Public bug reported:
When running an up-to-date precise system with a linux-image-generic-lts-raring
HWE kernel (linux 3.8),
the precise verion of apparmor will deny all attempts of apparmored apps to
call the block_suspend system call:
For example:
type=AVC msg=audit(XXXXXXXXXX.XXX:XXXXX): apparmor="DENIED" operation="capable"
parent=1 profile="/usr/sbin/cupsd" pid=1040 comm="cupsd" pid=1040 comm="cupsd"
capability=36 capname="block_suspend"
But it is also impossible to add block_suspend to the apparmor profiles,
because the AppArmor parser does not know about it:
Setting /usr/sbin/cupsd to enforce mode.
Warning from stdin (line 1): /sbin/apparmor_parser: cannot use or update
cache, disable, or force-complain via stdin
AppArmor parser error, in stdin line 24: Invalid capability block_suspend.
This seems to make it impossible to have apparmor not deny block
suspend when using an LTS HWE kernel.
This seems to be related to bug #1052098.
ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: apparmor 2.7.102-0ubuntu3.7
ProcVersionSignature: Ubuntu 3.8.0-25.37~precise1-generic 3.8.13
Uname: Linux 3.8.0-25-generic x86_64
ApportVersion: 2.0.1-0ubuntu17.3
Architecture: amd64
Date: Wed Jul 10 12:48:24 2013
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Release amd64
(20120425)
KernLog: Jul 10 12:34:08 gumdrop kernel: [580960.424225] SGI XFS with ACLs,
security attributes, realtime, large block/inode numbers, no debug enabled
MarkForUpload: True
ProcEnviron:
TERM=xterm
PATH=(custom, no user)
LANG=en_US.UTF-8
SHELL=/bin/bash
ProcKernelCmdline: BOOT_IMAGE=/@/boot/vmlinuz-3.8.0-25-generic
root=UUID=981723af-1da9-455d-b776-3a1e8885efde ro rootflags=subvol=@
SourcePackage: apparmor
UpgradeStatus: No upgrade log present (probably fresh install)
audit.log: Error: [Errno 13] Permission denied: '/var/log/audit/audit.log'
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug precise
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1199933
Title:
apparmor parser in precise does not support block_suspend capability
(needed for backported kernels)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1199933/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
