Public bug reported:
Hello,
Distro: Currently working on resolute, with a stonking chroot for building
packages.
Package: apparmor=5.0.0~beta1-0ubuntu7
The current sbuild profile for apparmor is:
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"
abi <abi/5.0>,
include <tunables/global>
profile sbuild /usr/bin/sbuild flags=(attach_disconnected mediate_deleted) {
allow all,
userns,
@{exec_path} mrix,
# override default pix, assumes allow all ix is at lower priority
/usr/bin/unshare ix,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/sbuild>
}
Contrary to the comment's statement, this is not allowing everything.
Indeed, when this profile is active, the whole apparmor stack is
traversed even if the operation will be allowed. While building
coreutils, it made me hit the aa_g_path_max = 2 * PATH_MAX; limit which
is generally 8192 (rm deep's test uses up to 10kB path names).
Since lsm.c precludes path_max modification, I initially planned on
unconfining the profile for real, but found out about the default_allow
tag which skips the whole evaluation stack.
Here is a suggested diff for sbuild profile.
It would be great to update it in resolute and onwards.
Bests,
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Patch added: "Patch for sbuild profile."
https://bugs.launchpad.net/bugs/2161302/+attachment/5984489/+files/apparmor_sbuild_profile.diff
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161302
Title:
sbuild profile is not equivalent to unconfined
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2161302/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
