https://bugzilla.suse.com/show_bug.cgi?id=1219139 https://bugzilla.suse.com/show_bug.cgi?id=1219139#c2 Christian Boltz <suse-beta@cboltz.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dimstar@opensuse.org Flags| |needinfo?(dimstar@opensuse. | |org) --- Comment #2 from Christian Boltz <suse-beta@cboltz.de> --- (In reply to Fabian Vogt from comment #1)

The pam changelog contains:

...

pam_unix: changed to always run the helper to obtain shadow password entries.

So everything which previously opened /etc/shadow directly might now call unix_chkpwd instead. That might affect more than just dovecot.

That's good to know, thanks for pointing it out! Nevertheless, let's start with the actual failure ;-) The denials translate to the following additions in /etc/apparmor.d/usr.lib.dovecot.auth /usr/sbin/unix_chkpwd Px, owner/proc/@{PID}/loginuid r, You'll also need a profile for unix_chkpwd, which I'll steal from the apparmor.d project (please save it as /etc/apparmor.d/unix-chkpwd) --------------------------------------------------------------------------- # apparmor.d - Full set of apparmor profiles # Copyright (C) 2019-2021 Mikhail Morfikov # SPDX-License-Identifier: GPL-2.0-only abi <abi/4.0>, include <tunables/global> @{exec_path} = /{,usr/}{,s}bin/unix_chkpwd profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd { include <abstractions/base> include <abstractions/nameservice-strict> # To write records to the kernel auditing log. capability audit_write, network netlink raw, @{exec_path} mr, /etc/shadow r, # file_inherit owner /dev/tty@{int} rw, include if exists <local/unix-chkpwd> } --------------------------------------------------------------------------- Can you please test if the dovecot-auth profile addition + this profile fix the authentification? (If you still see denials, please switch the affected profiles to complain mode with aa-complain so that we get everything at once.) For the records: the following profiles read /etc/shadow (via abstractions/authentication): - apparmor.d/usr.lib.dovecot.auth - apparmor.d/usr.lib.dovecot.dovecot-auth - apparmor.d/usr.sbin.dovecot - apparmor.d/usr.sbin.smbd -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1219139 https://bugzilla.suse.com/show_bug.cgi?id=1219139#c6 Christian Boltz <suse-beta@cboltz.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #6 from Christian Boltz <suse-beta@cboltz.de> --- (In reply to Freek de Kruijf from comment #5)

In which snapshot of Tumbleweed will this be available?

SR 1142650 submitted, so - as soon as it gets accepted and the snapshot passes openQA. Until then, feel free to install and test the apparmor-profiles package from security:apparmor as soon as the build finishes in a few minutes. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1219139 https://bugzilla.suse.com/show_bug.cgi?id=1219139#c8 Dominique Leuenberger <dimstar@opensuse.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #8 from Dominique Leuenberger <dimstar@opensuse.org> --- (In reply to OBSbugzilla Bot from comment #7)

This is an autogenerated message for OBS integration: This bug (1219139) was mentioned in https://build.opensuse.org/request/show/1142650 Factory / apparmor

checked in and confirmed by openQA: Previously failing test 'mutt' passes again https://openqa.opensuse.org/tests/3905255#step/mutt/1 -- You are receiving this mail because: You are on the CC list for the bug.