[Bug 426159] New: "deny" rules enforced even if profile is in complain mode
https://bugzilla.novell.com/show_bug.cgi?id=426159 Summary: "deny" rules enforced even if profile is in complain mode Product: openSUSE 11.0 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Critical Priority: P5 - None Component: AppArmor AssignedTo: jjohansen@novell.com ReportedBy: suse-beta@cboltz.de QAContact: qa@suse.de Found By: --- I just learned the hard way that "deny" rules are enforced even if a profile is in complain mode. Reproducer: root@cboltz:~> cat /etc/apparmor.d/tmp.testscript # Last Modified: Sun Sep 14 15:17:11 2008 #include <tunables/global> /tmp/testscript flags=(complain) { #include <abstractions/base> #include <abstractions/bash> deny /tmp/testfile a, /bin/bash rix, /dev/tty rw, /tmp/testscript r, } root@cboltz:~> LANG=C /tmp/testscript /tmp/testscript: line 2: /tmp/testfile: Permission denied root@cboltz:~> cat /tmp/testscript #!/bin/bash echo "hello world" >> /tmp/testfile -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=426159 User jjohansen@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=426159#c1 John Johansen <jjohansen@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Info Provider| |suse-beta@cboltz.de --- Comment #1 from John Johansen <jjohansen@novell.com> 2008-09-15 16:53:50 MDT --- Well yes, however that was done by design. Admittedly however it is not always the correct solution. Deny rules were added to achieve two main goals, 1. enabling profiles to remember what has been denied in the past so profiling tools doesn't constantly reprompt. 2. quiet known rejects so they don't clutter up the logs Goal 1. means you wouldn't normally get prompted for these rejects, as logprof/genprof use the deny rules to screen the logs so you don't get prompted for these entries. This is particularly nice with logprof as the log often contains entries from when the profile was created. The problems I see with the current behavior is that, Goal 2 is applied in complain mode, logprof/genprof are missing the ability to ignore deny rules so that they can be reevaluated, and that there is currently no way to turn off deny rules in complain mode (which may be needed by genprof). To better establish what needs to be done to refine/fix this behavior can you provide some more details on how you believe this should work? I don't see just turning off deny rules and reprompting for everything as a practical solution as Goal 1 was a highly requested behavior. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=426159 User suse-beta@cboltz.de added comment https://bugzilla.novell.com/show_bug.cgi?id=426159#c2 Christian Boltz <suse-beta@cboltz.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|suse-beta@cboltz.de | --- Comment #2 from Christian Boltz <suse-beta@cboltz.de> 2008-09-16 05:17:53 MDT --- I'm fine with logprof not prompting for already deni'ed permissions. That's why the deny rule is there ;-) I don't really care if rejects for deny rules are logged in complain mode or not. It's up to you to decide. But: The current behaviour (enforce deny rules if the profile is in complain mode) is very unexpected and problematic. In my case, I had a single deny rule in my apache profile (complain mode). It turned out to be the wrong one - apache couldn't open a logfile and died at reload after logrotation :-( IMHO the only needed change is: if a profile is in complain mode, then deny rules should not be enforced. I also think that this is the definition of complain mode: do _not_ really restrict the program, just look at it while doing its job. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=426159 User jeffm@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=426159#c4 Jeff Mahoney <jeffm@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #4 from Jeff Mahoney <jeffm@novell.com> 2009-02-11 08:19:15 MST --- A fix for this was committed to the SLE11 branch. I've added it to the SL111_BRANCH. Closing as fixed. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=426159 User suse-beta@cboltz.de added comment https://bugzilla.novell.com/show_bug.cgi?id=426159#c5 --- Comment #5 from Christian Boltz <suse-beta@cboltz.de> 2009-02-11 12:11:30 MST --- (In reply to comment #4)
A fix for this was committed to the SLE11 branch. I've added it to the SL111_BRANCH. Closing as fixed.
Sounds good, but what exactly does this mean for openSUSE 11.1? a) the fix is in 11.1 goldmaster? b) the fix comes with the next kernel update for 11.1? c) ....? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=426159 User jeffm@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=426159#c6 --- Comment #6 from Jeff Mahoney <jeffm@novell.com> 2009-02-11 12:16:08 MST --- The fix will be in the next kernel update for 11.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=426159 User swamp@suse.com added comment https://bugzilla.novell.com/show_bug.cgi?id=426159#c7 Swamp Script User <swamp@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |maint:released:11.1:22712 --- Comment #7 from Swamp Script User <swamp@suse.com> 2009-02-26 07:31:32 MST --- Update released for: kernel-debug, kernel-debug-base, kernel-debug-debuginfo, kernel-debug-debugsource, kernel-debug-extra, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-extra, kernel-docs, kernel-kdump, kernel-kdump-debuginfo, kernel-kdump-debugsource, kernel-pae, kernel-pae-base, kernel-pae-extra, kernel-ppc64, kernel-ppc64-base, kernel-ppc64-debuginfo, kernel-ppc64-debugsource, kernel-ppc64-extra, kernel-ps3, kernel-ps3-debuginfo, kernel-ps3-debugsource, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-extra, kernel-vanilla, kernel-vanilla-debuginfo, kernel-vanilla-debugsource, kernel-xen, kernel-xen-base, kernel-xen-debuginfo, kernel-xen-debugsource, kernel-xen-extra Products: openSUSE 11.1 (debug, i586, ppc, x86_64) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=426159 User suse-beta@cboltz.de added comment https://bugzilla.novell.com/show_bug.cgi?id=426159#c8 Christian Boltz <suse-beta@cboltz.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |VERIFIED --- Comment #8 from Christian Boltz <suse-beta@cboltz.de> 2009-02-26 14:38:21 MST --- VERIFIED using the updated kernel - deny rules are no longer enforced if a profile is in complain mode. However, the fix brought a small side effect on logging - I opened bug 426159 for this. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com