https://bugzilla.novell.com/show_bug.cgi?id=851131 https://bugzilla.novell.com/show_bug.cgi?id=851131#c1 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |robin.roevens1@pandora.be --- Comment #1 from Christian Boltz 2013-11-19 18:53:36 CET --- Can you please a) switch the profile to complain (learning) mode using aa-complain /usr/sbin/winbindd (note: this will allow everything, and log things not covered by the profile) b) restart winbindd and use it for some time c) attach your /var/log/audit/audit.log or, if you don't have auditd running, /var/log/messages or journalctl | grep apparmor If you want to update the profile yourself, you can use aa-logprof (and aa-enforce to switch it back to enforce mode). Nevertheless, I'd be interested in the log file ;-) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=851131 https://bugzilla.novell.com/show_bug.cgi?id=851131#c3 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |robin.roevens1@pandora.be --- Comment #3 from Christian Boltz 2013-11-20 18:10:30 CET --- The following profile additions should fix your problem: #include capability ipc_lock, capability setuid, /var/lib/samba/smb_krb5/krb5.conf.* rw, # rw instead of only w /var/tmp/uzaws0531-044_39756 rw, Needless to say that the last line is too specific, however I'd like to avoid allowing "/var/tmp/* rw". The filename looks like randomly generated, but if we are lucky, at least half of the filename is hardcoded. Can you please find out (probably by restarting winbindd multiple times) how the filename varies and which part of it is static? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=851131 https://bugzilla.novell.com/show_bug.cgi?id=851131#c5 Robin Roevens changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|robin.roevens1@pandora.be | --- Comment #5 from Robin Roevens 2013-11-21 09:41:37 UTC --- /var/tmp/uzaws0531-044_39756 seems to be <hostname>-044_<UID> where <hostname> is the hostname of the current workstation and <UID> is the (idmapped) uid of the user logging on using winbind. I don't know where 044 is coming from, and if it changes. I don't see it change after multiple winbindd restarts, logon/logoff sequences or even complete reboots.. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=851131 https://bugzilla.novell.com/show_bug.cgi?id=851131#c7 Anastasios Papadopoulos <70tas@usa.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |70tas@usa.net --- Comment #7 from Anastasios Papadopoulos <70tas@usa.net> 2013-11-21 21:54:16 UTC --- I had the same issue, although I did not track it to AppArmour. I did an in-place upgrade and could not login via AD. I built a new system from the DVD; had issues getting attached to the domain via YaST. I was able to run the 'net ads join' command via CLI and it worked. However I still could not connect via AD. Seeing this bug, I simply disabled AppArmour, and was immediately able to login. I can provide information that may needed, but someone will have to be explicit in what I should do, and what I should collect. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=851131 https://bugzilla.novell.com/show_bug.cgi?id=851131#c9 --- Comment #9 from Bernhard Wiedemann 2014-01-02 15:00:13 CET --- This is an autogenerated message for OBS integration: This bug (851131) was mentioned in https://build.opensuse.org/request/show/212636 Factory / apparmor -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=851131 https://bugzilla.novell.com/show_bug.cgi?id=851131#c11 --- Comment #11 from Christian Boltz 2014-01-19 16:26:28 CET --- SR 214402 sent to openSUSE:13.1:Update which fixes most of the problems reported here. The only exception is "/var/tmp/* rw," which is too broad IMHO, and I don't have a good way to restrict it to /var/tmp/$hostname. Please add this part to /etc/apparmor.d/local/usr.sbin.winbindd yourself if you need it. Lars, I'm still waiting for an answer to comment #6 ;-) (as an alternative, moving those files to /run/samba/ or something like that would be even better - if you do this, please tell me so that I can provide updated profiles in time.) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=851131 https://bugzilla.novell.com/show_bug.cgi?id=851131#c13 Deryk Lister changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |deryk.lister@marl.co.uk --- Comment #13 from Swamp Workflow Management 2014-02-03 15:08:52 UTC --- openSUSE-RU-2014:0182-1: An update that has 6 recommended fixes can now be installed. Category: recommended (important) Bug References: 850374,851131,851984,852018,853019,856651 CVE References: Sources used: openSUSE 13.1 (src): apparmor-2.8.2-4.13.1 --- Comment #14 from Deryk Lister 2014-05-22 13:03:35 UTC --- Just encountered the same issue when installing openSUSE 13.1 onto a machine here - it joins the AD (2008 server) domain fine but won't login if AppArmor is running, even with all the latest updates installed. I have checked /etc/apparmor.d/usr.sbin.winbindd and it does have the correct entries in it. /var/log/messages contains: messages:2014-05-22T13:21:18.342660+01:00 S5143L kernel: [ 29.123172] type=1400 audit(1400761278.341:40): apparmor="DENIED" operation="mknod" parent=2602 profile="/usr/sbin/winbindd" name="/var/tmp/s5143l-044_10000" pid=2605 comm="winbindd" requested_mask="c" denied_mask="c" fsuid=10000 ouid=10000 My only thought is that I used capital letters in the hostname, and if something in apparmor is expecting to allow /var/tmp/S5143L-044_10000 instead of /var/tmp/s5143l-044_10000 that might upset it. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=851131 https://bugzilla.novell.com/show_bug.cgi?id=851131#c16 Lars Heide changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |itsbo@fz-juelich.de --- Comment #16 from Lars Heide 2014-09-11 16:16:15 UTC --- I had to add this rule to apparmor to have winbind working: /var/cache/krb5rcache/* rw, 2014-09-11T17:38:26.239161+02:00 hostname kernel: [11473.815728] type=1400 audit(1410449906.233:59): apparmor="DENIED" operation="mknod" parent=2766 profile="/usr/sbin/winbindd" name="/var/cache/krb5rcache/hostname-044_132125" pid=2945 comm="winbindd" requested_mask="c" denied_mask="c" fsuid=132125 ouid=132125 This happened on an OpenSuSE 13.1 I also saw this: 2014-09-10T18:00:32.060219+02:00 hostname kernel: [ 650.879115] type=1400 audit(1410364832.053:42): apparmor="DENIED" operation="mknod" parent=5961 profile="/usr/sbin/winbindd" name="/etc/samba/passdb.tdb.tmp" pid=7637 comm="winbindd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0 and added /etc/samba/passdb.tdb.tmp rwk, /etc/samba/secrets.tdb.tmp rwk, as the original files are permitted, the tmp files should also be permitted. This also cropped up: 2014-09-11T10:36:25.470899+02:00 hostname kernel: [ 864.731323] type=1400 audit(1410424585.466:41): apparmor="DENIED" operation="capable" parent=1941 profile="/usr/sbin/winbindd" pid=2135 comm="winbindd" pid=2135 comm="winbindd" capability=1 capname="dac_override" Didn't seem to impair functionality. Somebody can elaborate on this? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=851131 https://bugzilla.novell.com/show_bug.cgi?id=851131#c18 --- Comment #18 from Lars Heide 2014-09-15 08:12:20 UTC --- (In reply to comment #17)

...

/etc/samba/secrets.tdb.tmp rwk,

Did you really see a need/log entry for this? (I never did, and therefore the profile doesn't allow it yet.)

No, I didn't. Just a precaution I deemed harmless but you are right, I shouldn't do this if not really necessary.

...

audit(1410424585.466:41): apparmor="DENIED" operation="capable" parent=1941 profile="/usr/sbin/winbindd" pid=2135 comm="winbindd" pid=2135 comm="winbindd" capability=1 capname="dac_override"

Didn't seem to impair functionality. Somebody can elaborate on this?

See man capabilities(7): CAP_DAC_OVERRIDE Bypass file read, write, and execute permission checks. (DAC is an abbreviation of "discretionary access control".)

Or simplified: the process is running as root and tries to read a file that is owned by a user without permissions for root, for example -rw-r-- cb users [...] /some/file

The general rule "root is allowed to do everything" allows read and write access to this file nevertheless, but it needs the dac_override capability. (Any idea which file winbindd tried to access?)

I'm sorry, I should have been more specific. I knew what the functionality meant, just wondered why it is not allowed (i.e. is this on purpose). I see this additionally in my logs: 2014-09-03T17:44:34.044481+02:00 iek3150 winbindd[2283]: STATUS=daemon 'winbindd' finished starting up and ready to serve connectionsremove_ccache: failed to destroy user krb5 ccache FILE:/tmp/krb5cc_164480 with: Credentials cache permissions incorrect 2014-09-03T17:44:34.044708+02:00 iek3150 winbindd[2283]: [2014/09/03 17:44:34.044501, 0] ../source3/winbindd/winbindd_pam.c:2204(winbindd_dual_pam_logoff) 2014-09-03T17:44:34.044852+02:00 iek3150 winbindd[2283]: winbindd_pam_logoff: failed to remove ccache: NT_STATUS_UNSUCCESSFUL Note: the system does not serve any files. It's just using winbind for authentication. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=851131 https://bugzilla.novell.com/show_bug.cgi?id=851131#c20 --- Comment #20 from Christian Boltz 2014-09-16 21:19:09 CEST --- Created an attachment (id=606574) --> (http://bugzilla.novell.com/attachment.cgi?id=606574) updated usr.sbin.winbindd profile for apparmor 2.8.x (In reply to comment #19)

profile="/usr/sbin/winbindd" name="/var/cache/krb5rcache/hostname-044_6540"

I think I'll disable apparmor for winbind.

Please don't ;-) Instead, please replace your winbind profile with the profile attached to this comment and run "rcapparmor reload" to load it. Instead of disabling the AppArmor profile for winbind, you can/should switch it to complain mode with aa-complain. This means it allows everything and logs everything the profile wouldn't allow. (Please report all log events so that I can improve the profile.) I'm waiting for the upstream 2.8.4 release and will then submit an update for 13.1 that also includes the updated winbind profile. (You can install apparmor-profiles-2.8.3 from security:apparmor/apparmor_2_8 if you want all updated profiles.) (In reply to comment #18)

(In reply to comment #17)

...

...

audit(1410424585.466:41): apparmor="DENIED" operation="capable" parent=1941 profile="/usr/sbin/winbindd" pid=2135 comm="winbindd" pid=2135 comm="winbindd" capability=1 capname="dac_override"

This log message is from # date -d @1410424585.466 Thu Sep 11 10:36:25 CEST 2014

I see this additionally in my logs:

2014-09-03T17:44:34.044481+02:00 iek3150 winbindd[2283]:

Needless to say that this is a totally different date/event ;-)

failed to destroy user krb5 ccache FILE:/tmp/krb5cc_164480 with: Credentials cache permissions incorrect

That's the /tmp/krb5cc_* issue you reported earlier - that's also fixed in the attached profile already. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=851131 https://bugzilla.novell.com/show_bug.cgi?id=851131#c22 --- Comment #22 from Lars Heide 2014-09-17 08:01:14 UTC --- (In reply to comment #19)

2014-09-16T12:19:55.346048+02:00 hostname kernel: [77334.850010] type=1400 audit(1410862795.340:46): apparmor="DENIED" operation="mknod" parent=23745 profile="/usr/sbin/winbindd" name="/var/cache/krb5rcache/hostname-044_6540" pid=23772 comm="winbindd" requested_mask="c" denied_mask="c" fsuid=6540 ouid=6540

Is this handled by "/var/cache/krb5rcache/* rw," or would I need "capability mknod," ? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=851131 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |obs:running:3208:low -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=851131 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CONFIRMED |RESOLVED Resolution|--- |FIXED --- Comment #26 from Christian Boltz --- Updated packages submitted to 13.1 (SR 261950) and 12.3 (SR 261953) which should fix everything mentioned in this bugreport. Since you didn't give feedback, I assume everything works now ;-) If you still notice any problems after installing the updates, please reopen or open a new bugreport (this one is long enough already ;-) -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=851131 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:3208:moderate | -- You are receiving this mail because: You are on the CC list for the bug.