad.net/bugs/1856054 to be fast tracked, this pulseaudio bug should not be marked as Fix Released before the end of year break unless you coordinate with the

[Touch-packages] [Bug 1781428] Re: please enable snap mediation support

2019-11-25 Thread Jamie Strandboge
Installing 1:8.0-0ubuntu3.11 from xenial-proposed, the test plan and James' addition for mediation is preserved across snapd restart all works as expected. Marking as verification done. ** Description changed: [Impact] Ubuntu 16.10 added rudimentary snap support to disable audio recording if

[Touch-packages] [Bug 1781428] Re: please enable snap mediation support

2019-11-25 Thread Jamie Strandboge
Installing 1:11.1-1ubuntu7.5 from bionic-proposed, the test plan and James' addition for mediation is preserved across snapd restart all works as expected. Marking as verification done. ** Tags removed: verification-needed-bionic ** Tags added: verification-done-bionic -- You received this bug

[Touch-packages] [Bug 1781428] Re: please enable snap mediation support

2019-11-25 Thread Jamie Strandboge
** Description changed: [Impact] Ubuntu 16.10 added rudimentary snap support to disable audio recording if the connecting process was a snap. By Ubuntu 18.04, something changed in the build resulting in 'Enable Snappy support: no' with audio recording no longer being mediated by pulseaudio

[Touch-packages] [Bug 1844743] Re: ufw missing .conf for syslog-ng

2019-10-30 Thread Jamie Strandboge
** Changed in: ufw (Ubuntu) Status: New => Triaged ** Changed in: ufw (Ubuntu) Importance: Undecided => Medium ** Also affects: ufw Importance: Undecided Status: New ** Changed in: ufw Status: New => Triaged ** Changed in: ufw Importance: Undecided => Medium --

[Touch-packages] [Bug 1830502] Re: apparmor uses excessive memory leading to oom kill

2019-10-24 Thread Jamie Strandboge
@Ivan, we are going to fix snapd for the excessive memory usage. AppArmor upstream already uses expr-simplify by default and newer release of Ubuntu use parser.conf to set -O no-expr-simplify so users can manage the setting like any other conffile. -- You received this bug notification because

[Touch-packages] [Bug 1781428] Re: please enable snap mediation support

2019-09-30 Thread Jamie Strandboge
** Changed in: pulseaudio (Ubuntu Xenial) Status: In Progress => Triaged ** Changed in: pulseaudio (Ubuntu Bionic) Status: In Progress => Triaged -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to pulseaudio in

[Touch-packages] [Bug 1781428] Re: please enable snap mediation support

2019-09-29 Thread Jamie Strandboge
** Description changed: [Impact] Ubuntu 16.10 added rudimentary snap support to disable audio recording if the connecting process was a snap. By Ubuntu 18.04, something changed in the build resulting in 'Enable Snappy support: no' with audio recording no longer being mediated by pulseaudio

[Touch-packages] [Bug 1781428] Re: please enable snap mediation support

2019-09-29 Thread Jamie Strandboge
** Description changed: [Impact] Ubuntu 16.10 added rudimentary snap support to disable audio recording if the connecting process was a snap. By Ubuntu 18.04, something changed in the build resulting in 'Enable Snappy support: no' with audio recording no longer being mediated by pulseaudio

[Touch-packages] [Bug 1781428] Re: please enable snap mediation support

2019-09-29 Thread Jamie Strandboge
Attaching test-snapd-pulseaudio and test-snapd-audio-record snaps. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to pulseaudio in Ubuntu. https://bugs.launchpad.net/bugs/1781428 Title: please enable snap mediation support

[Touch-packages] [Bug 1781428] Re: please enable snap mediation support

2019-09-29 Thread Jamie Strandboge
** Description changed: + [Impact] + Ubuntu 16.10 added rudimentary snap support to disable audio recording if the connecting process was a snap. By Ubuntu 18.04, something changed in the build resulting in 'Enable Snappy support: no' with audio recording no longer being mediated by pulseaudio

[Touch-packages] [Bug 1781428] Re: please enable snap mediation support

2019-09-29 Thread Jamie Strandboge
** Attachment added: "test-snapd-audio-record_1_amd64.snap" https://bugs.launchpad.net/ubuntu/+source/pulseaudio/+bug/1781428/+attachment/5292539/+files/test-snapd-audio-record_1_amd64.snap -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which

[Touch-packages] [Bug 1781428] Re: pulseaudio built with --enable-snappy but 'Enable Snappy support: no'

2019-09-29 Thread Jamie Strandboge
** Description changed: + + # Original summary: pulseaudio built with --enable-snappy but 'Enable + Snappy support: no' + + # Original description + From https://launchpadlibrarian.net/377100864/buildlog_ubuntu-cosmic- amd64.pulseaudio_1%3A12.0-1ubuntu1_BUILDING.txt.gz: ...

[Touch-packages] [Bug 1548057] Re: rfkill state is not restored on reboot

2019-09-12 Thread Jamie Strandboge
This still seems to be a problem on Ubuntu 19.04. Ie, if I do: $ sudo systemctl status systemd-rfkill ● systemd-rfkill.service - Load/Save RF Kill Switch Status Loaded: loaded (/lib/systemd/system/systemd-rfkill.service; static; vendor preset: ... $ rfkill block bluetooth $ rfkill ID TYPE

[Touch-packages] [Bug 1620635] Re: libapparmor's aa_query_label() always returns allowed = 0 for file rules containing the "owner" conditional

2019-09-11 Thread Jamie Strandboge
Retriaging these down to Medium. People worked around this in different ways and High was obviously inflated since it isn't fixed yet (I just verified with 5.0.0-25.26-generic and apparmor 2.13.2-9ubuntu6.1). ** Changed in: apparmor Importance: High => Medium ** Changed in: apparmor (Ubuntu)

[Touch-packages] [Bug 1840582] Re: aa-genprof crash

2019-09-10 Thread Jamie Strandboge
This was fixed in 2.13.3-5ubuntu1 in Ubunt 19.10 ** Also affects: apparmor (Ubuntu) Importance: Undecided Status: New ** Changed in: apparmor (Ubuntu) Status: New => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages,

[Touch-packages] [Bug 1842651] Re: Regression: after Uprade from udev_237-3ubuntu10.25 to udev_237-3ubuntu10.26 network interfaces don't get renamed by 70-persistent-network.rules

2019-09-09 Thread Jamie Strandboge
@Rex and @Shih-Yuan, I believe Chris is planning to push this through -security in his morning. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bugs.launchpad.net/bugs/1842651 Title: Regression:

[Touch-packages] [Bug 1842651] Re: Regression: after Uprade from udev_237-3ubuntu10.25 to udev_237-3ubuntu10.26 network interfaces don't get renamed by 70-persistent-network.rules

2019-09-09 Thread Jamie Strandboge
> Please reject the packages that are currently in the unapproved queue. Done -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bugs.launchpad.net/bugs/1842651 Title: Regression: after Uprade from

[Touch-packages] [Bug 1842651] Re: Regression: after Uprade from udev_237-3ubuntu10.25 to udev_237-3ubuntu10.26 network interfaces don't get renamed by 70-persistent-network.rules

2019-09-09 Thread Jamie Strandboge
FYI, this broke me as well. I have an 18.04 multi-nic system that went through several upgrades and was relying on /etc/udev/rules.d/70 -persistent-net.rules to give me predictable eth* names where each eth* name was used as part of a bridge. The recent change regressed this since non-existent

[Touch-packages] [Bug 595501] Re: iptables rules for NAT may break ufw setups

2019-09-03 Thread Jamie Strandboge
This should just all happen automatically in ufw based on bug feedback, so marking ufw as "Won't Fix" instead of "Fix Released" since nothing was needed in ufw (could've used Invalid, but that seemed worse than the other two...) ** Changed in: ufw (Ubuntu) Status: Triaged => Won't Fix --

[Touch-packages] [Bug 1556419] Re: nf_conntrack: automatic helper assignment is deprecated

2019-08-25 Thread Jamie Strandboge
** Changed in: ufw (Ubuntu) Status: New => Triaged ** Changed in: ufw (Ubuntu) Importance: Undecided => Medium ** Changed in: ufw (Ubuntu) Assignee: (unassigned) => Jamie Strandboge (jdstrand) -- You received this bug notification because you are a member of Ubuntu Tou

[Touch-packages] [Bug 1833719] Re: UFW 2nd interface incorrectly working

2019-08-25 Thread Jamie Strandboge
Can you perform the following: $ mkdir /tmp/ufw $ sudo ufw show raw > /tmp/ufw/raw $ sudo tar -zcvf /tmp/1833719.tar.gz /tmp/ufw /etc/default/ufw /etc/ufw /lib/ufw then attach to this bug /tmp/1833719.tar.gz? ** Changed in: ufw (Ubuntu) Status: Expired => Incomplete -- You received

[Touch-packages] [Bug 1840633] Re: autopkgtests get stuck in Eoan with iptables 1.8.3

2019-08-21 Thread Jamie Strandboge
Indeed, that is exactly what https://git.netfilter.org/iptables/commit/?id=e5cab728c40be88c541f68e4601d39178c36111f did. Are you saying there are other cases where a similar commit is needed? IMO, those should be patched before 1.8.3 goes into eoan. Unless I am missing something, iptables is

[Touch-packages] [Bug 1840633] Re: autopkgtests get stuck in Eoan with iptables 1.8.3

2019-08-21 Thread Jamie Strandboge
It seems like iptables going into a busy loop as non-root is also a bug that should be fixed? At the very least, iptables should bail prior to that condition saying that root is needed. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is

[Touch-packages] [Bug 1840633] Re: autopkgtests get stuck in Eoan with iptables 1.8.3

2019-08-20 Thread Jamie Strandboge
Thanks for chasing this down! It seems clear that while the ufw autopkgtest found the issue, the bug is not in ufw. ** Changed in: ufw (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to

[Touch-packages] [Bug 1840375] [NEW] groupdel doesn't support extrausers

2019-08-15 Thread Jamie Strandboge
Public bug reported: snapd needs the ability to call 'groupdel --extrausers foo' to clean up after itself, but --extrausers is currently unsupported. ** Affects: snapd Importance: Undecided Assignee: Michael Vogt (mvo) Status: New ** Affects: shadow (Ubuntu) Importance:

[Touch-packages] [Bug 1824384] Re: libapparmor not built with -fPIC

2019-08-13 Thread Jamie Strandboge
** Changed in: apparmor (Ubuntu) Importance: Undecided => Medium ** Changed in: apparmor (Ubuntu) Status: New => Triaged -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 1836722] Re: package ufw 0.35-0ubuntu2 failed to install/upgrade: subprocess installed pre-removal script returned error exit status 127

2019-07-16 Thread Jamie Strandboge
This looks to be a local system issue with python3-minimal being removed and then the prerm scripts from various programs failing due to debhelper scripts that the package use can't find the required binaries. Removing python3.6-minimal (3.6.8-1~16.04.york1) ... Unlinking and removing bytecode

[Touch-packages] [Bug 1820068] Re: specifying -O no-expr-simplify results in cache miss

2019-06-24 Thread Jamie Strandboge
FYI, I tested this and 2.13.2-9ubuntu6.1 fixes this bug. I also executed https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor (sans dbus optional bits) and everything passed. Lastly, I wanted to double check the performance impact of no-expr- simplify on amd64 especially as it pertains to

[Touch-packages] [Bug 1833719] Re: UFW 2nd interface incorrectly working

2019-06-21 Thread Jamie Strandboge
Thank you for using ufw and filing a bug. Please keep in mind that the firewall is sensitive to rule order. What is the output of 'sudo ufw show numbered'? ** Changed in: ufw (Ubuntu) Status: New => Incomplete -- You received this bug notification because you are a member of Ubuntu Touch

[Touch-packages] [Bug 1788929] Re: Debian/Ubuntu AppArmor policy gaps in evince

2019-06-18 Thread Jamie Strandboge
Ubuntu 14.04 LTS is now out of standard support and evince is not included in ESM. ** Changed in: evince (Ubuntu Trusty) Status: In Progress => Won't Fix -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in

[Touch-packages] [Bug 1820068] Re: specifying -O no-expr-simplify results in cache miss

2019-06-18 Thread Jamie Strandboge
** Description changed: + [Impact] + + * AppArmor 2.13 unconditionally invalidates its cache when parser options are specified. To decrease compile times for ARM systems, -O no-expr-simplify has been used in Ubuntu for click and snap policy for many years, but was temporarily disabled during

[Touch-packages] [Bug 1820068] Re: specifying -O no-expr-simplify results in cache miss

2019-06-06 Thread Jamie Strandboge
** Changed in: apparmor Status: In Progress => Fix Released ** Changed in: apparmor (Ubuntu Disco) Status: Triaged => In Progress ** Changed in: apparmor Assignee: (unassigned) => John Johansen (jjohansen) -- You received this bug notification because you are a member of

[Touch-packages] [Bug 1820068] Re: specifying -O no-expr-simplify results in cache miss

2019-06-06 Thread Jamie Strandboge
** Changed in: apparmor (Ubuntu Eoan) Status: In Progress => Fix Committed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1820068 Title: specifying -O

[Touch-packages] [Bug 1820068] Re: specifying -O no-expr-simplify results in cache miss

2019-06-06 Thread Jamie Strandboge
riaged ** Also affects: apparmor (Ubuntu Disco) Importance: Undecided Status: New ** Changed in: apparmor (Ubuntu Eoan) Assignee: (unassigned) => Jamie Strandboge (jdstrand) ** Changed in: apparmor (Ubuntu Disco) Assignee: (unassigned) => Jamie Strandboge (jdstrand)

[Touch-packages] [Bug 1820068] Re: specifying -O no-expr-simplify results in cache miss

2019-06-06 Thread Jamie Strandboge
** Description changed: With 2.13.2 and the most recent testsuite patches from the 2.13 branch, I find that the cache works correctly when no options are specified. Eg # setup $ mkdir -p /tmp/aa/cache /tmp/aa/profiles $ cp /etc/apparmor.d/sbin.dhclient /tmp/aa/profiles/ # no

[Touch-packages] [Bug 1821625] Re: systemd 237-3ubuntu10.14 ADT test failure on Bionic ppc64el (test-seccomp)

2019-06-03 Thread Jamie Strandboge
FYI, please note that seccomp 2.4.1 was pushed to bionic in https://usn.ubuntu.com/4001-1/ on 2019/05/30. It shouldn't affect this bug report AFAICT because while the 2.4.1 Ubuntu packaging drops these patches, the upstream commits for lp-1815415-arch-update-syscalls-for- Linux-4.9.patch and

[Touch-packages] [Bug 1586496] Re: Upgrade libseccomp library in main

2019-05-31 Thread Jamie Strandboge
This could be argued as Won't Fix since trusty is out of standard support, but it did, in the end, receive an upgrade in trusty esm, so marking Fix Released. ** Changed in: libseccomp (Ubuntu) Status: New => Fix Released -- You received this bug notification because you are a member of

[Touch-packages] [Bug 1695808] Re: tasks killed for nop (-1)

2019-05-31 Thread Jamie Strandboge
This was fixed in upstream 2.3.2 which was fixed in cosmic. As of https://usn.ubuntu.com/4001-1/ pulling back 2.4.1, this is now fixed everywhere. ** Changed in: libseccomp (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification because you are a member of Ubuntu

[Touch-packages] [Bug 1586496] Re: Upgrade libseccomp library in main

2019-05-31 Thread Jamie Strandboge
libseccomp was updated in trusty ESM here: https://usn.ubuntu.com/4001-2/ -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1586496 Title: Upgrade libseccomp library in

[Touch-packages] [Bug 1830859] Re: new libseccomp 2.4 (in proposed) makes rebuilds need but not generate a dependency to 2.4

2019-05-30 Thread Jamie Strandboge
FYI, libseccomp is now published: https://usn.ubuntu.com/4001-1/ -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1830859 Title: new libseccomp 2.4 (in proposed) makes

[Touch-packages] [Bug 1830502] Re: apparmor fails to start with no parser errors

2019-05-29 Thread Jamie Strandboge
@Ian - how did you generate this profile? Is this something that snapd generated (it doesn't look like typical snap-update-ns profiles...)? If it did, can you attach the snap.yaml (this seems like atypical usage of the layouts feature)? -- You received this bug notification because you are a

[Touch-packages] [Bug 1826429] Re: package apparmor 2.13.2-9ubuntu6 failed to install/upgrade: installed apparmor package post-installation script subprocess returned error exit status 1

2019-04-26 Thread Jamie Strandboge
** Changed in: apparmor (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1826429 Title: package apparmor 2.13.2-9ubuntu6 failed to

[Touch-packages] [Bug 520546] Re: Alt+KEY incorrectly behaves like Ctrl+Alt+KEY

2019-04-17 Thread Jamie Strandboge
I'm also seeing this behavior in gnome-shell on disco. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to console-setup in Ubuntu. https://bugs.launchpad.net/bugs/520546 Title: Alt+KEY incorrectly behaves like Ctrl+Alt+KEY

[Touch-packages] [Bug 1824961] Re: AppArmor blocks apport python hook from working

2019-04-16 Thread Jamie Strandboge
"I guess the question is: Shouldn't we have a python-apport abstraction that apps (or local admin) can include to make debugging work under apparmor? It should probably live in apport, I guess, so apport can define which files it needs." Perhaps an abstraction makes sense to optionally add it in

[Touch-packages] [Bug 1824961] Re: AppArmor blocks apport python hook from working

2019-04-16 Thread Jamie Strandboge
I might also mention on IRC the exact type of thing why we've had these rules in the profile that ship them: [119698.000187] audit: type=1400 audit(1555405334.985:222): apparmor="DENIED" operation="exec" profile="/usr/sbin/kopano-search" name="/usr/bin/x86_64-linux-gnu-gcc-8" pid=15647

[Touch-packages] [Bug 1824961] Re: AppArmor blocks apport python hook from working

2019-04-16 Thread Jamie Strandboge
Traditionally we have actually put these accesses in the packages that ship the profile, like Marc said, because profilers may not want the profile to automatically have everything apport requires. These accesses should *not* be in the python abstraction because the accesses have nothing to do

[Touch-packages] [Bug 1824812] Re: apparmor does not start in Disco LXD containers

2019-04-15 Thread Jamie Strandboge
Uploaded 2.13.2-9ubuntu6 with the SFS_MOUNTPOINT change. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1824812 Title: apparmor does not start in Disco LXD containers

[Touch-packages] [Bug 1824812] Re: apparmor does not start in Disco LXD containers

2019-04-15 Thread Jamie Strandboge
Since the apparmor SFS_MOUNTPOINT change is small, I'll prepare an upload for that immediately. We may need another parser update for the other issue. ** Changed in: apparmor (Ubuntu) Status: Triaged => In Progress -- You received this bug notification because you are a member of Ubuntu

[Touch-packages] [Bug 1824812] Re: apparmor does not start in Disco LXD containers

2019-04-15 Thread Jamie Strandboge
The following will reproduce the issue in a disco VM with disco LXD container: Initial setup: 1. have an up to date disco vm $ cat /proc/version_signature Ubuntu 5.0.0-11.12-generic 5.0.6 2. sudo snap install lxd 3. sudo adduser `id -un` lxd 4. newgrp lxd 5. sudo lxd init # use defaults 6. .

[Touch-packages] [Bug 1824812] Re: apparmor does not start in Disco LXD containers

2019-04-15 Thread Jamie Strandboge
There are two bugs that are causing trouble for apparmor policy in LXD containers: 1. the rc.apparmor.functions bug (easy fix: define SFS_MOUNTPOINT at the right time 2. there is some sort of an interaction with the 5.0.0 kernel that is causing problems I'll give complete instructions on how

[Touch-packages] [Bug 1824812] Re: apparmor does not start in Disco LXD containers

2019-04-15 Thread Jamie Strandboge
** Summary changed: - apparmor no more starting in Disco LXD containers + apparmor does not start in Disco LXD containers -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 1824812] Re: apparmor no more starting in Disco LXD containers

2019-04-15 Thread Jamie Strandboge
This is due to a bug in upstream parser/rc.apparmor.functions because SFS_MOUNTPOINT is only set after is_apparmor_loaded() is called, but is_container_with_internal_policy() doesn't call it. /lib/apparmor/apparmor.systemd calls is_container_with_internal_policy() prior to apparmor_start() and it

[Touch-packages] [Bug 1824812] Re: apparmor no more starting in Disco LXD containers

2019-04-15 Thread Jamie Strandboge
** Also affects: apparmor Importance: Undecided Status: New ** Changed in: apparmor Status: New => Triaged -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 1824812] Re: apparmor no more starting in Disco LXD containers

2019-04-15 Thread Jamie Strandboge
** Changed in: libvirt (Ubuntu) Status: New => Invalid ** Changed in: apparmor (Ubuntu) Status: New => Triaged ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Jamie Strandboge (jdstrand) ** Changed in: apparmor (Ubuntu) Importance: Undecided => H

[Touch-packages] [Bug 1820114] Re: iptables v1.6.1: can't initialize iptables table `filter': Memory allocation problem

2019-04-10 Thread Jamie Strandboge
To be clear, when I installed linux-modules-extra-5.0.0-8-generic, I no longer saw this error message. Of course, it might not strictly be a duplicate, but I'll let the kernel team figure that out. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages,

[Touch-packages] [Bug 1820114] Re: iptables v1.6.1: can't initialize iptables table `filter': Memory allocation problem

2019-04-10 Thread Jamie Strandboge
FYI, I saw this when looking at https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1823862. In the other bug, the reporter say a different error message, but I saw 'iptables v1.6.1: can't initialize iptables table `filter': Memory allocation problem'. If those in this bug do not have

[Touch-packages] [Bug 1823862] Re: disco: unable to enable ufw under -virtual kernel

2019-04-10 Thread Jamie Strandboge
I can confirm that without linux-modules-extra-*, iptables is broken. Reduced test case: $ sudo iptables -L -n iptables: No chain/target/match by that name. Full test case: $ sudo /usr/share/ufw/check-requirements -f ... ERROR: could not create 'ufw-check-requirements'. Aborting FAIL: check your

[Touch-packages] [Bug 1823862] Re: disco: unable to enable ufw under -virtual kernel

2019-04-10 Thread Jamie Strandboge
Marking the ufw task as Invalid. The kernel doesn't have what is needed to run iptables. ** Changed in: ufw (Ubuntu) Status: New => Invalid ** Changed in: ufw (Ubuntu) Assignee: Jamie Strandboge (jdstrand) => (unassigned) -- You received this bug notification becau

[Touch-packages] [Bug 1823862] Re: disco: unable to enable ufw

2019-04-09 Thread Jamie Strandboge
"I can only think this is something cloud-image specific." Can you provide the requested information in the earlier comments? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ufw in Ubuntu.

[Touch-packages] [Bug 1823862] Re: disco: unable to enable ufw

2019-04-09 Thread Jamie Strandboge
Another thing that might be useful is attaching a tarball of /lib/ufw, /etc/ufw, and /etc/default/ufw. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ufw in Ubuntu. https://bugs.launchpad.net/bugs/1823862 Title: disco:

[Touch-packages] [Bug 1823862] Re: disco: unable to enable ufw

2019-04-09 Thread Jamie Strandboge
FYI, I also tried the above with setting /etc/default/ufw to have IPV6=no and everything works fine (and the v6 rules are not added). -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ufw in Ubuntu.

[Touch-packages] [Bug 1823862] Re: disco: unable to enable ufw

2019-04-09 Thread Jamie Strandboge
You said that the swift charm is disabling ipv6 in certain situations. Is it updating /etc/default/ufw? Is it disabling it elsewhere? In the failing instance, before trying to setup swift or run ufw or anything, what is the output of 'sudo /usr/share/ufw/check-requirements'? -- You received this

[Touch-packages] [Bug 1823862] Re: disco: unable to enable ufw

2019-04-09 Thread Jamie Strandboge
The usefulness of the policy aside (it is configured wide open), I still can't reproduce with http://cdimage.ubuntu.com/ubuntu- server/daily/current/disco-server-amd64.iso that I just downloaded: $ sudo ufw default allow incoming Default incoming policy changed to 'allow' (be sure to update your

[Touch-packages] [Bug 1823862] Re: disco: unable to enable ufw

2019-04-09 Thread Jamie Strandboge
t; Incomplete ** Changed in: ufw (Ubuntu) Assignee: (unassigned) => Jamie Strandboge (jdstrand) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ufw in Ubuntu. https://bugs.launchpad.net/bugs/1823862 Title: disco:

[Touch-packages] [Bug 1811129] Re: update ufw to 0.36

2019-03-28 Thread Jamie Strandboge
I've verified this on cosmic using a combination of test-ufw.py from QRT (which in addition to various smoke/etc tests, runs all the tests in the testsuite, including root/iptables tests): ufw: Installed: 0.36-0ubuntu0.18.10.1 Candidate: 0.36-0ubuntu0.18.10.1 Version table: ***

[Touch-packages] [Bug 1811129] Re: update ufw to 0.36

2019-03-28 Thread Jamie Strandboge
I've verified this on bionic using a combination of test-ufw.py from QRT (which in addition to various smoke/etc tests, runs all the tests in the testsuite, including root/iptables tests): ufw: Installed: 0.36-0ubuntu0.18.04.1 Candidate: 0.36-0ubuntu0.18.04.1 Version table: ***

[Touch-packages] [Bug 1368411] Re: Cannot insert IPV6 rule before IPV4 rules

2019-03-28 Thread Jamie Strandboge
Tested this is fixed in cosmic: $ apt-cache policy ufw ufw: Installed: 0.36-0ubuntu0.18.10.1 Candidate: 0.36-0ubuntu0.18.10.1 Version table: *** 0.36-0ubuntu0.18.10.1 500 500 http://us.archive.ubuntu.com/ubuntu cosmic-proposed/main amd64 Packages 500

[Touch-packages] [Bug 1368411] Re: Cannot insert IPV6 rule before IPV4 rules

2019-03-28 Thread Jamie Strandboge
Verified this is fixed in bionic: $ apt-cache policy ufw ufw: Installed: 0.36-0ubuntu0.18.04.1 Candidate: 0.36-0ubuntu0.18.04.1 Version table: *** 0.36-0ubuntu0.18.04.1 500 500 http://us.archive.ubuntu.com/ubuntu bionic-proposed/main amd64 Packages 500

[Touch-packages] [Bug 1204579] Re: ufw doesn't support concurrent updates

2019-03-28 Thread Jamie Strandboge
Verified this is fixed in bionic: $ apt-cache policy ufw ufw: Installed: 0.36-0ubuntu0.18.04.1 Candidate: 0.36-0ubuntu0.18.04.1 Version table: *** 0.36-0ubuntu0.18.04.1 500 500 http://us.archive.ubuntu.com/ubuntu bionic-proposed/main amd64 Packages 500

[Touch-packages] [Bug 1204579] Re: ufw doesn't support concurrent updates

2019-03-28 Thread Jamie Strandboge
Tested this is fixed in cosmic: $ apt-cache policy ufw ufw: Installed: 0.36-0ubuntu0.18.10.1 Candidate: 0.36-0ubuntu0.18.10.1 Version table: *** 0.36-0ubuntu0.18.10.1 500 500 http://us.archive.ubuntu.com/ubuntu cosmic-proposed/main amd64 Packages 500

[Touch-packages] [Bug 1775043] Re: bash completion not working: uses deprecated have()

2019-03-28 Thread Jamie Strandboge
Tested this is fixed in cosmic: $ apt-cache policy ufw ufw: Installed: 0.36-0ubuntu0.18.10.1 Candidate: 0.36-0ubuntu0.18.10.1 Version table: *** 0.36-0ubuntu0.18.10.1 500 500 http://us.archive.ubuntu.com/ubuntu cosmic-proposed/main amd64 Packages 500

[Touch-packages] [Bug 1775043] Re: bash completion not working: uses deprecated have()

2019-03-28 Thread Jamie Strandboge
Verified this is fixed in bionic: $ apt-cache policy ufw ufw: Installed: 0.36-0ubuntu0.18.04.1 Candidate: 0.36-0ubuntu0.18.04.1 Version table: *** 0.36-0ubuntu0.18.04.1 500 500 http://us.archive.ubuntu.com/ubuntu bionic-proposed/main amd64 Packages 500

[Touch-packages] [Bug 1719211] Re: Bad interface name

2019-03-28 Thread Jamie Strandboge
Verified this is fixed in bionic: $ apt-cache policy ufw ufw: Installed: 0.36-0ubuntu0.18.04.1 Candidate: 0.36-0ubuntu0.18.04.1 Version table: *** 0.36-0ubuntu0.18.04.1 500 500 http://us.archive.ubuntu.com/ubuntu bionic-proposed/main amd64 Packages 500

[Touch-packages] [Bug 1664133] Re: ipv6 multicast pings don't return

2019-03-28 Thread Jamie Strandboge
Verified this is fixed in bionic: $ apt-cache policy ufw ufw: Installed: 0.36-0ubuntu0.18.04.1 Candidate: 0.36-0ubuntu0.18.04.1 Version table: *** 0.36-0ubuntu0.18.04.1 500 500 http://us.archive.ubuntu.com/ubuntu bionic-proposed/main amd64 Packages 500

[Touch-packages] [Bug 1664133] Re: ipv6 multicast pings don't return

2019-03-28 Thread Jamie Strandboge
Tested this is fixed in cosmic: $ apt-cache policy ufw ufw: Installed: 0.36-0ubuntu0.18.10.1 Candidate: 0.36-0ubuntu0.18.10.1 Version table: *** 0.36-0ubuntu0.18.10.1 500 500 http://us.archive.ubuntu.com/ubuntu cosmic-proposed/main amd64 Packages 500

[Touch-packages] [Bug 1719211] Re: Bad interface name

2019-03-28 Thread Jamie Strandboge
Tested this is fixed in cosmic: $ apt-cache policy ufw ufw: Installed: 0.36-0ubuntu0.18.10.1 Candidate: 0.36-0ubuntu0.18.10.1 Version table: *** 0.36-0ubuntu0.18.10.1 500 500 http://us.archive.ubuntu.com/ubuntu cosmic-proposed/main amd64 Packages 500

<    1   2   3   4   5   6   7   8   9   10   >