[Bug 991901] New: DENIED errors for nmbd & winbindd
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 Bug ID: 991901 Summary: DENIED errors for nmbd & winbindd Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: AppArmor Assignee: suse-beta@cboltz.de Reporter: nopower@suse.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- At least latest versions of samba on sle12 (and presumably leap) exhibit 2016-08-02T20:47:28.744928+01:00 e6 kernel: [20450.573208] audit: type=1400 audit(1470167248.740:40): apparmor="DENIED" operation="capable" profile="/usr/sbin/winbindd" pid=30995 comm="winbindd" capability=21 capname="sys_admin" 2016-08-02T20:47:28.772923+01:00 e6 kernel: [20450.602088] audit: type=1400 audit(1470167248.768:41): apparmor="DENIED" operation="capable" profile="/usr/sbin/winbindd" pid=30995 comm="winbindd" capability=12 capname="net_admin" for winbindd & nmb looking for EPERM in associated straces we see for net_admin (trace for nmb & winbind are the same) 20:47:28.770944 socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 11 20:47:28.770960 getsockopt(11, SOL_SOCKET, SO_SNDBUF, [212992], [4]) = 0 20:47:28.770972 setsockopt(11, SOL_SOCKET, SO_SNDBUFFORCE, [8388608], 4) = -1 EPERM (Operation not permitted) sys_admin (again traces for nmb & winbind are same) 20:47:28.742041 statfs("/sys/fs/selinux", 0x7ffec45e3420) = -1 ENOENT (No such file or directory) 20:47:28.742063 statfs("/selinux", {f_type="BTRFS_SUPER_MAGIC", f_bsize=4096, f_blocks=4716800, f_bfree=3791830, f_bavail=3634294, f_files=0, f_ffree=0, f_fsid={599142472, -600034648}, f_namelen=255, f_frsize=4096}) = 0 20:47:28.742084 mount("proc", "/proc", "proc", 0, NULL) = -1 EPERM (Operation not permitted) 20:47:28.742124 open("/proc/filesystems", O_RDONLY) = 3 Actually for this one above I see the same for nscd also I don't believe that these are actually causing any problems (at least no errors are reported in the samba logs) and my testing didn't yet reveal any problems -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 Noel Power <nopower@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nopower@suse.com, | |samba-maintainers@SuSE.de -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 http://bugzilla.opensuse.org/show_bug.cgi?id=991901#c1 --- Comment #1 from Noel Power <nopower@suse.com> --- the sys_admin error looks like it is a duplicate of bug #990724 still need to find out about the net_admin one :-) could be kernel related -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 http://bugzilla.opensuse.org/show_bug.cgi?id=991901#c2 --- Comment #2 from Noel Power <nopower@suse.com> --- the net_admin DENIED error happens for smbd, winbind & nmb. This is related to systemd and how samba communicates with it. Additionally that the operation is denied is not a problem imho as the systemd code handles the EPERM gracefully. Briefly all the samba daemons call 'become_daemon' (see https://git.samba.org/?p=samba.git;a=blob;f=lib/util/become_daemon.c;h=9979f...) The sd_notifyf in that function ends up calling fd_inc_sndbuf (see https://github.com/systemd/systemd/blob/master/src/libsystemd/sd-daemon/sd-d... && https://github.com/systemd/systemd/blob/master/src/basic/socket-util.c#L754) and this results in the strace snippet as shown in comment #0 For sle12 I have modified abstractions/samba as follows @@ -21,5 +21,7 @@ /{,var/}run/samba/ w, /{,var/}run/samba/*.tdb rw, + deny capability net_admin, + # required for clustering /var/lib/ctdb/** rwk, The error is squashed -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 Noel Power <nopower@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|DENIED errors for nmbd & |DENIED errors for smb, nmbd |winbindd |& winbindd -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 http://bugzilla.opensuse.org/show_bug.cgi?id=991901#c5 Dominique Leuenberger <dimstar@opensuse.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dimstar@opensuse.org Flags| |needinfo? --- Comment #5 from Dominique Leuenberger <dimstar@opensuse.org> --- Can we please have this fix also for openSUSE:Factory and subsequently openSUSE:Leap:42.2? -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 Dominique Leuenberger <dimstar@opensuse.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 http://bugzilla.opensuse.org/show_bug.cgi?id=991901#c6 --- Comment #6 from Christian Boltz <suse-beta@cboltz.de> --- This is an interesting[tm] topic. I discussed this with the upstream AppArmor developers, and they didn't like the idea to deny a capability because systemd is doing silly things (I have to admit that this summary is slightly exaggerated ;-)) So if we include this patch, it will most probably be a non-upstreamable patch forever. The main problem is: If one day samba really needs the net_admin capability, we will get reports about strange failures without any log entry (because "deny" silences the logging) and, worse, angry users ;-) The correct fix here is to fix systemd so that it does not accidently cause a request for capability sys_admin (see comment #2 for details) for lots of daemons. Note that I've noticed similar capability requests for other daemons, for example apache. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 http://bugzilla.opensuse.org/show_bug.cgi?id=991901#c7 --- Comment #7 from Noel Power <nopower@suse.com> --- (In reply to Christian Boltz from comment #6)
This is an interesting[tm] topic.
I discussed this with the upstream AppArmor developers, and they didn't like the idea to deny a capability because systemd is doing silly things (I have to admit that this summary is slightly exaggerated ;-)) So if we include this patch, it will most probably be a non-upstreamable patch forever.
The main problem is: If one day samba really needs the net_admin capability, we will get reports about strange failures without any log entry (because "deny" silences the logging) and, worse, angry users ;-)
The correct fix here is to fix systemd so that it does not accidently cause a request for capability sys_admin (see comment #2 for details) for lots of daemons. Note that I've noticed similar capability requests for other daemons, for example apache.
I get the point of some maybe future issue about lack of corresponding log entry for a net_admin cap issue, I think it will affect development debugging rather than users though. Keeping this out of Factory probably makes sense. It remaining in SLE I don't think is a big deal, we can think about removing this if it causes an issue. However this just reminds me about the fact that we (e.g. SLE) still use this cobbled together old version of apparmor. It makes no sense IMHO (unless there is some real genuine difference, Christian do you know?) Because apparmor affects so many processes I don't know if it would be acceptable to change to the newer version mid SP2 but for SP3 we should really fix this( not sure how that should happen maybe FATE or some other mechanism) -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 http://bugzilla.opensuse.org/show_bug.cgi?id=991901#c8 --- Comment #8 from Christian Boltz <suse-beta@cboltz.de> --- (In reply to Noel Power from comment #7)
I get the point of some maybe future issue about lack of corresponding log entry for a net_admin cap issue, I think it will affect development debugging rather than users though.
Depends on what exactly it breaks ;-) - but at least I'd hope that the developers will notice it first.
However this just reminds me about the fact that we (e.g. SLE) still use this cobbled together old version of apparmor. It makes no sense IMHO (unless there is some real genuine difference, Christian do you know?)
I proposed AppArmor 2.9 for SLE 12 GA - it was in beta status at that time and the final release would have been in time for the SLE release. However it was declined, see bug 864091 for details. The biggest change in 2.9 is that the aa-* tools were rewritten in python (instead of the interesting[tm] perl code in 2.8, and it didn't take too long until a SLE user found a bug that was already fixed in the python code), but there were also other changes. You can find the detailed 2.9.x and 2.10.x release notes at http://wiki.apparmor.net/index.php?title=Special%3AAllPages&from=Release&to=Rev (BTW: 2.11 will be released soon)
Because apparmor affects so many processes I don't know if it would be acceptable to change to the newer version mid SP2 but for SP3 we should really fix this( not sure how that should happen maybe FATE or some other mechanism)
I'll leave the SLE paperwork to you ;-) -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 http://bugzilla.opensuse.org/show_bug.cgi?id=991901#c9 Christian Boltz <suse-beta@cboltz.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|AppArmor |Basesystem Version|Leap 42.2 |Current Assignee|suse-beta@cboltz.de |systemd-maintainers@suse.de Product|openSUSE Distribution |openSUSE Tumbleweed --- Comment #9 from Christian Boltz <suse-beta@cboltz.de> --- I'll hand over this bug to the systemd maintainers since I believe it should be fixed in systemd ;-) The short version is that lots of daemons (for example samba and apache) request capability sys_admin because of the way they communicate with systemd (sd_notifyf). Those daemons still work without granting this capability and can even talk to systemd, so it would be nice if we wouldn't need to grant that powerful capability to lots of daemons. See comment #2 and #6 for more technical details. The most relevant part of the discussion in #apparmor (from 2016-08-09) is probably <sarnold> oh right, _this_ bit is the sendbuf and recvbuf ... <sarnold> cboltz: to be honest I'm surprised that these options require privs :( <cboltz> capabilities(7) lists the SO_SNDBUFFORCE flag in the NET_ADMIN section <sarnold> https://github.com/systemd/systemd/blob/master/src/basic/socket-util.c#L836 [link updated, was originally #L754] <sarnold> love it <sarnold> they try the one that requires root privileges -first- <sarnold> rather than the one that might succeed if the admin has configured the system properly first -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 http://bugzilla.opensuse.org/show_bug.cgi?id=991901#c12 Franck Bui <fbui@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS Christian Boltz <suse-beta@cboltz.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(suse-beta@cboltz. | |de) | --- Comment #12 from Christian Boltz <suse-beta@cboltz.de> --- (In reply to Franck Bui from comment #11)
Sorry for the delay...
(In reply to Christian Boltz from comment #9)
I'll hand over this bug to the systemd maintainers since I believe it should be fixed in systemd ;-)
The short version is that lots of daemons (for example samba and apache) request capability sys_admin because of the way they communicate with systemd (sd_notifyf).
You probably meant capability "net_admin" instead of "sys_admin".
Right, sorry for confusing it.
Those daemons still work without granting this capability and can even talk to systemd, so it would be nice if we wouldn't need to grant that powerful capability to lots of daemons.
So what is exactly the problem here if it still works without granting capability "net_admin" ?
Is it just a matter of warnings or more ?
Short version: security warnings equal to "more" ;-) Longer version: In theory it's "just" about the log entries. I'm not sure if I'd call these log entries a "warning" ;-) but I understand that you could interpret them as such. In practise you really don't want to have DENIED log entries. Think of them as a red warning light, because they could indicate that a program has been hacked and tried to do funny[tm] things. I mean, do you really enjoy it if samba requests permissions that would allow to change your IP address and routing? ;-) (just for completeness, DENIED log entries can also mean that your AppArmor profile is "just incomplete".) To avoid these log entries (without changing systemd), you basically have two options: - allow net_admin in the AppArmor profile, which will allow more than the program actually needs. I probably don't need to mention that capability net_admin allows to change your IP, routing etc. (see capabilities(7) for details) so granting it superfluously weakens security. - deny net_admin in the profile - this silences the warnings, but if one day the program really needs that capability, the logging will still be silenced and you'll have a hard time to find out why the program doesn't work as expected. Both options are far from perfect.
Admittedly we could try SO_SNDBUF first and fallback to SO_SNDBUFFORCE but I'd like to understand the problem first.
The problem is exactly the order. systemd first tries SO_SNDBUFFORCE, and because that option needs capability net_admin (see capabilities(7)), we see the DENIED logs for net_admin. It should first try to use the door handle (SO_SNDBUF), and only kick in the door (SO_SNDBUFFORCE) if that fails. In practise, this should avoid SO_SNDBUFFORCE and therefore the need (and log entries) for capability net_admin. Noel's comment #2 looks like a good explanation of the technical details. The line numbers changed slightly, fd_inc_sndbuf() is now https://github.com/systemd/systemd/blob/master/src/basic/socket-util.c#L827
Disclaimer: my apparmor knowledge is mostly null :)
I'm not sure if I know more about the systemd internals than you know about AppArmor ;-) The very quick and rough summary is that an AppArmor profile is a whitelist of what a program is allowed to do (file permissions, capabilities etc.), and if it tries something not allowed in the profile, this will be denied and logged. <shameless plug> To get started with AppArmor, I can recommend my AppArmor Crash course - either the slides on blog.cboltz.de, or the video from oSC16. </shameless plug> -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 http://bugzilla.opensuse.org/show_bug.cgi?id=991901#c16 Christian Boltz <suse-beta@cboltz.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(suse-beta@cboltz. | |de) | --- Comment #16 from Christian Boltz <suse-beta@cboltz.de> --- (In reply to Franck Bui from comment #15)
Christian, I suppose this change would be also welcomed by other distros (such as Leap, SLE) ?
Yes, please also apply this fix to Leap and SLE. (In reply to Franck Bui from comment #14)
Discussion wasn't needed, upstream accepted the patch.
:-) Thanks for getting this fixed upstream!
So with this patch, the DENIED log entries will still be present but at least sysadmin can increase the max size limit and make the logs go away.
Since denying capability net_admin seems to work (see comment #2), I'd guess/hope the default limits are high enough to avoid the log entries ;-) -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=991901 http://bugzilla.opensuse.org/show_bug.cgi?id=991901#c17 Franck Bui <fbui@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #17 from Franck Bui <fbui@suse.com> --- Patch applied to v228, v234 and v237, so should be released through the next updates. Hence closing. -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com