[Touch-packages] [Bug 2058179] Re: Kernel 6.8 + zfs-2.2.2: copy_file_range Operation Not Supported

2024-04-19 Thread John Cabaj
** Changed in: zfs-linux (Ubuntu Noble) Status: Confirmed => In Progress ** Changed in: zfs-linux (Ubuntu Noble) Assignee: (unassigned) => John Cabaj (john-cabaj) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subs

[Touch-packages] [Bug 2062441] Re: Apparmor breaks Joplin Desktop

2024-04-19 Thread John Johansen
unfortunately Joplin is only shipped as an appimage for Linux. Which means we can not ship a profile for it by default that will allow it to use capabilities within the unprivileged user namespace that the electron embedded browser is attempting to use. This means that the user is required to

[Touch-packages] [Bug 2058179] Re: Kernel 6.8 + zfs-2.2.2: copy_file_range Operation Not Supported

2024-04-19 Thread John Cabaj
I've tested an initial version with the upstream patch and attached the debdiff here. Will work to get this uploaded. ** Patch added: "zfs-linux_2.2.2-0ubuntu9.debdiff" https://bugs.launchpad.net/ubuntu/+source/zfs-linux/+bug/2058179/+attachment/5767995/+files/zfs-linux_2.2.2-0ubuntu9.debdiff

[Touch-packages] [Bug 2061869] Re: Snaps unable to connect to network under linux-lowlatency 6.8.0-25.25.3

2024-04-16 Thread John Johansen
the kernel team is already rolling kernels with the fix for 2061851 but it is also building in https://launchpad.net/~apparmor- dev/+archive/ubuntu/apparmor-devel ppa -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor

[Touch-packages] [Bug 2061869] Re: Snaps unable to connect to network under linux-lowlatency 6.8.0-25.25.3

2024-04-16 Thread John Johansen
This is likely a dup of https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2061851 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2061869 Title: Snaps unable to

[Touch-packages] [Bug 2060810] Re: Wike does not run in Ubuntu 24.04 due to apparmor issue

2024-04-10 Thread John Johansen
More applications will be getting confinement, on an individual level I don't think it will be everything from debs. In this case its because it uses unprivileged user namespaces. Which is now being restricted and treated as a semi-privileged because it gives access to several privileged kernel

[Touch-packages] [Bug 2060810] Re: Wike does not run in Ubuntu 24.04 due to apparmor issue

2024-04-10 Thread John Johansen
There are vague plans, yes. The time line of it has not been scoped, but it would be something akin to what happens on macos when you try to run a downloaded application for the first time and you have to go into their security config to allow it. The application will still be "confined" but it

[Touch-packages] [Bug 2060767] Re: Foliate does not run in Ubuntu 24.04 due to apparmor issue

2024-04-10 Thread John Johansen
The fix has been merged upstream in https://gitlab.com/apparmor/apparmor/-/merge_requests/1209 it will be in the next release. ** Changed in: apparmor (Ubuntu) Status: New => Confirmed ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) -

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-03 Thread John Johansen
@arraybolt3 is correct. Both unshare and bwrap will not get a unconfined profile, as that allows for an arbitrary by-pass of the restriction. There is a potential solution in the works that will allow for bwrap and unshare to function as long as the child task does not require permissions but at

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-03 Thread John Johansen
@arraybolt3: Answer to your question. bwrap requires capabilities within the user namespace. unshare is a little more forgiving in that what it requires depends on the options passed but most of the options also require capabilities within the user namespace. The potential solution I mention is

[Touch-packages] [Bug 1597017] Re: mount rules grant excessive permissions

2024-04-03 Thread John Johansen
It is in the SRU queue and the current ETA is April 15 to land in the proposed pocket (archive proposed not security proposed ppa), there is a caveat that the recent xz backdoor has caused some "fun" on the archive side and could potentially cause some delays. -- You received this bug

[Touch-packages] [Bug 2060100] Re: denials from sshd in noble

2024-04-03 Thread John Johansen
Fixed by MR https://gitlab.com/apparmor/apparmor/-/merge_requests/1196 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2060100 Title: denials from sshd in noble Status

[Touch-packages] [Bug 2060100] [NEW] denials from sshd in noble

2024-04-03 Thread John Johansen
Public bug reported: 2024-03-27T00:10:28.929314-04:00 image-ubuntu64 kernel: audit: type=1400 audit(1711512628.920:155): apparmor="DENIED" operation="bind" class="net" profile="/usr/sbin/sshd" pid=1290 comm="sshd" family="unix" sock_type="stream" protocol=0 requested_mask="bind"

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-01 Thread John Johansen
We have an update of the firefox profile coming that supports the /opt/firefox/firefox location used as the default install for the firefox downloaded directly from mozilla.org If you are running firefox out of your home directory, that will not be directly supported and you will need to chose to

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-29 Thread John Johansen
@coeur-noir: Are you installing firefox to /opt/ as recommended or using it local in your user account? as for bwarp, maybe it is known to be problematic. It is allowed to run and to create a user namespace but it is denied all capabilities within the namespace. Can you run sudo dmesg |

[Touch-packages] [Bug 2058866] Re: proposed-migration for cups-browsed 2.0.0-0ubuntu8

2024-03-24 Thread John Johansen
So what I think is going on from a first pass look at this is that We are seeing a change in kernel behavior around exec. The 6.8 has a known change here, that doesn't normally trigger because unconfined is delegating access into the profile. However in the lxd case, unconfined can is not

[Touch-packages] [Bug 2058866] Re: proposed-migration for cups-browsed 2.0.0-0ubuntu8

2024-03-24 Thread John Johansen
Do we know if there is a difference in the kernel between the runs? The 2.0.0.0~0ubuntu3 autopackage run log I was pointed at was on a Linux 5.4.0-170-generic #188-Ubuntu Do we know what kernel that 2.0.0-0ubuntu7 is failing on? There was a change to when security checks were made in on the

[Touch-packages] [Bug 2058866] Re: proposed-migration for cups-browsed 2.0.0-0ubuntu8

2024-03-24 Thread John Johansen
** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2058866 Title: propo

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-18 Thread John Johansen
@ajg-charlbury: no apparmor beta3 has not landed in proposed yet, we are working on the upload now. firefox separately have added a bug fix that will detect when the user namespace/capabilities are denied and fallback without crashing but it disables the full sandbox. the apparmor-beta3 fix

[Touch-packages] [Bug 2058241] [NEW] [X570 AORUS ELITE, Realtek ALCS1200A, Black Line Out, Rear] Pulseaudio fails to detect card

2024-03-18 Thread John
Public bug reported: Audio is very crackly, choppy, and when converting videos, the videos end up the same. The system has a Realtek audio built in, but the driver shows Generic. Tried nearly all online fixes, none work but it seems many people have the same issue. Can someone help? ProblemType:

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-17 Thread John Johansen
@ajg-charlbury: yes, firefox we are well aware of the problem, the firefox profile has been tweaked for beta3 (landing this week) so that it should work with the new deb. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@arraybolt3: qutebrowser should be fixed in beta3 ** Changed in: qutebrowser (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) ** Changed in: qmapshack (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) ** Changed in: notepadqq (Ubuntu) Assignee: (unas

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@kc2bez: qmapshack should be fixed in beta3 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@kc2bez: I have been able to verify that privacybrowser is not working. However it is not due to the apparmor user namespace restrictions. I get the following segfault out of dmesg [ 1591.466016] privacybrowser[7743]: segfault at 8 ip 70bb4dd11ccc sp 7ffd5c6587e0 error 4 in

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@kc2bez: pageedit should be fixed in beta3 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@kc2bez: notepadqq should be fixed in beta3 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@kc2bez: there are no updated deb packages in the ppa for kiwix. the kiwix appimage worked for me. kiwix flatpak worked for me. I am not sure what you were seeing. But I we are going to need more information. ** Changed in: kiwix (Ubuntu) Status: Confirmed => Incomplete -- You

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
hi @vvaleryan-24, I have been able to replicate the crash you are seeing but it is not do to the user namespace restriction. The restrictions logging does not happen, and I can put it in an unconfined profile and it still doesn't help. From dmesg I find the following segfault [79854.520976]

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
this will be fixed in Beta ** Changed in: kchmviewer (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) ** Changed in: rssguard (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) ** Changed in: supercollider (Ubuntu) Assignee: (unassigned) => John

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
sorry this won't be fixed in Beta3 that note was for goldendict ** Changed in: gnome-packagekit (Ubuntu) Assignee: John Johansen (jjohansen) => (unassigned) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to appar

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
Will be fixed in Beta3 ** Changed in: goldendict-webengine (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/b

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
we will be fixed in Beta3 ** Changed in: gnome-packagekit (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/b

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
I have tested gnome-packagekit and it never trigger unprivileged user namespace mediation. Can you please provide more information on how you triggered it. ** Changed in: gnome-packagekit (Ubuntu) Status: Confirmed => Incomplete -- You received this bug notification because you are a

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
** Changed in: loupe (Ubuntu) Assignee: (unassigned) => Georgia Garcia (georgiag) ** Changed in: geary (Ubuntu) Assignee: (unassigned) => Georgia Garcia (georgiag) ** Changed in: firefox (Ubuntu) Assignee: (unassigned) => Georgia Garcia (georgiag) -- You received this bug

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
supercollider will work on current noble. Since it is using QTWebEngine it has a graceful fallback when capabilities within the user namespace are denied. supercollider will have a profile and be fixed in Beta3, so it doesn't even have to do the fallback. -- You received this bug notification

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
I have tried freecad and unprivileged user namespace restrictions are not the problem. freecad snap works, freecad ppa does not have a noble build yet but the mantic build can be made to work. freecad daily appimage: works freecad appimage: stable fails with mesa or qt errors depending on

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-15 Thread John Johansen
@sudipmuk loupe should be fixed in Beta3 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-15 Thread John Johansen
@eeickmeyer geary should be fixed in Beta3 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-15 Thread John Johansen
@guyster, @eldmannen+launchpad, @valeryan-24 Firefox dailies now have a work around, by detecting and disabling the user namespace. The proper fix that should allow firefox to still use the user namespace for its sandbox will land in Beta3, landing early next week. -- You received this bug

[Touch-packages] [Bug 2046477] Re: Enable unprivileged user namespace restrictions by default

2024-03-15 Thread John Johansen
@pitti: yes this intended. At this stage we are essentially enumerating the known users of unprivileged user namespaces. We can ship the profile for you or you are welcome to ship it. In the future this is going to gradually tighten, some of the "unconfined" profiles will be developed into real

[Touch-packages] [Bug 2046477] Re: Enable unprivileged user namespace restrictions by default

2024-03-15 Thread John Johansen
It solves several problems, but not all. With regard to unprivileged user namespace mediation it should fix - mscode - nautilis - devhelp - element-desktop - piphany - evolution - keybase - opam the element-desktop is still known to have some issues, which are on the snapd side. It

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-15 Thread John Johansen
@valeryan-24 ModuleNotFoundError: No module named 'imp'" says that your Gpodder issue is not related to this bug. You are missing a dependency the 'imp' module. If Gpodder is packaged it will need to add that as part of its install dependencies. -- You received this bug notification because you

[Touch-packages] [Bug 2056696] Re: All Snaps are denied the ability to use DBus for notifications and apptray indicators in KDE-based flavors

2024-03-15 Thread John Johansen
the plasmashell profile is necessary for it to work under unprivileged user namespace restrictions. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2056696 Title: All

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-14 Thread John Johansen
** Changed in: steam (Ubuntu) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation

[Touch-packages] [Bug 2056696] Re: All Snaps are denied the ability to use DBus for notifications and apptray indicators in KDE-based flavors

2024-03-14 Thread John Johansen
the rejects here are all from the snap.element-desktop.element-desktop profile. We will need to dig into that profiles permissions. If its getting all the right paths correct then I suspect the peer_label match might be the issue. -- You received this bug notification because you are a member of

[Touch-packages] [Bug 2057943] Re: Can't disable or modify snap package apparmor rules

2024-03-14 Thread John Johansen
If you are admin of your system, you can manually replace snap profiles. But there are some caveats in that snapd doesn't really want this. It manages its profiles, dynamically regenerates and replaces them etc. You are correct that the tooling doesn't work here. It expects the abstractions to be

[Touch-packages] [Bug 2056739] Re: apparmor="DENIED" operation="open" class="file" profile="virt-aa-helper" name="/etc/gnutls/config"

2024-03-12 Thread John Johansen
Yes, will do I added both reference you provided to the upstream merge commit and all fixes/closes references will be going into the changelog. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 2039294] Re: apparmor docker

2024-03-11 Thread John Johansen
@gvarouchas, you need to be more specific. There are a couple interrelated issues in this bug. What is the exact Denial message you are getting. The will look something like the denial messages in comment 5. You can find them using sudo dmesg | grep DENIED or journalctl -g apparmor -- You

[Touch-packages] [Bug 2056517] Re: VS Code profile still broken.

2024-03-10 Thread John Johansen
This is now moving forward and should show up in proposed soon. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2056517 Title: VS Code profile still broken. Status in

[Touch-packages] [Bug 2056517] Re: vsode profile still broken

2024-03-08 Thread John Johansen
I won't promise we will get to fixing PHPStorm or Jetbrains before release, but without a bug they certainly won't get fixed, so yes it is worth filing a bug for them. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor

[Touch-packages] [Bug 2056517] Re: vsode profile still broken

2024-03-08 Thread John Johansen
The fix for vscode is currently in apparmor 4.0.0-beta2-0ubuntu3 pending a Feature Freeze exception. If the feature freeze exception is not granted then the fix will be moved to a bug patch on the current apparmor 4.0.0-alpha4 Atm the fix is available via ppa https://launchpad.net/~apparmor-

[Touch-packages] [Bug 2056496] Re: [FFe] AppArmor 4.0-beta2 + prompting support for noble

2024-03-07 Thread John Johansen
** Description changed: AppArmor 4.0-beta2 contains fixes that prevented AppArmor 4.0-beta1 from landing pre feature freeze. Landing AppArmor 4.0-beta's will enable us to more easily track upstream bug fixes, and is needed to support network rules in prompting. The addition of the

[Touch-packages] [Bug 2056496] Re: [FFe] AppArmor 4.0-beta2 + prompting support for noble

2024-03-07 Thread John Johansen
** Description changed: AppArmor 4.0-beta2 contains fixes that prevented AppArmor 4.0-beta1 from landing pre feature freeze. Landing AppArmor 4.0-beta's will enable us to more easily track upstream bug fixes, and is needed to support network rules in prompting. The addition of the

[Touch-packages] [Bug 2056496] [NEW] [FFe] AppArmor 4.0-beta2 + prompting support for noble

2024-03-07 Thread John Johansen
Public bug reported: AppArmor 4.0-beta2 contains fixes that prevented AppArmor 4.0-beta1 from landing pre feature freeze. Landing AppArmor 4.0-beta's will enable us to more easily track upstream bug fixes, and is needed to support network rules in prompting. The addition of the prompting patch

[Touch-packages] [Bug 2056496] Re: [FFe] AppArmor 4.0-beta2 + prompting support for noble

2024-03-07 Thread John Johansen
Captured output of QRT test run on updated noble using Linux 6.8.0-11-generic #11-Ubuntu kernel and 4.0.0~beta2-0ubuntu3 ** Attachment added: "Captured output of QRT test run" https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2056496/+attachment/5753923/+files/qrt.output -- You

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-06 Thread John Johansen
@scarlet I think it is fair to mark these as Fixed released as they are part of apparmor-alpha4 that is in noble. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2046844

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-06 Thread John Johansen
This is part of the apparmor alpha4 release in noble ** Changed in: plasma-desktop (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-06 Thread John Johansen
This is part of the alpha4 release in noble ** Changed in: kdeplasma-addons (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-06 Thread Dimitri John Ledkov
** Also affects: firefox (Ubuntu) Importance: Undecided Status: New ** Changed in: firefox (Ubuntu) Milestone: None => ubuntu-24.04 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 2055426] [NEW] busybox wget with https crashes

2024-02-29 Thread Dimitri John Ledkov
Public bug reported: $ busybox wget https://start.ubuntu.com Floating point exception (core dumped) ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: busybox (not installed) ProcVersionSignature: Ubuntu 6.8.0-11.11-generic 6.8.0-rc4 Uname: Linux 6.8.0-11-generic x86_64 NonfreeKernelModules:

[Touch-packages] [Bug 1833322] Re: Please consider no more having irqbalance enabled by default (per image/use-case/TBD)

2024-02-19 Thread John Chittum
Proxying a few comments I've heard from cloud partners about uses: There are some big companies, particularly in the streaming media and encoding business heavily using irqbalance. _however_ our consideration is about irqbalance enabled by default. They do heavy tuning, not running stock values.

[Touch-packages] [Bug 2052489] Re: Mate Daily Graphic Layer does not come up - apparmor denied snap desktop integration

2024-02-18 Thread John Johansen
Changed apparmor task to invalid as lightdm is broken with apparmor disabled (apparmor=0). We can change status if apparmor is a problem after the current lightdm issue is fixed. ** Changed in: apparmor (Ubuntu) Status: Confirmed => Invalid -- You received this bug notification because

[Touch-packages] [Bug 2051572] Re: Always preseed core and snapd snap in server seed

2024-02-16 Thread John Chittum
Based on the data, I'm in the "No" camp as well. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ubuntu-meta in Ubuntu. https://bugs.launchpad.net/bugs/2051572 Title: Always preseed core and snapd snap in server seed

[Touch-packages] [Bug 2051572] Re: Always preseed core and snapd snap in server seed

2024-02-15 Thread John Chittum
I agree with vorlon in general. It is a bit odd to not be seeding snapd by default, since snaps are a recognized package format. preseeding snapd will bring in its base, but there's no guarantee that base will match any other snaps. Flip side is that somewhere back in history, it was decided that

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-15 Thread John Johansen
** Changed in: steam (Ubuntu) Status: Confirmed => Fix Committed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-14 Thread John Johansen
So appimages are interesting. They don't all need a profile. I have run several that are not using user namespaces, or only need to be able to create the user namespace and don't need capabilities so the default unpriviled_userns profile works for them. It is applications that need privileges

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-13 Thread John Johansen
Erich, yes the archive version is based on the ppa, with a couple small fixes in the packaging. The ppa is going to get updated based the new archive version + a few more patches. Do you have some higher priority electron apps that you can point us at. We will look into the Visual Studo and

[Touch-packages] [Bug 1117804] Re: ausearch doesn't show AppArmor denial messages

2024-02-09 Thread John Johansen
responding to @intrigeri (sorry this got lost some how). tldr: yes we are basically on the same page. AppArmor does not fit into the 1400 range formats, every one of our messages have some custom fields. Some of them could be reformated/reworked to share more, but we would still need custom

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-08 Thread John Johansen
One more addition, the current state of how unconfined deals with unprivileged user namespaces is a temporary limitation. The afore mentioned improvement will allow for more customization at the policy level. The current fixed behavior will be the default. -- You received this bug notification

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-08 Thread John Johansen
So the answer is it depends on how they are using unprivileged user namespaces and how they react to them being denied, not every application needs to patched separately. Generally speaking gnome has been better tested than KDE had because gnome being the Ubuntu default saw a lot more opt in

[Touch-packages] [Bug 2052558] [NEW] prompting does not allow userspace to specify the execmode or target profile

2024-02-06 Thread John Johansen
Public bug reported: Currently the prompting interface does not allow userspace to specify the execmode to use, even if there is no matching exec rule in policy (case caused by prompt flag). Nor does it allow specifying the target profile (needed for certain exec modes). It also does not allow

[Touch-packages] [Bug 2052557] [NEW] EXEC_MODE under prompting does not do profile transitions correctly

2024-02-06 Thread John Johansen
Public bug reported: When a prompt rule that specifies an exec transition. The transition is not handled correctly in several cases. Resulting in denials even if the prompt is allowed. When prompting is triggered by the prompt flag, the behavior depends if an exec rule is matched (behavior

[Touch-packages] [Bug 2052489] Re: Mate Daily Graphic Layer does not come up - apparmor denied snap desktop integration

2024-02-05 Thread John Johansen
Note: snap now vendors apparmor so reinstalling/removing the system apparmor package with not affect snapd's use of apparmor. You can temporarily (for the boot) disable apparmor in the grub command line by adding apparmor=0 to the kernel parameters. >From the logs the following adjustments need

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-02 Thread John Johansen
We have found that allowing the user namespace creation, and then denying capabilities is in general handled much better by KDE. The the case of the plasmashell and the browswer widget denying the creation of the user namespace would cause a crash with a SIGTRAP backtrace, where allowing the

[Touch-packages] [Bug 2051454] Re: pipewire wireplumber can not detect the sound output device when using an unofficial linux kernel

2024-01-28 Thread John Johansen
A slightly revised version of this kernel should be showing up in the Ubuntu unstable kernel builds this week. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2051454

[Touch-packages] [Bug 2046624] Re: apparmor breaks surfshark vpn

2024-01-22 Thread John Johansen
*** This bug is a duplicate of bug 2046844 *** https://bugs.launchpad.net/bugs/2046844 The surfshark profile has been uploaded to the https://launchpad.net/~apparmor-dev/+archive/ubuntu/unprivileged-userns ppa for testing -- You received this bug notification because you are a member of

[Touch-packages] [Bug 2047343] Re: The steam profile in 4.0.0~alpha2-0ubuntu7 does not support steam installed by steam-installer package

2024-01-22 Thread John Johansen
the adjusted steam profile has been uploaded to https://launchpad.net/~apparmor-dev/+archive/ubuntu/unprivileged-userns ppa for testing -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-01-22 Thread John Johansen
Sorry for the delay on this, we had some bugs to chase down. The following PPA has an update to how user namespace mediation is being handled. For the unconfined case there are two options 1. If the unprivileged_userns profile does not exist, unprivileged user namespace creation is denied as

[Touch-packages] [Bug 2046477] Re: Enable unprivileged user namespace restrictions by default

2024-01-11 Thread John Johansen
We will get this updated with requested information soon. We are currently working on a revision that provides more flexibility and will support some cases that break today. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to

[Touch-packages] [Bug 2037604] Re: Backport packages for 22.04.4 HWE stack

2024-01-09 Thread Dimitri John Ledkov
i guess rebuilding gnome snaps with proposed on arm64 and testing that new gnome snap on mantic for pi5 & x1s would help. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to mesa in Ubuntu. https://bugs.launchpad.net/bugs/2037604

[Touch-packages] [Bug 2047343] Re: The steam profile in 4.0.0~alpha2-0ubuntu7 does not support steam installed by steam-installer package

2024-01-02 Thread John Johansen
The following profile worked for me, if it works for you I will get it uploaded asap. You can just drop it in a file and do sudo apparmor_parser -r /path/to/your/file to test it. # This profile allows everything and only exists to give the # application a name instead of having the label

[Touch-packages] [Bug 2046477] Re: Enable unprivileged user namespace restrictions by default

2024-01-02 Thread Dimitri John Ledkov
Can you please explain how all of this is handled during dist-upgrades? Have all the packages with affected profiles have versioned depends added? Is the featured _not_ turned on during dist-upgrade from jammy hwe to noble, but only after reboot? (as the kernel is compatible, yet during upgrade

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-28 Thread John Johansen
kdeplasma should be a fairly easy fix without prompting. I'll work on a profile for it and its add-ons -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title:

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-26 Thread John Johansen
There is another improvement coming before prompt that may (it will depend on the sandbox) also take care of many of the browser sandbox issues, as well as a few other uses of unprivileged user namespaces. On user namespace creation we will be able to transition the profile to a new profile with a

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-21 Thread John Johansen
Agreed we can't ask for a user to create a profile for every application, apparmor profiles can be shared, and having a generic profile that can be opted into makes sense. We are working towards it, this is just the first iteration. One of the things we are working on is abstracting what the

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-20 Thread John Johansen
RE: security.apparmor attribute attachment not working Sorry for the current version of apparmor in Ubuntu requires a path attachment as well, you need to change the profile to (caveat untested so I may have made another mistake too) profile falkon /** xattrs=(security.apparmor=falkon)

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-20 Thread John Johansen
Unfortunately it has to be a privileged operation, otherwise any application could set the attribute and then have access to user namespaces. The problem with unprivileged user namespaces is that it makes privileged interfaces available to the user in ways that they weren't designed for, leading

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-19 Thread John Johansen
It does work for AppImages, but it is weird in that they don't have an install location, so that has to be adjusted for where they are placed on the system, or we have to set a security xattr on the executable at the time it is chmoded to +x Admittedly orcaslicer doesn't use unprivileged user

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-19 Thread John Johansen
Yes it is known that Electron based apps are broken by this, it is unfortunate but there is no getting around it if we are going to tighten security around unprivileged user namespaces. As for apps that we don't specifically support (Electron or otherwise), we are still adding profiles for as

[Touch-packages] [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-19 Thread John Johansen
Hey Aaron, yes there are many packages that now require an apparmor profile. There is a shortcut, in between profile that can be used atm so that a full profile doesn't need to be developed to get applications that require unprivileged user namespaces working. I will get a patch together to add

[Touch-packages] [Bug 2046624] Re: apparmor breaks surfshark vpn

2023-12-17 Thread John Johansen
Also for others that might find this bug, there is documentation around userns mediation in the apparmor wiki https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is

[Touch-packages] [Bug 2046624] Re: apparmor breaks surfshark vpn

2023-12-17 Thread John Johansen
@1fallen did you can you update this bug with the exact profile you used so we can add it to the set of profiles that is being installed by default. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 2046624] Re: apparmor breaks surfshark vpn

2023-12-16 Thread John Johansen
Can you include the output of sudo dmesg | grep DENIED -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2046624 Title: apparmor breaks surfshark vpn Status in apparmor

[Touch-packages] [Bug 2045586] Re: livecd-rootfs uses losetup -P for theoretically reliable/synchronous partition setup but it's not reliable in noble

2023-12-11 Thread Dimitri John Ledkov
my expectation is that udev should be running (somewhere, not sure if it needs to be both the host and the lxd guest) and that it should process the device using locks https://systemd.io/BLOCK_DEVICE_LOCKING/. After that is done, the device should be safe to operate on, in a consistent manner.

[Touch-packages] [Bug 1813581] Re: gpgme1.0 ftbfs in 18.04 LTS

2023-11-30 Thread Dimitri John Ledkov
can you please move such updates into esm-proposed instead? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to gpgme1.0 in Ubuntu. https://bugs.launchpad.net/bugs/1813581 Title: gpgme1.0 ftbfs in 18.04 LTS Status in gpgme1.0

[Touch-packages] [Bug 1801762] Re: Dual-signed things should be easy to verify with one key

2023-11-29 Thread Dimitri John Ledkov
** Changed in: ubuntu-keyring (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ubuntu-keyring in Ubuntu. https://bugs.launchpad.net/bugs/1801762 Title: Dual-signed things should be

[Touch-packages] [Bug 1437209] Re: package ubuntu-keyring 2012.05.19 failed to install/upgrade: subprocess installed post-installation script returned error exit status 2

2023-11-27 Thread Dimitri John Ledkov
something is wrong with your install gpg: keyblock resource `/etc/apt/trusted.gpg.d/webupd8team-sublime-text-2.gpg': resource limit gpg: keyblock resource `/etc/apt/trusted.gpg.d/webupd8team-sublime-text-3.gpg': resource limit gpg: keyblock resource

[Touch-packages] [Bug 1060349] Re: package ubuntu-keyring 2011.11.21.1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 2

2023-11-27 Thread Dimitri John Ledkov
it seems maybe incompatible gnupg was installed on the system? gpg: fatal: /etc/apt/trustdb.gpg: invalid trustdb ** Changed in: ubuntu-keyring (Ubuntu) Status: Confirmed => Invalid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is

[Touch-packages] [Bug 1553673] Re: package ubuntu-keyring 2012.05.19 failed to install/upgrade: el subproceso instalado el script post-installation devolvió el código de salida de error 2

2023-11-27 Thread Dimitri John Ledkov
Something is broken with these files: gpg: /etc/apt/trusted.gpg.d/webupd8team-y-ppa-manager.gpg: recurso de bloqueo de claves: límite de recurso gpg: /etc/apt/trusted.gpg.d/wine-wine-builds.gpg: recurso de bloqueo de claves: límite de recurso gpg: /etc/apt/trusted.gpg.d/yorba-ppa.gpg: recurso

[Touch-packages] [Bug 1897836] Re: package ubuntu-keyring 2012.05.19.1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2023-11-27 Thread Dimitri John Ledkov
something is wrong with your installation gpg: invalid key resource URL `/etc/apt/trusted.gpg.d/home:osmc.gpg' unrelated to this package ** Changed in: ubuntu-keyring (Ubuntu) Status: New => Won't Fix ** Changed in: ubuntu-keyring (Ubuntu) Status: Won't Fix => Invalid -- You

  1   2   3   4   5   6   7   8   9   10   >