** Changed in: apparmor (Ubuntu Stonking)
Status: In Progress => Fix Released
** Description changed:
- On Resolute, some coreutils commands provided by uutils attempt to read
- locale files under /usr/share/coreutils/locales/**, but the AppArmor
- base locale rules allow on `locale`, not the plural `locales` path.
+ [ Impact ]
- The current abstractions/base allows common locale paths such as
- `/usr/share/locale/** r,` and `/usr/share/**/locale/** r,`, but neither
- of these match, e.g., /usr/share/coreutils/locales/uucore/**. I will
- submit a PR upstream and SRU the changes once they've landed.
+ On 26.04 Resolute, uutils/uucore coreutils commands may read
+ localization files from `/usr/share/coreutils/locales/`. The shipped
+ AppArmor `abstractions/base` allows common singular locale paths such as
+ `/usr/share/**/locale/**`, but it does not match plural `locales` paths.
- The same locales denials were also observed when profiles executed
- uutils coreutils commands, e.g., under the `pollinate` profile with
- commands such as `mktemp`, `head`, `uname`, `cat`, and `touch`.
+ Affected users can see AppArmor read denials when confined profiles
+ execute uutils coreutils commands. The bug was reproduced with the `who`
+ profile, and similar denials were also observed under other profiles,
+ such as `pollinate`, when commands read uutils locales paths.
- Observed on:
- 26.04 Resolute
- apparmor 5.0.0~beta1-0ubuntu7
- coreutils 9.5-1ubuntu2+0.0.0~ubuntu25
- coreutils-from-uutils 0.0.0~ubuntu25
- rust-coreutils 0.8.0-0ubuntu3
- MGX VERA CX / Vera Rubin C2
+ The fix is ported from the upstream AppArmor base-abstraction change
+ from:
+
https://gitlab.com/apparmor/apparmor/-/commit/44a204dbc3790195a984415674b441a91d3b2fa9
- Reproduce:
+ The change to `abstractions/base` resolving this is:
+
+ ```
+ /usr/share/**/locale/** r,
+ ```
+
+ to:
+
+ ```
+ /usr/share/**/locale{,s}/** r,
+ ```
+
+ This covers `/usr/share/coreutils/locales/...` for profiles that include
+ `<abstractions/base>`.
+
+ [ Test Plan ]
+
+ These steps should be run on Ubuntu 26.04 Resolute with AppArmor enabled
+ and theu utils coreutils implementation installed.
+
+ A package with these changes is staged in the following PPA:
+ https://launchpad.net/~ks0/+archive/ubuntu/apparmor-lsusb-fix
+ Adding it:
+ sudo add-apt-repository ppa:ks0/apparmor-lsusb-fix
+ sudo apt update
+
+ 1. Reproduce the `who` denial with the release package:
+
+ ```
sudo dmesg -C
LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 who >/dev/null
sudo dmesg | grep
'apparmor="DENIED".*profile="who".*/usr/share/coreutils/locales'
+ ```
- Example denial with `who`:
- apparmor="DENIED" operation="open" class="file" profile="who"
name="/usr/share/coreutils/locales/uucore/en-US.ftl" comm="who"
requested_mask="r" denied_mask="r"
+ Expected: one or more denials for
+ `/usr/share/coreutils/locales/.../*.ftl`.
+
+ In place of `en_US.UTF-8`, you may also use any generated UTF-8 locale
+ that causes uutils commands to read files below
+ `/usr/share/coreutils/locales/`.
+
+ 2. Install `apparmor` version `5.0.0~beta1-0ubuntu7.1~ppa1` from the
+ PPA, or the corresponding version once in -proposed, then reload
+ AppArmor:
+
+ ```
+ apt-cache policy apparmor
+ sudo systemctl reload apparmor
+ sudo apparmor_parser -Q -K /etc/apparmor.d/who
+ ```
+
+ 3. Verify the `who` denial is gone:
+
+ ```
+ sudo dmesg -C
+ LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 who >/dev/null
+ sudo dmesg | grep
'apparmor="DENIED".*profile="who".*/usr/share/coreutils/locales'
+ ```
+
+ Expected: `grep` returns no matching denials.
+
+ 4. Run basic regression checks:
+
+ ```
+ who >/dev/null
+ who -a >/dev/null
+ sudo dmesg | grep 'apparmor="DENIED".*/usr/share/coreutils/locales' || true
+ ```
+
+ Expected: commands complete successfully and no new coreutils locale
+ denials are logged for profiles that include `<abstractions/base>`.
+
+ [ Where problems could occur ]
+
+ This changes the shared `abstractions/base` policy. If the rule is too
+ narrow, users will continue to see AppArmor denials for the uutils
+ `locales` files. If the rule is too broad, confined processes whose
+ profiles include `<abstractions/base>` can read under the plural
+ `locales` directory. This is a read-only rule.
+
+ [ Other Info ]
+
+ The upstream AppArmor task is Fix Released. 26.10 Stonking carries a
+ version of AppArmor which contain the upstream commits from which this
+ fix was derived, though it was still `In Progress` when this was
+ originally triaged. So marking this `Fix Released` for Stonking, while
+ an SRU is still needed for Resolute.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2158941
Title:
uutils coreutils locale reads blocked
To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/2158941/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
