Public bug reported:
On a busy Noble host, the ubuntu_pro_esm_cache profile logs DENIED audit
messages for capability sys_resource every time the ESM cache job runs.
We counted 29 in the kernel log since 2026-10-22, from three processes:
python3 and apt-cache in ubuntu_pro_esm_cache, and cloud-id in
ubuntu_pro_esm_cache//cloud_id.
Example:
audit: type=1400 audit(1793386374.115:222): apparmor="DENIED"
operation="capable" class="cap" profile="ubuntu_pro_esm_cache"
pid=252514 comm="apt-cache" capability=24 capname="sys_resource"
Versions:
- Ubuntu 24.04, kernel 6.8.0-147-generic
- ubuntu-pro-client 37.2ubuntu~24.04.1
- apparmor 4.0.1really4.0.1-0ubuntu0.24.04.8
Cause:
The host runs many root-owned processes (about 60 containers), so root's pipe
buffer usage is above fs.pipe-user-pages-soft (16384, the default). When that
happens, the kernel checks CAP_SYS_RESOURCE and then CAP_SYS_ADMIN on every new
pipe (alloc_pipe_info and pipe_is_unprivileged_user in fs/pipe.c). The profile
allows neither, so each check is logged as a denial. The pipe is still created,
but with the minimum 2 pages instead of 16.
Steps to reproduce (on a host where root is over the soft limit):
$ sudo aa-exec -p ubuntu_pro_esm_cache -- python3 -I -c "import os,fcntl;
r,w=os.pipe(); print(fcntl.fcntl(r, 1032))"
8192
$ sudo python3 -I -c "import os,fcntl; r,w=os.pipe(); print(fcntl.fcntl(r,
1032))"
65536
The confined run logs:
apparmor="DENIED" operation="capable" class="cap"
profile="ubuntu_pro_esm_cache" pid=456311 comm="python3" capability=24
capname="sys_resource"
apparmor="DENIED" operation="capable" class="cap"
profile="ubuntu_pro_esm_cache" pid=456311 comm="python3" capability=21
capname="sys_admin"
The same host has no such denials outside this profile, and two other
Noble hosts with fewer processes show none.
Impact: audit log noise on busy hosts, and smaller pipes inside the job.
We did not see the ESM cache update fail.
Suggested fix: add "deny capability sys_resource," and "deny capability
sys_admin," to the profile and its child profiles, which keeps today's
behaviour without the log noise. Allowing sys_resource would be the
alternative if full-size pipes matter. The profile on main
(debian/apparmor/ubuntu_pro_esm_cache.jinja2) has neither rule today.
** Affects: ubuntu-advantage-tools (Ubuntu)
Importance: Undecided
Status: New
** Tags: noble
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172626
Title:
ubuntu_pro_esm_cache: apparmor DENIED capability sys_resource and
sys_admin when root is over fs.pipe-user-pages-soft
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2172626/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
