Public bug reported:
[ Impact ]
The AppArmor ‘linux-boot-prober’ profile is missing rules that its
sibling ‘os-prober’ profile has. On any system using LVM (LVM-based
dual-boot, thin volumes, or snapshots), the confined linux-boot-prober
is denied the operations it needs:
1. exec of /usr/sbin/lvm (via grub-probe's "vgs" call) is denied
"grub-probe: error: unknown filesystem"
2. dac_override capability needed by grub-mount to bind-mount the real /boot
into the probed tree is denied
"mount: .../boot: bind /boot failed"
As a result linux-boot-prober returns an empty result, so grub’s 30_os-
prober generates no menu entry for LVM-based OSes. Boot entries for
other LVM-based OSes are present right after install but disappear after
the next "update-grub", leaving those OSes unbootable from the GRUB
menu. Non-LVM systems are unaffected.
The current update adds the four missing rules to the linux-boot-prober
profile, mirroring the os-prober profile that already works correctly:
1. capability dac_override,
2. file /usr/sbin/lvm ix,
3. file /run/lock/lvm/* wk, and file /run/lvm/hints wk,
4. a mount rule covering the /boot bind-mount: mount options=(rw, nosuid,
nodev) -> /var/lib/os-prober/mount/{,**}
[ Test Plan ]
On an LVM-based VM with a second LVM-based OS or an LVM snapshot
present, and GRUB_DISABLE_OS_PROBER=false:
Before the fix, confirm the failure with the currently shipped profile:
$ sudo dmesg -C
$ sudo linux-boot-prober /dev/mapper/<other-lvm-lv> # prints nothing
$ sudo dmesg | grep -i 'apparmor.*DENIED'
Expected denials:
apparmor="DENIED" operation="exec" name="/usr/sbin/lvm"
comm="grub-probe" profile="linux-boot-prober"
apparmor="DENIED" operation="capable" capname="dac_override"
comm="grub-mount" profile="linux-boot-prober"
And confirm the entry vanishes:
$ sudo update-grub
$ sudo awk '/### BEGIN \/etc\/grub.d\/30_os-prober ###/,/### END
\/etc\/grub.d\/30_os-prober ###/' /boot/grub/grub.cfg # LVM OS entry missing
in os_prober section
Update the apparmor profile to add the rules above and rerun to observe no
AppArmor denials:
$ sudo nano /etc/apparmor.d/linux-boot-prober
- capability dac_read_search sys_admin,
+ capability dac_override dac_read_search sys_admin,
- mount options=(rw, nosuid, nodev) -> /var/lib/os-prober/mount/,
+ mount options=(rw, nosuid, nodev) -> /var/lib/os-prober/mount/{,**},
+ file /usr/sbin/lvm ix,
+ file /run/lock/lvm/* wk,
+ file /run/lvm/hints wk,
$ sudo apparmor_parser -r /etc/apparmor.d/linux-boot-prober
$ sudo systemctl reload apparmor.service
$ sudo dmesg -C
$ sudo linux-boot-prober /dev/mapper/<other-lvm-lv>
# prints a non-empty line
$ sudo dmesg | grep -i 'apparmor.*DENIED' # no linux-boot-prober denials
$ sudo update-grub
$ sudo awk '/### BEGIN \/etc\/grub.d\/30_os-prober ###/,/### END
\/etc\/grub.d\/30_os-prober ###/' /boot/grub/grub.cfg # LVM OS entry
present/persists in os_prober section
[ Where problems could occur ]
The change only grants additional permissions to the linux-boot-prober
profile and does not remove any existing rule. If any added rule were
too broad, the effect would be a wider confinement for linux-boot-prober
than strictly necessary. However as all four rules already exist and are
exercised by the sibling os-prober profile, wider impact is not
expected. A regression would most visibly show up as new AppArmor
denials for linux-boot-prober in dmesg, or as update-grub failing to
enumerate other OSes, both of which are covered by the test plan above.
There is no impact on any non-os-prober workload, since the profile only
attaches to /usr/bin/linux-boot-prober.
[ Other Info ]
The linux-boot-prober and os-prober profiles were both introduced in
AppArmor MR [0] to fix LP #2099811 (a Plucky unprivileged-userns
regression that made os-prober segfault). The os-prober profile was
authored with the LVM rules while linux-boot-prober profile was
validated against a system with no LVM, so the LVM rules were not added.
This SRU closes that gap by bringing linux-boot-prober in line with os-
prober.
Related bugs (for context and not fixed here): LP #1987679 and LP
#2155998 are related to an os-prober-side issue with LVM-based
snapshots. That os-prober defect is currently masked by this very
AppArmor gap. Once linux-boot-prober is unblocked it becomes observable
again and is tracked/fixed separately in the os-prober package.
[0] https://gitlab.com/apparmor/apparmor/-/merge_requests/1569/diffs
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Description changed:
[ Impact ]
The AppArmor ‘linux-boot-prober’ profile is missing rules that its
sibling ‘os-prober’ profile has. On any system using LVM (LVM-based
dual-boot, thin volumes, or snapshots), the confined linux-boot-prober
is denied the operations it needs:
1. exec of /usr/sbin/lvm (via grub-probe's "vgs" call) is denied
- "grub-probe: error: unknown filesystem"
+ "grub-probe: error: unknown filesystem"
2. dac_override capability needed by grub-mount to bind-mount the real /boot
into the probed tree is denied
- "mount: .../boot: bind /boot failed"
+ "mount: .../boot: bind /boot failed"
As a result linux-boot-prober returns an empty result, so grub’s 30_os-
prober generates no menu entry for LVM-based OSes. Boot entries for
other LVM-based OSes are present right after install but disappear after
the next "update-grub", leaving those OSes unbootable from the GRUB
menu. Non-LVM systems are unaffected.
The current update adds the four missing rules to the linux-boot-prober
profile, mirroring the os-prober profile that already works correctly:
1. capability dac_override,
2. file /usr/sbin/lvm ix,
3. file /run/lock/lvm/* wk, and file /run/lvm/hints wk,
- 4. a mount rule covering the /boot bind-mount
-
- This restores LVM-based OS detection under confinement.
+ 4. a mount rule covering the /boot bind-mount: mount options=(rw, nosuid,
nodev) -> /var/lib/os-prober/mount/{,**}
[ Test Plan ]
On an LVM-based VM with a second LVM-based OS or an LVM snapshot
present, and GRUB_DISABLE_OS_PROBER=false:
Before the fix, confirm the failure with the currently shipped profile:
- $ sudo dmesg -C
- $ sudo linux-boot-prober /dev/mapper/<other-lvm-lv> # prints nothing
- $ sudo dmesg | grep -i 'apparmor.*DENIED'
- Expected denials:
- apparmor="DENIED" operation="exec" name="/usr/sbin/lvm"
- comm="grub-probe" profile="linux-boot-prober"
- apparmor="DENIED" operation="capable" capname="dac_override"
- comm="grub-mount" profile="linux-boot-prober"
- And confirm the entry vanishes:
- $ sudo update-grub
- $ sudo awk '/### BEGIN \/etc\/grub.d\/30_os-prober ###/,/### END
\/etc\/grub.d\/30_os-prober ###/' /boot/grub/grub.cfg # LVM OS entry missing
in os_prober section
+ $ sudo dmesg -C
+ $ sudo linux-boot-prober /dev/mapper/<other-lvm-lv> # prints nothing
+ $ sudo dmesg | grep -i 'apparmor.*DENIED'
+ Expected denials:
+ apparmor="DENIED" operation="exec" name="/usr/sbin/lvm"
+ comm="grub-probe" profile="linux-boot-prober"
+ apparmor="DENIED" operation="capable" capname="dac_override"
+ comm="grub-mount" profile="linux-boot-prober"
+ And confirm the entry vanishes:
+ $ sudo update-grub
+ $ sudo awk '/### BEGIN \/etc\/grub.d\/30_os-prober ###/,/### END
\/etc\/grub.d\/30_os-prober ###/' /boot/grub/grub.cfg # LVM OS entry missing
in os_prober section
Update the apparmor profile to add the rules above and rerun to observe no
AppArmor denials:
- $ sudo nano /etc/apparmor.d/linux-boot-prober
-
- - capability dac_read_search sys_admin,
- + capability dac_override dac_read_search sys_admin,
+ $ sudo nano /etc/apparmor.d/linux-boot-prober
- - mount options=(rw, nosuid, nodev) -> /var/lib/os-prober/mount/,
- + mount options=(rw, nosuid, nodev) -> /var/lib/os-prober/mount/{,**},
+ - capability dac_read_search sys_admin,
+ + capability dac_override dac_read_search sys_admin,
- + file /usr/sbin/lvm ix,
- + file /run/lock/lvm/* wk,
- + file /run/lvm/hints wk,
+ - mount options=(rw, nosuid, nodev) -> /var/lib/os-prober/mount/,
+ + mount options=(rw, nosuid, nodev) -> /var/lib/os-prober/mount/{,**},
- $ sudo apparmor_parser -r /etc/apparmor.d/linux-boot-prober
- $ sudo systemctl reload apparmor.service
- $ sudo dmesg -C
- $ sudo linux-boot-prober /dev/mapper/<other-lvm-lv>
- # prints a non-empty line
- $ sudo dmesg | grep -i 'apparmor.*DENIED' # no linux-boot-prober denials
- $ sudo update-grub
- $ sudo awk '/### BEGIN \/etc\/grub.d\/30_os-prober ###/,/### END
\/etc\/grub.d\/30_os-prober ###/' /boot/grub/grub.cfg # LVM OS entry
present/persists in os_prober section
+ + file /usr/sbin/lvm ix,
+ + file /run/lock/lvm/* wk,
+ + file /run/lvm/hints wk,
+
+ $ sudo apparmor_parser -r /etc/apparmor.d/linux-boot-prober
+ $ sudo systemctl reload apparmor.service
+ $ sudo dmesg -C
+ $ sudo linux-boot-prober /dev/mapper/<other-lvm-lv>
+ # prints a non-empty line
+ $ sudo dmesg | grep -i 'apparmor.*DENIED' # no linux-boot-prober denials
+ $ sudo update-grub
+ $ sudo awk '/### BEGIN \/etc\/grub.d\/30_os-prober ###/,/### END
\/etc\/grub.d\/30_os-prober ###/' /boot/grub/grub.cfg # LVM OS entry
present/persists in os_prober section
[ Where problems could occur ]
The change only grants additional permissions to the linux-boot-prober
profile and does not remove any existing rule. If any added rule were
too broad, the effect would be a wider confinement for linux-boot-prober
than strictly necessary. However as all four rules already exist and are
exercised by the sibling os-prober profile, wider impact is not
expected. A regression would most visibly show up as new AppArmor
denials for linux-boot-prober in dmesg, or as update-grub failing to
enumerate other OSes, both of which are covered by the test plan above.
There is no impact on any non-os-prober workload, since the profile only
attaches to /usr/bin/linux-boot-prober.
[ Other Info ]
The linux-boot-prober and os-prober profiles were both introduced in
AppArmor MR [0] to fix LP #2099811 (a Plucky unprivileged-userns
regression that made os-prober segfault). The os-prober profile was
authored with the LVM rules while linux-boot-prober profile was
validated against a system with no LVM, so the LVM rules were not added.
This SRU closes that gap by bringing linux-boot-prober in line with os-
prober.
- * Related bugs (for context and not fixed here): LP #1987679 and LP
+ * Related bugs (for context and not fixed here): LP #1987679 and LP
#2155998 are related to an os-prober-side issue with LVM-based
snapshots. That os-prober defect is currently masked by this very
AppArmor gap. Once linux-boot-prober is unblocked it becomes observable
again and is tracked/fixed separately in the os-prober package.
[0] https://gitlab.com/apparmor/apparmor/-/merge_requests/1569/diffs
** Description changed:
[ Impact ]
The AppArmor ‘linux-boot-prober’ profile is missing rules that its
sibling ‘os-prober’ profile has. On any system using LVM (LVM-based
dual-boot, thin volumes, or snapshots), the confined linux-boot-prober
is denied the operations it needs:
1. exec of /usr/sbin/lvm (via grub-probe's "vgs" call) is denied
"grub-probe: error: unknown filesystem"
2. dac_override capability needed by grub-mount to bind-mount the real /boot
into the probed tree is denied
"mount: .../boot: bind /boot failed"
As a result linux-boot-prober returns an empty result, so grub’s 30_os-
prober generates no menu entry for LVM-based OSes. Boot entries for
other LVM-based OSes are present right after install but disappear after
the next "update-grub", leaving those OSes unbootable from the GRUB
menu. Non-LVM systems are unaffected.
The current update adds the four missing rules to the linux-boot-prober
profile, mirroring the os-prober profile that already works correctly:
1. capability dac_override,
2. file /usr/sbin/lvm ix,
3. file /run/lock/lvm/* wk, and file /run/lvm/hints wk,
4. a mount rule covering the /boot bind-mount: mount options=(rw, nosuid,
nodev) -> /var/lib/os-prober/mount/{,**}
[ Test Plan ]
On an LVM-based VM with a second LVM-based OS or an LVM snapshot
present, and GRUB_DISABLE_OS_PROBER=false:
Before the fix, confirm the failure with the currently shipped profile:
$ sudo dmesg -C
$ sudo linux-boot-prober /dev/mapper/<other-lvm-lv> # prints nothing
$ sudo dmesg | grep -i 'apparmor.*DENIED'
Expected denials:
apparmor="DENIED" operation="exec" name="/usr/sbin/lvm"
comm="grub-probe" profile="linux-boot-prober"
apparmor="DENIED" operation="capable" capname="dac_override"
comm="grub-mount" profile="linux-boot-prober"
And confirm the entry vanishes:
$ sudo update-grub
$ sudo awk '/### BEGIN \/etc\/grub.d\/30_os-prober ###/,/### END
\/etc\/grub.d\/30_os-prober ###/' /boot/grub/grub.cfg # LVM OS entry missing
in os_prober section
Update the apparmor profile to add the rules above and rerun to observe no
AppArmor denials:
$ sudo nano /etc/apparmor.d/linux-boot-prober
- capability dac_read_search sys_admin,
+ capability dac_override dac_read_search sys_admin,
- mount options=(rw, nosuid, nodev) -> /var/lib/os-prober/mount/,
+ mount options=(rw, nosuid, nodev) -> /var/lib/os-prober/mount/{,**},
+ file /usr/sbin/lvm ix,
+ file /run/lock/lvm/* wk,
+ file /run/lvm/hints wk,
$ sudo apparmor_parser -r /etc/apparmor.d/linux-boot-prober
$ sudo systemctl reload apparmor.service
$ sudo dmesg -C
$ sudo linux-boot-prober /dev/mapper/<other-lvm-lv>
# prints a non-empty line
$ sudo dmesg | grep -i 'apparmor.*DENIED' # no linux-boot-prober denials
$ sudo update-grub
$ sudo awk '/### BEGIN \/etc\/grub.d\/30_os-prober ###/,/### END
\/etc\/grub.d\/30_os-prober ###/' /boot/grub/grub.cfg # LVM OS entry
present/persists in os_prober section
[ Where problems could occur ]
The change only grants additional permissions to the linux-boot-prober
profile and does not remove any existing rule. If any added rule were
too broad, the effect would be a wider confinement for linux-boot-prober
than strictly necessary. However as all four rules already exist and are
exercised by the sibling os-prober profile, wider impact is not
expected. A regression would most visibly show up as new AppArmor
denials for linux-boot-prober in dmesg, or as update-grub failing to
enumerate other OSes, both of which are covered by the test plan above.
There is no impact on any non-os-prober workload, since the profile only
attaches to /usr/bin/linux-boot-prober.
[ Other Info ]
The linux-boot-prober and os-prober profiles were both introduced in
AppArmor MR [0] to fix LP #2099811 (a Plucky unprivileged-userns
regression that made os-prober segfault). The os-prober profile was
authored with the LVM rules while linux-boot-prober profile was
validated against a system with no LVM, so the LVM rules were not added.
This SRU closes that gap by bringing linux-boot-prober in line with os-
prober.
- * Related bugs (for context and not fixed here): LP #1987679 and LP
+ Related bugs (for context and not fixed here): LP #1987679 and LP
#2155998 are related to an os-prober-side issue with LVM-based
snapshots. That os-prober defect is currently masked by this very
AppArmor gap. Once linux-boot-prober is unblocked it becomes observable
again and is tracked/fixed separately in the os-prober package.
[0] https://gitlab.com/apparmor/apparmor/-/merge_requests/1569/diffs
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171055
Title:
linux-boot-prober profile missing LVM rules breaks LVM dual-
boot/snapshot detection
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2171055/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
