Public bug reported:
[Impact]
Profiles whose attachment pattern compiles to a differentially encoded
DFA never attach. The exec stays "unconfined", and because no conflict
is involved, nothing is audited.
Visible example: /etc/apparmor.d/firefox (from the apparmor package)
profile firefox
/{usr/lib/firefox{,-esr,-beta,-devedition,-nightly},opt/firefox}/firefox{,-esr,-bin}
flags=(unconfined) { userns, ... }
never attaches to /usr/lib/firefox/firefox-bin (Firefox .deb from
packages.mozilla.org). Firefox therefore runs unconfined and is moved to
unprivileged_userns, which denies CAP_SYS_ADMIN. Its content sandbox
loses user-namespace isolation:
apparmor="AUDIT" operation="userns_create" info="Userns create -
transitioning profile" profile="unconfined" comm="firefox-bin"
target="unprivileged_userns" execpath="/usr/lib/firefox/firefox-bin"
apparmor="DENIED" operation="capable" class="cap"
profile="unprivileged_userns" comm="firefox-bin" capability=21
capname="sys_admin"
ps -eo label,args shows "unconfined" for every firefox-bin process,
although "firefox (unconfined)" is loaded.
[Cause]
security/apparmor/match.c: leftmatch_fb(), used by aa_dfa_leftmatch()
and therefore by find_attach(), takes the default transition as
if (check[pos] == state)
state = next[pos];
else
state = def[state];
and moves on to the next input character. It does not handle
MATCH_FLAG_DIFF_ENCODE. match_char(), used by aa_dfa_match() for file
rules, does: for a diff-encoded state it follows def[state] and retries
the SAME character. apparmor_parser emits diff-encoded DFAs by default
whenever the kernel advertises policy/diff_encode (it does), so larger
attachment patterns end in a non-accepting state.
File rules are not affected, since they go through match_char(). Simple
attachments (plain paths, "/a/{b,c}/x", "/a/x{,-y}",
"/{,usr/}{,s}bin/unix_chkpwd") still attach. Larger or nested
alternations fail.
[Test case]
The attached aa-repro.sh (run as root) loads the firefox profile's
attachment pattern, relocated to a scratch directory, twice: once with
default options and once with "-O no-diff-encode". It then executes a
copy of dash under each path and prints /proc/$$/attr/current.
Expected:
enc -> repro_enc (unconfined)
noenc -> repro_noenc (unconfined)
Actual:
enc -> unconfined
noenc -> repro_noenc (unconfined)
The two profiles differ only in diff encoding. Reproduced on the stock
7.0.0-38-generic kernel (output attached as repro-
output-7.0.0-38-generic.txt). Further confirmation: Ubuntu's real
firefox profile does not attach, while a copy with the simpler
attachment /usr/lib/firefox/firefox{,-bin} does.
[Workarounds]
- Set "Optimize=no-diff-encode" in /etc/apparmor/parser.conf and reload all
profiles.
- Alternatively, add a local profile with a simpler attachment, e.g.
/usr/lib/firefox/firefox{,-bin}.
[Suggested fix - untested]
In leftmatch_fb(), compute the input byte first (c = equiv[(u8) *str++]
or (u8) *str++), then replace the open-coded transition with
match_char(state, def, base, next, check, c), as aa_dfa_match() does.
The is_loop() history and longest-left count logic should then be
reviewed for diff-encoded default chains.
Upstream report: https://gitlab.com/apparmor/apparmor-
kernel/-/work_items/8
[Environment]
Ubuntu 26.04.1 LTS (resolute)
linux-image-7.0.0-38-generic 7.0.0-38.38 (/proc/version_signature: Ubuntu
7.0.0-38.38-generic 7.0.14)
apparmor / libapparmor1 5.0.2-0ubuntu1~26.04.1
firefox 158.0.1~build1 (packages.mozilla.org)
/sys/kernel/security/apparmor/features/policy/diff_encode: yes
---
ProblemType: Bug
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: invarianz 1478 F.... wireplumber
/dev/snd/controlC1: invarianz 1478 F.... wireplumber
/dev/snd/seq: invarianz 1454 F.... pipewire
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
DistroRelease: Ubuntu 26.04
InstallationDate: Installed on 2026-06-27 (121 days ago)
InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
MachineType: LENOVO 30DH00H7GE
Package: linux (not installed)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=tmux-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic
root=UUID=3c69bedc-0154-4019-a8e3-99860442ddb8 ro quiet splash
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
RebootRequiredPkgs: Error: path contained symlinks.
Tags: resolute wayland-session
Uname: Linux 7.0.0-38-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin lxd plugdev sudo users
_MarkForUpload: True
dmi.bios.date: 03/21/2025
dmi.bios.release: 1.94
dmi.bios.vendor: LENOVO
dmi.bios.version: S08KT5EA
dmi.board.name: 1048
dmi.board.vendor: LENOVO
dmi.board.version: SDK0T08861 WIN 3305348596304
dmi.chassis.type: 3
dmi.chassis.vendor: LENOVO
dmi.chassis.version: None
dmi.ec.firmware.release: 1.12
dmi.modalias:
dmi:bvnLENOVO:bvrS08KT5EA:bd03/21/2025:br1.94:efr1.12:svnLENOVO:pn30DH00H7GE:pvrThinkStationP340:rvnLENOVO:rn1048:rvrSDK0T08861WIN3305348596304:cvnLENOVO:ct3:cvrNone:skuLENOVO_MT_30DH_BU_Think_FM_ThinkStationP340:pfaThinkStationP340:
dmi.product.family: ThinkStation P340
dmi.product.name: 30DH00H7GE
dmi.product.sku: LENOVO_MT_30DH_BU_Think_FM_ThinkStation P340
dmi.product.version: ThinkStation P340
dmi.sys.vendor: LENOVO
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: apport-collected resolute wayland-session
** Attachment added: "aa-repro.sh"
https://bugs.launchpad.net/bugs/2172229/+attachment/6012835/+files/aa-repro.sh
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172229
Title:
AppArmor: profile attachment fails for diff-encoded xmatch DFAs
(leftmatch_fb ignores MATCH_FLAG_DIFF_ENCODE) - firefox profile never
attaches
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172229/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
