@hofstaettermait Good catch, the original fix indeed does not cover the
disconnected path case you referenced. I reproduced the failure and
confirmed attach_disconnected solves it, but AppArmor documents
unrestricted attach_disconnected as unsafe as it can introduce pathname
aliasing and unintended access. A narrower alternative is
`attach_disconnected.path=/att/ptp4l/`, with accompanying rules for
authorized paths under /att/ptp4l/, e.g., `/att/ptp4l/run/pmc.@{int}
rw,` in this case.This overlaps with #2150639 [1] which is a similar disconnected path case but involving a different socket, whose corresponding rule I believe would be `/att/ptp4l/run/systemd/journal/dev-log w,`(haven't verified this yet). I'm wondering if there are more sockets which require similar treatment and will investigate this; in the meantime, perhaps others more familiar with AppArmor and linuxptp can weigh in. [1] https://bugs.launchpad.net/ubuntu/+source/linuxptp/+bug/2150639 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2169218 Title: ptp4l AppArmor profile blocks system clock adjustment and pmc replies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linuxptp/+bug/2169218/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
