http://bugzilla.opensuse.org/show_bug.cgi?id=1061195 http://bugzilla.opensuse.org/show_bug.cgi?id=1061195#c3 --- Comment #3 from Jeff Mahoney --- We've carried the network mediation patches for a while. They landed upstream in -rc2, which must've been in a slightly different form. Hopefully it should be as simple as refreshing our userspace tools to get the updated profiles. We can't be the only ones seeing this issue. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1061195 http://bugzilla.opensuse.org/show_bug.cgi?id=1061195#c4 --- Comment #4 from Christian Boltz --- I updated to Kernel:HEAD today, and had an interesting evening in #apparmor ;-) Regarding the now upstreamed network patch, let me just quote John: <‎jjohansen‎>‎ cboltz: ah yes, the upstreamed version fixes a couple holes in the old patch suse carried One of these "holes" were unix events, which explains the denials you noticed (and that I also see now after installing 4.14rc2). The final solution will be to add some "unix" rules - but that's hard at the moment because 4.14 doesn't log all details needed for unix rules. Instead, I'll add a temporary patch for abstractions/nameservice that adds network unix dgram, network unix stream, (including a TODO note to replace it as soon as support for unix rules was upstreamed, probably 4.15). These rules are broader than needed, but should avoid user-visible breakage - and at least with 4.14, unix rules would get downgraded to network unix anyway ;-) Do you have any ETA when 4.14 will enter Tumbleweed? I want to have the updated abstractions/nameservice in place before 4.14 enters Tumbleweed, otherwise *lots of* things will break. To give you an impression what "lots of" means - I had to adjust 40 profiles on my laptop ;-) -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1061195 http://bugzilla.opensuse.org/show_bug.cgi?id=1061195#c8 Doug Smythies changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dsmythies@telus.net --- Comment #8 from Doug Smythies --- Jeff wrote:

We can't be the only ones seeing this issue.

I am seeing issues, not exactly the same, with Ubuntu. My test Ubuntu 16.04.3 server fails to start mysql and libvirtd due to many apparmor "DENIED" errors. My Ubuntu 17.10 development desktop VM fails to acquire an IP address due to dhclient apparmor "DENIED" errors. The problems came up between kernels 4.14-rc1 and 4.14-rc2, and via kernel bisection was isolated to commit 651e28c5537abb39076d3949fb7618536f1d242e - apparmor: add base infastructure for socket mediation. I found this thread: https://lkml.org/lkml/2017/10/3/2 , which pointed me here. The thread debates if this is a kernel regression or not. In my opinion it is a kernel regression. I have passed my information along to the author of the commit. Jeff wrote:

We've carried the network mediation patches for a while. They landed upstream in -rc2, which must've been in a slightly different form.

I'm told that Ubuntu has carried them for awhile also. And yes, there are significant differences between Ubuntu kernel 4.13.0.12 and what ended up in mainline kernel 4.14-rc2. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1061195 http://bugzilla.opensuse.org/show_bug.cgi?id=1061195#c10 --- Comment #10 from Jeff Mahoney --- Thanks for your effort on this, Christian. I agree that users running an -rc kernel need to be prepared to deal with issues like this. That's not to say I don't appreciate users doing exactly that and reporting bugs in the process. I view this as a profile compatibility issue and one that, as you say, will be fixed before 4.14 hits TW as a real kernel update. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1061195 http://bugzilla.opensuse.org/show_bug.cgi?id=1061195#c13 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #13 from Christian Boltz --- The updated package reached Tumbleweed today. I also submitted an update for Leap 42.2 and 42.3 - SR 537428 -- You are receiving this mail because: You are on the CC list for the bug.