** Description changed: [ Impact ] AppArmor generates noisy denial logs when launching an Ubuntu 24.04 image on Azure. The profile cloud-id lacks permission for cap perfmon, resulting in audit denials in system logs whenever cloud-id attempts to check process capability. The fix is to add capability perfmon, to the cloud_id AppArmor sub- profile. [ Test Plan ] On a system running the version without the fix (e.g., Ubuntu 24.04 on Azure), attach to Pro or run cloud-id directly. Check dmesg or journalctl -k and observe the AppArmor denial log: apparmor="DENIED" operation="capable" class="cap" profile="ubuntu_pro_esm_cache//cloud_id" ... capname="perfmon" Install the updated package from -proposed. Trigger cloud-id or re-attach to Pro. Check dmesg or journalctl -k and verify that no perfmon AppArmor denials are logged. [ Where problems could occur ] Adding to an AppArmor profile can bring the risk of allowing more than intended. To minimize the concern, capability perfmon is strictly granted to the cloud_id profile to allow capability checks required by system libraries without granting unnecessary file or process access. [ Other Info ] + + By the following SRU process, ubuntu-advantage-tools has an SRU + exception: + https://documentation.ubuntu.com/sru/en/latest/reference/exception- + UbuntuAdvantageTools-Updates Here is the original description of the bug: When launching an Ubuntu 24.04 image on Azure (Canonical:ubuntu-24_04-lts:server:latest) and attaching to Pro with a token the following Apparmor denied logs can be found in the system logs: 'May 20 18:35:32 ctf-pcnjpvzwjo kernel: audit: type=1400 audit(1779302132.079:126): apparmor="DENIED" operation="capable" class="cap" profile="ubuntu_pro_esm_cache//cloud_id" pid=3854 comm="cloud-id" capability=38 capname="perfmon"', 'May 20 18:36:37 ctf-pcnjpvzwjo kernel: audit: type=1400 audit(1779302197.373:128): apparmor="DENIED" operation="capable" class="cap" profile="ubuntu_pro_esm_cache//cloud_id" pid=4500 comm="cloud-id" capability=38 capname="perfmon"', 'May 20 18:37:24 ctf-pcnjpvzwjo kernel: audit: type=1400 audit(1779302244.581:130): apparmor="DENIED" operation="capable" class="cap" profile="ubuntu_pro_esm_cache//cloud_id" pid=5602 comm="cloud-id" capability=38 capname="perfmon"', 'May 20 18:37:50 ctf-pcnjpvzwjo kernel: audit: type=1400 audit(1779302270.751:132): apparmor="DENIED" operation="capable" class="cap" profile="ubuntu_pro_esm_cache//cloud_id" pid=6552 comm="cloud-id" capability=38 capname="perfmon"' There are other denied messages present but these have been omitted since they are covered by other bugs. This issue has been present for some time but for extra context the relevant package versions in the image I tested are: apparmor: 4.0.1really4.0.1-0ubuntu0.24.04.6 ubuntu-pro-client: 37.2ubuntu~24.04 [ Changelog ] ubuntu-advantage-tools (38ubuntu0) stonking; urgency=medium * d/apparmor: add cap perfmon to cloud_id AppArmor profile (LP: #2153472) * d/apparmor: add perfmon systemctl unix socket in AppArmor profiles (LP: #2143251) * d/apparmor: fix denied audit messages when devicetree exists (LP: #2131292) * d/apparmor: include PID directory in ubuntu_pro_esm_cache profile (GH: #3555) * d/apparmor: allow /usr/share/coreutils/locales/** in ubuntu_pro_esm_cache profile (GH: #3570) * New upstream release 38: - security: + fix CVE-2026-12391 + fix CVE-2026-11386 + fix CVE-2026-9494 - clouds: + add support for GCE Marketplace Pro licenses (GH: #3573) + add resolute GCP license IDs (GH: #3532) + map aws-gov to aws for correct FIPS flavor (LP: #2144693)
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2153472 Title: ubuntu_pro_esm_cache//cloud_id profile denied on Azure 24.04 images To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2153472/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
