This affects me as well on 26.04 with 7.0.0-42-generic and apparmor
5.0.2-0ubuntu1~26.04.1. The stock /etc/apparmor.d/firefox profile is
loaded but never attaches to /usr/lib/firefox/firefox, so Firefox runs
unconfined, its userns creation is transitioned to unprivileged_userns,
and all its content processes share the host user and PID namespaces
(seccomp only).
I bisected the attachment pattern on this kernel by loading variants
under the profile name firefox and executing /usr/lib/firefox/firefox:
```
/usr/lib/firefox/firefox
attaches
/usr/lib/firefox/firefox{,-esr,-bin}
attaches
/usr/lib/firefox{,-esr,-beta,-devedition,-nightly}/firefox{,-esr,-bin}
attaches
/{usr/lib/firefox,opt/firefox}/firefox
attaches
/{usr/lib/firefox{,-esr},opt/firefox}/firefox
unconfined
/{usr/lib/firefox{,-esr,-beta,-devedition,-nightly},opt/firefox}/firefox{,-esr,-bin}
unconfined (stock pattern)
```
The two failing patterns are exactly the ones whose xmatch DFA the
parser emits with a diff-encoded state (one each). Replaying the
kernel's leftmatch_fb() on the compiled tables reproduces all six
results, and the same tables accept the path under match_char()
semantics.
The fix is already in mainline as e667fc72f7f4 ("apparmor: convert
duplicated dfa transitions to match_char()", Fixes: 21f606610502 and
031dcc8f4e84f), which John Johansen pointed to on the list as
superseding the patch linked here. It also fixes the same pattern in
aa_dfa_match_until() and aa_dfa_matchn_until(). It carries no Cc:
stable, so it may not reach 7.0 through stable updates on its own. Could
the bug be nominated for Resolute and the fix backported to its kernel?
Its impact is that every 26.04 user of Mozilla's Firefox .deb (or the
Mozilla Team PPA build) silently loses Firefox's namespace sandbox.
Workaround until then: add "Optimize=no-diff-encode" to
/etc/apparmor/parser.conf and reload the firefox profile with
"apparmor_parser -r -T -W /etc/apparmor.d/firefox".
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172229
Title:
AppArmor: profile attachment fails for diff-encoded xmatch DFAs
(leftmatch_fb ignores MATCH_FLAG_DIFF_ENCODE) - firefox profile never
attaches
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172229/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
