[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Brian Murray]

Hello Martin, or anyone else affected,

Accepted ntp into artful-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/ntp/1:4.2.8p10+dfsg-
5ubuntu3.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-artful to verification-done-artful. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-artful. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance!

** Changed in: ntp (Ubuntu Artful)
   Status: In Progress => Fix Committed

** Tags added: verification-needed verification-needed-artful

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[ChristianEhrhardt]

Uploaded for the SRU team to evaluate

** Changed in: ntp (Ubuntu Artful)
   Status: Triaged => In Progress

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[ChristianEhrhardt]

** Description changed:

  [Impact]
  
   * NTP has new isolation features which makes it trigger apparmor issues.
-  * Those apparmor issues not only clutter the log and make other things 
-less readable, they also prevent ntp from reporting its actual 
-messages.
-  * Fix is opening the apparmor profile to follow ntp through the 
-disconnect by the isolation feature.
+  * Those apparmor issues not only clutter the log and make other things
+    less readable, they also prevent ntp from reporting its actual
+    messages.
+  * Fix is opening the apparmor profile to follow ntp through the
+    disconnect by the isolation feature.
  
  [Test Case]
  
   * This is hard to trigger, but then also not. Which means it is not
     entirely sorted out when it triggers and when not, but the following
     does trigger it in tests of Pitti and also mine (while at the same time
     sometimes it does not - mabye I had other guests or kvm instead of lxd)
  
   * First install ntp in Artful (or above unless fixed)
-    * Then you have to cause soemthing that ntp "needs" to complain about
-  in my case I had spawned more virtual guests and NTP failed to bind
-  on their virtual interface, but you could setup anything else that it
-  fails on after the initial start (there it passed over to private
-  TMP)
+    * Install ntp and check demsg for denies
     * Once an issue triggers instead of the error in syslog you'll see the
   apparmor Deny like:
     apparmor="DENIED" operation="sendmsg" info="Failed name lookup -
     disconnected path" error=-13 profile="/usr/sbin/ntpd"
     name="run/systemd/journal/dev-log" pid=5600 comm="ntpd"
     requested_mask="w" denied_mask="w" fsuid=0 ouid=0
  
  [Regression Potential]
  
   * We are slightly opening up the apparmor profile which is far lower risk
     than adding more constraints. So safe from that POV.
  
   * OTOH one could think this might be a security issue, but in fact this
     isn't a new suggestion if you take a look at [1] with an ack by Seth of
     the Security Team.
  
  [Other Info]
  
   * n/a
  
  [1]: https://lists.ubuntu.com/archives/apparmor/2015-May/007858.html
  
  
  
  Merely installing and starting ntp.service in Ubuntu 17.10 now causes
  this AppArmor violation:
  
  audit: type=1400 audit(1508915894.215:25): apparmor="DENIED"
  operation="sendmsg" info="Failed name lookup - disconnected path"
  error=-13 profile="/usr/sbin/ntpd" name="run/systemd/journal/dev-log"
  pid=5600 comm="ntpd" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
  
  (many times). This hasn't happened in earlier Ubuntu releases yet.
  
  This was spotted by Cockpit's integration tests, as our "ubuntu-stable"
  image now moved to 17.10 after its release.
  
  ProblemType: Bug
  DistroRelease: Ubuntu 17.10
  Package: ntp 1:4.2.8p10+dfsg-5ubuntu3
  ProcVersionSignature: Ubuntu 4.13.0-16.19-generic 4.13.4
  Uname: Linux 4.13.0-16-generic x86_64
  ApportVersion: 2.20.7-0ubuntu3
  Architecture: amd64
  Date: Wed Oct 25 03:19:34 2017
  SourcePackage: ntp
  UpgradeStatus: No upgrade log present (probably fresh install)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[ChristianEhrhardt]

Thanks Andreas, yes I see it nearly everywhere as well.
Also thanks to spot that I missed to uopdate impact - done.
Discussion on the MP going on ...

** Description changed:

  [Impact]
  
-  * An explanation of the effects of the bug on users and
- 
-  * justification for backporting the fix to the stable release.
- 
-  * In addition, it is helpful, but not required, to include an
-explanation of how the upload fixes this bug.
+  * NTP has new isolation features which makes it trigger apparmor issues.
+  * Those apparmor issues not only clutter the log and make other things 
+less readable, they also prevent ntp from reporting its actual 
+messages.
+  * Fix is opening the apparmor profile to follow ntp through the 
+disconnect by the isolation feature.
  
  [Test Case]
  
-  * This is hard to trigger, but then also not. Which means it is not 
-entirely sorted out when it triggers and when not, but the following 
-does trigger it in tests of Pitti and also mine (while at the same time 
-sometimes it does not - mabye I had other guests or kvm instead of lxd)
+  * This is hard to trigger, but then also not. Which means it is not
+    entirely sorted out when it triggers and when not, but the following
+    does trigger it in tests of Pitti and also mine (while at the same time
+    sometimes it does not - mabye I had other guests or kvm instead of lxd)
  
-  * First install ntp in Artful (or above unless fixed)
-* Then you have to cause soemthing that ntp "needs" to complain about
-  in my case I had spawned more virtual guests and NTP failed to bind 
-  on their virtual interface, but you could setup anything else that it 
-  fails on after the initial start (there it passed over to private 
-  TMP)
-* Once an issue triggers instead of the error in syslog you'll see the 
-  apparmor Deny like:
-apparmor="DENIED" operation="sendmsg" info="Failed name lookup - 
-disconnected path" error=-13 profile="/usr/sbin/ntpd" 
-name="run/systemd/journal/dev-log" pid=5600 comm="ntpd" 
-requested_mask="w" denied_mask="w" fsuid=0 ouid=0
+  * First install ntp in Artful (or above unless fixed)
+    * Then you have to cause soemthing that ntp "needs" to complain about
+  in my case I had spawned more virtual guests and NTP failed to bind
+  on their virtual interface, but you could setup anything else that it
+  fails on after the initial start (there it passed over to private
+  TMP)
+    * Once an issue triggers instead of the error in syslog you'll see the
+  apparmor Deny like:
+    apparmor="DENIED" operation="sendmsg" info="Failed name lookup -
+    disconnected path" error=-13 profile="/usr/sbin/ntpd"
+    name="run/systemd/journal/dev-log" pid=5600 comm="ntpd"
+    requested_mask="w" denied_mask="w" fsuid=0 ouid=0
  
  [Regression Potential]
  
-  * We are slightly opening up the apparmor profile which is far lower risk 
-than adding more constraints. So safe from that POV.
+  * We are slightly opening up the apparmor profile which is far lower risk
+    than adding more constraints. So safe from that POV.
  
-  * OTOH one could think this might be a security issue, but in fact this 
-isn't a new suggestion if you take a look at [1] with an ack by Seth of 
-the Security Team.
+  * OTOH one could think this might be a security issue, but in fact this
+    isn't a new suggestion if you take a look at [1] with an ack by Seth of
+    the Security Team.
  
  [Other Info]
-  
-  * n/a
+ 
+  * n/a
  
  [1]: https://lists.ubuntu.com/archives/apparmor/2015-May/007858.html
  
  
  
  Merely installing and starting ntp.service in Ubuntu 17.10 now causes
  this AppArmor violation:
  
  audit: type=1400 audit(1508915894.215:25): apparmor="DENIED"
  operation="sendmsg" info="Failed name lookup - disconnected path"
  error=-13 profile="/usr/sbin/ntpd" name="run/systemd/journal/dev-log"
  pid=5600 comm="ntpd" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
  
  (many times). This hasn't happened in earlier Ubuntu releases yet.
  
  This was spotted by Cockpit's integration tests, as our "ubuntu-stable"
  image now moved to 17.10 after its release.
  
  ProblemType: Bug
  DistroRelease: Ubuntu 17.10
  Package: ntp 1:4.2.8p10+dfsg-5ubuntu3
  ProcVersionSignature: Ubuntu 4.13.0-16.19-generic 4.13.4
  Uname: Linux 4.13.0-16-generic x86_64
  ApportVersion: 2.20.7-0ubuntu3
  Architecture: amd64
  Date: Wed Oct 25 03:19:34 2017
  SourcePackage: ntp
  UpgradeStatus: No upgrade log present (probably fresh install)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Andreas Hasenack]

fwiw, I can see the error in every reboot on my artful vm when it's
deployed with maas. I can also therefore verify the fix :)

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Andreas Hasenack]

fwiw, I can see the error in every reboot on my artful vm when it's
deployed with maas. I can also therefore verify the fix :)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Andreas Hasenack]

Can you please update the "[Impact]" section of this SRU?

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Andreas Hasenack]

Can you please update the "[Impact]" section of this SRU?

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Launchpad Bug Tracker]

** Merge proposal linked:
   https://code.launchpad.net/~paelzer/ubuntu/+source/ntp/+git/ntp/+merge/335314

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[ChristianEhrhardt]

** Description changed:

+ [Impact]
+ 
+  * An explanation of the effects of the bug on users and
+ 
+  * justification for backporting the fix to the stable release.
+ 
+  * In addition, it is helpful, but not required, to include an
+explanation of how the upload fixes this bug.
+ 
+ [Test Case]
+ 
+  * This is hard to trigger, but then also not. Which means it is not 
+entirely sorted out when it triggers and when not, but the following 
+does trigger it in tests of Pitti and also mine (while at the same time 
+sometimes it does not - mabye I had other guests or kvm instead of lxd)
+ 
+  * First install ntp in Artful (or above unless fixed)
+* Then you have to cause soemthing that ntp "needs" to complain about
+  in my case I had spawned more virtual guests and NTP failed to bind 
+  on their virtual interface, but you could setup anything else that it 
+  fails on after the initial start (there it passed over to private 
+  TMP)
+* Once an issue triggers instead of the error in syslog you'll see the 
+  apparmor Deny like:
+apparmor="DENIED" operation="sendmsg" info="Failed name lookup - 
+disconnected path" error=-13 profile="/usr/sbin/ntpd" 
+name="run/systemd/journal/dev-log" pid=5600 comm="ntpd" 
+requested_mask="w" denied_mask="w" fsuid=0 ouid=0
+ 
+ [Regression Potential]
+ 
+  * We are slightly opening up the apparmor profile which is far lower risk 
+than adding more constraints. So safe from that POV.
+ 
+  * OTOH one could think this might be a security issue, but in fact this 
+isn't a new suggestion if you take a look at [1] with an ack by Seth of 
+the Security Team.
+ 
+ [Other Info]
+  
+  * n/a
+ 
+ [1]: https://lists.ubuntu.com/archives/apparmor/2015-May/007858.html
+ 
+ 
+ 
  Merely installing and starting ntp.service in Ubuntu 17.10 now causes
  this AppArmor violation:
  
  audit: type=1400 audit(1508915894.215:25): apparmor="DENIED"
  operation="sendmsg" info="Failed name lookup - disconnected path"
  error=-13 profile="/usr/sbin/ntpd" name="run/systemd/journal/dev-log"
  pid=5600 comm="ntpd" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
- 
  
  (many times). This hasn't happened in earlier Ubuntu releases yet.
  
  This was spotted by Cockpit's integration tests, as our "ubuntu-stable"
  image now moved to 17.10 after its release.
  
  ProblemType: Bug
  DistroRelease: Ubuntu 17.10
  Package: ntp 1:4.2.8p10+dfsg-5ubuntu3
  ProcVersionSignature: Ubuntu 4.13.0-16.19-generic 4.13.4
  Uname: Linux 4.13.0-16-generic x86_64
  ApportVersion: 2.20.7-0ubuntu3
  Architecture: amd64
  Date: Wed Oct 25 03:19:34 2017
  SourcePackage: ntp
  UpgradeStatus: No upgrade log present (probably fresh install)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[ChristianEhrhardt]

The Bionic fix is about to complete now'ish.
Since this (if triggered) is effectively blocking the messages to appear in the 
syslog this can hide an arbitrary amount of further issues that the user then 
has next to no grasp on how to tackle.

So SRU worthy for Artful IMHO.
Adding template soon.

** Changed in: ntp (Ubuntu Artful)
   Status: Confirmed => Triaged

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Launchpad Bug Tracker]

This bug was fixed in the package ntp - 1:4.2.8p10+dfsg-5ubuntu4

---
ntp (1:4.2.8p10+dfsg-5ubuntu4) bionic; urgency=medium

  * debian/apparmor-profile: add attach_disconnected which is needed in some
cases to let ntp report its log messages (LP: #1727202).

 -- Christian Ehrhardt   Wed, 13 Dec
2017 16:31:30 +0100

** Changed in: ntp (Ubuntu Bionic)
   Status: Triaged => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Launchpad Bug Tracker]

Status changed to 'Confirmed' because the bug affects multiple users.

** Changed in: ntp (Ubuntu Artful)
   Status: New => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Martin Pitt]

Thanks Christian! Indeed this is rather hard to reproduce locally, but
that PR seems to address this. I'll let you know if it doesn't after it
lands.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[ChristianEhrhardt]

I was in discussion with Kurt Roeckx on NTPsec before and the NTPsec
folks as well but never had the time to continue - thanks you a lot for
packaging it up Richard. I subscribed myself to 819806.

Nice to hear that this will fix it for you as well!

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Richard Laager]

I'm seeing the same errors with NTPsec (a fork of this ntpd, which I
have packaged for Debian) on 16.04. The apparmor policy is copied from
this ntp package. I'm not able to reproduce the problem at will, but it
seems to happen regularly. The proposed change seems to have resolved
it.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[ChristianEhrhardt]

As expected I could solve the issue in a test via
flags=(attach_disconnected).

Although I had cases where the issue appeared and others where it never
showed up - didn't find the difference for that yet. Never the less the
fix will help the affected cases and should not break others.

The worst is that I found this to be hiding the actual error message.
In my case where I was seeing it ntp was "actually" complaining about bug 
1737998.
But I think atm most ntp errors might look like the apparmor deny which makes 
this a bit more severe than I thought at first.

Opened an MP for it at [1].

@Martin - do you test Debian as well and if you have apparmor enabled
there does it hit there as well? Just to know if you have a bug I could
post the fix on

@Martin - since I failed to see when it hits and when not - if you can
test from a ppa [2] (or modify the case to have the one line change) it
would be nice if you could confirm the fix. If you happen to see why it
only happens "sometimes" let me know.

[1]: 
https://code.launchpad.net/~paelzer/ubuntu/+source/ntp/+git/ntp/+merge/335147
[2]: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3080

** Changed in: ntp (Ubuntu Bionic)
   Importance: Undecided => Medium

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Launchpad Bug Tracker]

** Merge proposal linked:
   https://code.launchpad.net/~paelzer/ubuntu/+source/ntp/+git/ntp/+merge/335147

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[ChristianEhrhardt]

** Also affects: ntp (Ubuntu Artful)
   Importance: Undecided
   Status: New

** Also affects: ntp (Ubuntu Bionic)
   Importance: Undecided
   Status: Triaged

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[ChristianEhrhardt]

Thanks Martin, this was missed on triage so far, I ran by today and marked it 
for the team to look at.
Unfortunately have no cycles atm to fix is up right away.

** Tags added: server-next

** Changed in: ntp (Ubuntu)
   Status: Confirmed => Triaged

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1727202] Re: [17.10 regression] AppArmor denial: Failed name lookup - disconnected path

[Launchpad Bug Tracker]

Status changed to 'Confirmed' because the bug affects multiple users.

** Changed in: ntp (Ubuntu)
   Status: New => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1727202

Title:
  [17.10 regression] AppArmor denial: Failed name lookup - disconnected
  path

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1727202/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs