Public bug reported:

[ Impact ]

nslcd is (since 25.04) started by a systemd service, which puts the
daemon in its own mount namespace [1].

This prevents strictly-confined processes (like sshd or anything else
using PAM) from opening /run/nslcd/socket; here's a bit from the denial:

apparmor="DENIED" operation="connect" class="file" info="Failed name
lookup - disconnected path" error=-13 profile="/usr/bin/sshd"
name="run/nslcd/socket" comm="sshd-session" requested-mask="wr"
denied_mask="wr"

See [2] for upstream context.

[ Other Info ]

For now users of nslcd must include "flags=(attach_disconnected)" in
their apparmor profiles for any process that queries nslcd.

My apologies if this is a duplicate report; I don't see anything for
similar issues on the apparmor LP bugtracker.

[1] 
https://salsa.debian.org/debian/nss-pam-ldapd/-/commit/e2a3e5673bded992fe60d1457b1a5543e28719d4
[2] https://gitlab.com/apparmor/apparmor/-/work_items/125

** Affects: nss-pam-ldapd (Ubuntu)
     Importance: Undecided
         Status: New

** Description changed:

  [ Impact ]
  
  nslcd is (since 25.04) started by a systemd service, which puts the
  daemon in its own mount namespace [1].
  
  This prevents strictly-confined processes (like sshd or anything else
  using PAM) from opening /run/nslcd/socket; here's a bit from the denial:
  
  apparmor="DENIED" operation="connect" class="file" info="Failed name
  lookup - disconnected path" error=-13 profile="/usr/bin/sshd"
  name="run/nslcd/socket" comm="sshd-session" requested-mask="wr"
  denied_mask="wr"
  
  See [2] for upstream context.
  
  [ Other Info ]
  
  For now users of nslcd must include "flags=(attach_disconnected)" in
  their apparmor profiles for any process that queries nslcd.
  
+ My apologies if this is a duplicate report; I don't see anything for
+ similar issues on the apparmor LP bugtracker.
+ 
  [1] 
https://salsa.debian.org/debian/nss-pam-ldapd/-/commit/e2a3e5673bded992fe60d1457b1a5543e28719d4
  [2] https://gitlab.com/apparmor/apparmor/-/work_items/125

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167859

Title:
  AppArmor denials in 26.04 querying nslcd

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/nss-pam-ldapd/+bug/2167859/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to