https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c1 Jeff Mahoney changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |iceman@fastmail.com.au --- Comment #1 from Jeff Mahoney 2011-03-21 14:03:05 UTC --- Since you've put the profile into complain mode, you should have the info needed to update the profile. Can you attach your /var/log/audit/audit.log? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c3 Carsten Koch changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |CarstenKochElsdorf@web.de --- Comment #3 from Carsten Koch 2011-03-28 00:57:33 UTC --- Same here. dovecot out of the box did not even start (it complained that /usr/bin/doveconf could not be executed). So I added /usr/bin/doveconf ux, to /etc/apparmor.d/usr.sbin.dovecot Now dovecot started, but a telnet <hostname> 143 gave me no output. /var/log/mail.err contains lines like this: Mar 27 01:52:44 puwa dovecot: master: Error: service(config): child 10364 returned error 84 (exec() failed) Mar 27 01:52:44 puwa dovecot: master: Error: service(config): command startup failed, throttling Mar 27 01:52:44 puwa dovecot: master: Error: service(imap-login): command startup failed, throttling When I disabled apparmor entirely, dovecot worked immediately. Please fix! I feel naked without AppArmor! puwa:~ # cat /etc/SuSE-release openSUSE 11.4 (x86_64) VERSION = 11.4 CODENAME = Celadon puwa:~ # uname -a Linux puwa 2.6.37.1-1.2-desktop #1 SMP PREEMPT 2011-02-21 10:34:10 +0100 x86_64 x86_64 x86_64 GNU/Linux -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c5 --- Comment #5 from Javier Llorente 2011-03-29 20:43:24 UTC --- BTW, I upgraded from 11.3 to 11.4 using zypper dup. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c7 Tim Edwards changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|iceman@fastmail.com.au | --- Comment #7 from Tim Edwards 2011-03-30 19:01:46 UTC --- Ok I've updated apparmor-profiles using your RPM (YAST saw it as a vendor change). I still get one error about /etc/mtab permission, however the dovecot server seems to work fine: Mar 30 20:54:08 triton dovecot: Dovecot v1.2.16 starting up (core dumps disabled) Mar 30 20:54:19 triton dovecot: imap-login: Login: user=<tim>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS Mar 30 20:54:19 triton dovecot: setmntent(/etc/mtab) failed: Permission denied Mar 30 20:54:39 triton dovecot: imap-login: Login: user=<tim>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS rpm -qa | grep apparmor | sort apparmor-docs-2.5.1.r1445-52.55.1.x86_64 apparmor-parser-2.5.1.r1445-52.55.1.x86_64 apparmor-profiles-2.5.1.r1445-59.1.noarch apparmor-utils-2.5.1.r1445-52.55.1.noarch libapparmor1-2.5.1.r1445-52.55.1.x86_64 pam_apparmor-2.5.1.r1445-52.55.1.x86_64 patterns-openSUSE-apparmor-11.4-6.9.1.x86_64 patterns-openSUSE-apparmor_opt-11.4-6.9.1.x86_64 perl-apparmor-2.5.1.r1445-52.55.1.x86_64 yast2-apparmor-2.20.1-1.2.1.noarch The only thing is that I went through the YAST wizard to setup some custom apparmor permissions to allow dovecot to work. I'm not sure if installing the new apparmor-profiles RPM has overwritten those - if not how do I remove them so I can test properly? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c9 Jeff Mahoney changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED --- Comment #9 from Jeff Mahoney 2011-04-11 19:55:46 UTC --- This should be fixed in SR 66522, to be released as an update soon. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c11 Andres Nogueiras Melendez changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aaugusto@uvigo.es --- Comment #11 from Andres Nogueiras Melendez 2011-04-21 12:22:11 UTC --- Hi all, Just my one and a half cent, I just suffer an issue from this bug. As long as the fixed package for apparmour profiles is not available yet, when upgrading the email server I spent around half a day dealing with no access to mail accounts (can't read mail) altrough we can receive. As this bug is marked as FIXED, and I truly believe that it is, maybe it is time to say it is alredy unfixed, as long as the new profile package is not available in the main repositories. I congratulate you all who work by SuSE, Novell and collaborate with openSUSE for all your excellent work. All the best! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c13 Rui Salgueiro changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |rps@mat.uc.pt --- Comment #13 from Rui Salgueiro 2011-05-23 16:27:20 UTC --- This bug has also affected me. When will the update be released ? (My system has all the updates, according to YaST, but the versions of apparmor are still the same as the original poster: apparmor-profiles - 2.5.1.r1445-52.55.1 apparmor-utils - 2.5.1.r1445-52.55.1 ) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c15 --- Comment #15 from Bernhard Wiedemann 2011-06-24 17:00:45 CEST --- This is an autogenerated message for OBS integration: This bug (681267) was mentioned in https://build.opensuse.org/request/show/74457 11.4 / apparmor -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c17 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:running:41833:low |maint:running:41833:low | |maint:released:11.4:41905 --- Comment #17 from Swamp Workflow Management 2011-07-07 13:17:32 UTC --- Update released for: apache2-mod_apparmor, apparmor-docs, apparmor-parser, apparmor-profiles, apparmor-utils, libapparmor-devel, libapparmor1, pam_apparmor, perl-apparmor, tomcat_apparmor Products: openSUSE 11.4 (debug, i586, x86_64) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c18 Björn Jacobs changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bjoern.jacobs@gmx.net --- Comment #18 from Björn Jacobs 2011-07-26 12:11:34 UTC --- I just upgraded from Dovecot 1.2 to 2.0, installed all available updates to Dovecot and AppArmor, but the problem is not fixed here. me:/ # /etc/init.d/dovecot start Starting dovecot Fatal: execv(/usr/bin/doveconf) failed: Permission denied startproc: exit status of parent of /usr/sbin/dovecot: 84 me:/ # rpm -qa | grep apparmor | sort apparmor-docs-2.5.1.r1445-52.59.1.noarch apparmor-parser-2.5.1.r1445-52.59.1.x86_64 apparmor-profiles-2.5.1.r1445-52.59.1.noarch apparmor-utils-2.5.1.r1445-52.59.1.noarch libapparmor1-2.5.1.r1445-52.59.1.x86_64 libapparmor-devel-2.5.1.r1445-52.59.1.x86_64 pam_apparmor-2.5.1.r1445-52.59.1.x86_64 patterns-openSUSE-apparmor-11.4-6.9.1.x86_64 patterns-openSUSE-apparmor_opt-11.4-6.9.1.x86_64 perl-apparmor-2.5.1.r1445-52.59.1.x86_64 yast2-apparmor-2.20.1-1.2.1.noarch When disabling AppArmor, everything works fine. Thanks for your help! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c20 --- Comment #20 from Tim Edwards 2011-07-26 13:09:39 UTC --- I'm not sure why this was marked fixed, did anyone test it? I commented 4 months ago that the changes made no difference to me. I long ago just turned off Apparmor due to this issue but in the logs I can see it would still be blocking dovecot if I hadn't turned it off: Jul 26 15:04:03 triton kernel: [325830.735248] type=1400 audit(1311685443.595:2396): apparmor="ALLOWED" operation="file_lock" parent=2521 profile="/usr/lib/dovecot/imap" name=2F686F6D652F74696D2F4D61696C2F2E696D61702F747269746F6E2041646D696E2F646F7665636F742E696E6465782E6C6F67 pid=20845 comm="imap" requested_mask="wk" denied_mask="wk" fsuid=1000 ouid=1000 Jul 26 15:04:03 triton kernel: [325830.735289] type=1400 audit(1311685443.595:2397): apparmor="ALLOWED" operation="file_lock" parent=2521 profile="/usr/lib/dovecot/imap" name=2F686F6D652F74696D2F4D61696C2F2E696D61702F747269746F6E2041646D696E2F646F7665636F742E696E6465782E6C6F67 pid=20845 comm="imap" requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c22 --- Comment #22 from Björn Jacobs 2011-07-26 14:07:53 UTC --- Created an attachment (id=442388) --> (http://bugzilla.novell.com/attachment.cgi?id=442388) New profile for Dovecot (doveconf) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c24 --- Comment #24 from Jeff Mahoney 2011-08-03 00:53:59 UTC --- (In reply to comment #20)

I'm not sure why this was marked fixed, did anyone test it? I commented 4 months ago that the changes made no difference to me.

I long ago just turned off Apparmor due to this issue but in the logs I can see it would still be blocking dovecot if I hadn't turned it off:

Yeah, I took the info you gave me and rolled it in. usr.sbin.dovecot contains /etc/mtab. We also have the ssl abstractions. The audit chunk you posted decodes as: /home/tim/Mail/.imap/triton Admin/dovecot.index.log and the apparmor profile for usr.lib.dovecot.imap contains: @{HOME}/Mail/.imap/** klrw, . so it should be covered. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=681267 https://bugzilla.novell.com/show_bug.cgi?id=681267#c26 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |suse-beta@cboltz.de --- Comment #26 from Christian Boltz 2011-09-13 21:09:52 CEST --- (In reply to comment #25)

I'm not sure if I'm having a variant of this problem. One of my IMAP accounts, dhwarchive, has a home directory that is not under /home. (It's /DWMedia/DWMedia3/dhwarchive.)

Intuitively, I would have thought that "@{HOME}" would work for any user's home directory,

no, @{HOME} is defined as /home/*/ + /root/ (see /etc/apparmor.d/tunables/home)

but I decided to try adding explicit entries for dhwarchive's home directory:

/DWMedia/DWMedia3/dhwarchive/Maildir/ rw /DWMedia/DWMedia3/dhwarchive/Maildir/** rwlk

Correct solution ;-)

Things now seem to be working, but I hope I don't have to redo this whenever there's an update.

Modified profiles (hopefully) won't be overwritten when installing a new package - you'll see a *.rpmnew. General note: I commited Jeff's patch upstream, and it will be part of AppArmor 2.7 beta2 which will be released in the next days. Packages will be available in security:apparmor:factory. (Just take the apparmor-profiles package from there.) If you still see dovecot problems with the 2.7 beta2 apparmor-profiles package, please open a new bugreport, attach your audit.log and assign it to me. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.