Public bug reported: [ Impact ]
nslcd is (since 25.04) started by a systemd service, which puts the daemon in its own mount namespace [1]. This prevents strictly-confined processes (like sshd or anything else using PAM) from opening /run/nslcd/socket; here's a bit from the denial: apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="/usr/bin/sshd" name="run/nslcd/socket" comm="sshd-session" requested-mask="wr" denied_mask="wr" See [2] for upstream context. [ Other Info ] For now users of nslcd must include "flags=(attach_disconnected)" in their apparmor profiles for any process that queries nslcd. My apologies if this is a duplicate report; I don't see anything for similar issues on the apparmor LP bugtracker. [1] https://salsa.debian.org/debian/nss-pam-ldapd/-/commit/e2a3e5673bded992fe60d1457b1a5543e28719d4 [2] https://gitlab.com/apparmor/apparmor/-/work_items/125 ** Affects: nss-pam-ldapd (Ubuntu) Importance: Undecided Status: New ** Description changed: [ Impact ] nslcd is (since 25.04) started by a systemd service, which puts the daemon in its own mount namespace [1]. This prevents strictly-confined processes (like sshd or anything else using PAM) from opening /run/nslcd/socket; here's a bit from the denial: apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="/usr/bin/sshd" name="run/nslcd/socket" comm="sshd-session" requested-mask="wr" denied_mask="wr" See [2] for upstream context. [ Other Info ] For now users of nslcd must include "flags=(attach_disconnected)" in their apparmor profiles for any process that queries nslcd. + My apologies if this is a duplicate report; I don't see anything for + similar issues on the apparmor LP bugtracker. + [1] https://salsa.debian.org/debian/nss-pam-ldapd/-/commit/e2a3e5673bded992fe60d1457b1a5543e28719d4 [2] https://gitlab.com/apparmor/apparmor/-/work_items/125 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167859 Title: AppArmor denials in 26.04 querying nslcd To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/nss-pam-ldapd/+bug/2167859/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
