[Bug 846301] New: apparmor="DENIED" operation="open" profile="/usr/lib/colord"
https://bugzilla.novell.com/show_bug.cgi?id=846301 https://bugzilla.novell.com/show_bug.cgi?id=846301#c0 Summary: apparmor="DENIED" operation="open" profile="/usr/lib/colord" Classification: openSUSE Product: openSUSE 13.1 Version: RC 1 Platform: x86-64 OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: AppArmor AssignedTo: suse-beta@cboltz.de ReportedBy: koenig@linux.de QAContact: qa-bugs@suse.de Found By: --- Blocker: --- after update from 12.3 to 13.1-factory I noticed these kernel msg: [ 165.814132] type=1400 audit(1381957265.766:36): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/sys/class/drm/" pid=2791 comm="colord" requested_mask="r" denied_mask="r" fsuid=120 ouid=0 [ 165.921781] type=1400 audit(1381957265.873:37): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/usr/local/share/mime/mime.cache" pid=2791 comm="colord" requested_mask="r" denied_mask="r" fsuid=120 ouid=0 [ 165.921820] type=1400 audit(1381957265.873:38): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/usr/local/share/mime/globs2" pid=2791 comm="colord" requested_mask="r" denied_mask="r" fsuid=120 ouid=0 [ 165.921850] type=1400 audit(1381957265.873:39): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/usr/local/share/mime/magic" pid=2791 comm="colord" requested_mask="r" denied_mask="r" fsuid=120 ouid=0 [ 165.921871] type=1400 audit(1381957265.873:40): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/usr/local/share/mime/aliases" pid=2791 comm="colord" requested_mask="r" denied_mask="r" fsuid=120 ouid=0 [ 165.921892] type=1400 audit(1381957265.873:41): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/usr/local/share/mime/subclasses" pid=2791 comm="colord" requested_mask="r" denied_mask="r" fsuid=120 ouid=0 [ 165.921914] type=1400 audit(1381957265.873:42): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/usr/local/share/mime/icons" pid=2791 comm="colord" requested_mask="r" denied_mask="r" fsuid=120 ouid=0 [ 165.921937] type=1400 audit(1381957265.873:43): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/usr/local/share/mime/generic-icons" pid=2791 comm="colord" requested_mask="r" denied_mask="r" fsuid=120 ouid=0 $ rpm -qa colord apparmor\* apparmor-utils-2.8.2-7.1.noarch apparmor-profiles-2.8.2-7.1.noarch apparmor-docs-2.8.2-7.1.noarch apparmor-parser-2.8.2-7.1.x86_64 colord-1.1.2-1.3.x86_64 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c1
Christian Boltz
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c2
Harald Koenig
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c3
Christian Boltz
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c4
--- Comment #4 from Bernhard Wiedemann
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c5
Jean Delvare
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c6
Christian Boltz
[ 14.287646] type=1400 audit(1382509489.903:32): apparmor="DENIED" operation="file_mmap" info="Failed name lookup - disconnected path"
Those "disconnected path" entries can have several meanings, but the most likely is that colord was accessing a deleted file which it has still open. The profile already allows this for the non-deleted file (via abstractions/nameservice), but I'm afraid I can't do much for deleted files. Since you wrote this happened after boot - maybe nscd was (re)started after colord?
[ 14.525551] type=1400 audit(1382509490.140:33): apparmor="DENIED" operation="getattr" info="Failed name lookup - disconnected path" error=-13 parent=1 profile="/usr/lib/colord" name="var/lib/gdm/.local/share/icc/edid-8e39eec151c6278d4badffd7b8f27166.icc" pid=1925 comm="colord" requested_mask="r" denied_mask="r"
This looks interesting, even if it's about a "disconnected path". Do you have similar lines without "disconnected path"? Do some *.icc files exist in /var/lib/gdm/.local/share/icc/ (which is $HOME for gdm)? (I can't check myself because I don't use gdm.)
[ 15.473932] type=1400 audit(1382509491.088:36): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/run/systemd/sessions/1" pid=1925 comm="colord" requested_mask="r" denied_mask="r" fsuid=487 ouid=0
This looks interesting[tm], especially because of # head -n1 /run/systemd/sessions/1 # This is private data. Do not parse. ;-)
[ 15.474528] type=1400 audit(1382509491.089:37): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/proc/1871/cmdline" pid=1925 comm="colord" requested_mask="r" denied_mask="r" fsuid=487
Reading /proc/*/cmdline of another process? If the process with PID 1871 is still running, can you please check what it is?
[ 29.565496] type=1400 audit(1382509504.029:42): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/proc/2142/cmdline" pid=1925 comm="colord" requested_mask="r" denied_mask="r" fsuid=487
Another /proc/*/cmdline read attemp - any idea what PID 2142 is? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c7
Jean Delvare
Since you wrote this happened after boot - maybe nscd was (re)started after colord?
No. According to systemctl, nscd was started at 08:24:42 and colord was started at 08:24:49 so nscd was started first (and not restarted since.)
[ 14.525551] type=1400 audit(1382509490.140:33): apparmor="DENIED" operation="getattr" info="Failed name lookup - disconnected path" error=-13 parent=1 profile="/usr/lib/colord" name="var/lib/gdm/.local/share/icc/edid-8e39eec151c6278d4badffd7b8f27166.icc" pid=1925 comm="colord" requested_mask="r" denied_mask="r"
This looks interesting, even if it's about a "disconnected path". Do you have similar lines without "disconnected path"?
I have 4 log messages with operation="open", all the rest has operation="disconnected path". All can be seen in comment #0. They relate to different paths.
Do some *.icc files exist in /var/lib/gdm/.local/share/icc/ (which is $HOME for gdm)? (I can't check myself because I don't use gdm.)
Yes, there is one file there: -rw-r--r-- 1 gdm gdm 1580 18 oct. 12:20 edid-8e39eec151c6278d4badffd7b8f27166.icc Note that I can only read this file as root and not as a regular user because a regular user can't enter /var/lib/gdm: # ll -d /var /var/lib /var/lib/gdm /var/lib/gdm/.local /var/lib/gdm/.local/share /var/lib/gdm/.local/share/icc drwxr-xr-x 16 root root 4096 18 oct. 13:58 /var drwxr-xr-x 54 root root 4096 23 oct. 12:30 /var/lib drwxr-x--- 6 gdm gdm 4096 23 oct. 08:24 /var/lib/gdm drwxr-xr-x 3 gdm gdm 4096 18 oct. 12:20 /var/lib/gdm/.local drwxr-xr-x 7 gdm gdm 4096 18 oct. 12:20 /var/lib/gdm/.local/share drwxr-xr-x 2 gdm gdm 4096 18 oct. 12:20 /var/lib/gdm/.local/share/icc So it might be a permission problem.
[ 15.474528] type=1400 audit(1382509491.089:37): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/proc/1871/cmdline" pid=1925 comm="colord" requested_mask="r" denied_mask="r" fsuid=487
Reading /proc/*/cmdline of another process? If the process with PID 1871 is still running, can you please check what it is?
Unfortunately process 1871 is no longer running. However a grep through /var/log/messages suggests it was gnome-settings-daemon: 2013-10-23T08:24:51.089409+02:00 endymion colord[1925]: (colord:1925): Cd-WARNING **: failed to get seat for session 1 [pid 1871]: Unknown error -13 2013-10-23T08:24:51.089977+02:00 endymion colord[1925]: (colord:1925): Cd-WARNING **: CdMain: failed to read /proc/1871/cmdline: Failed to open file '/proc/1871/cmdline': Permission denied 2013-10-23T08:24:51.090696+02:00 endymion kernel: [ 15.474528] type=1400 audit(1382509491.089:37): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/proc/1871/cmdline" pid=1925 comm="colord" requested_mask="r" denied_mask="r" fsuid=487 ouid=484 2013-10-23T08:25:01.744871+02:00 endymion gnome-session[1849]: (gnome-settings-daemon:1871): GLib-GIO-WARNING **: Error releasing name org.gnome.SettingsDaemon: Connection is closed
[ 29.565496] type=1400 audit(1382509504.029:42): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/colord" name="/proc/2142/cmdline" pid=1925 comm="colord" requested_mask="r" denied_mask="r" fsuid=487
Another /proc/*/cmdline read attemp - any idea what PID 2142 is?
khali 2142 1999 0 08:25 ? 00:00:01 /usr/lib/gnome-settings-daemon-3.0/gnome-settings-daemon -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c8
John Johansen
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c9
Christian Boltz
(In reply to comment #6) Note that I can only read this file as root and not as a regular user because a regular user can't enter /var/lib/gdm:
drwxr-x--- 6 gdm gdm 4096 23 oct. 08:24 /var/lib/gdm
So it might be a permission problem.
User "gdm" can enter the directory, so the permissions are ok.
Reading /proc/*/cmdline of another process? If the process with PID 1871 is still running, can you please check what it is?
Unfortunately process 1871 is no longer running. However a grep through /var/log/messages suggests it was gnome-settings-daemon:
OK, that sounds somehow valid. I just wanted to be sure it doesn't read
/proc/*/cmdline of random processes (which would have been at least strange).
Please apply the following patch to the profile (or download the profile from
home:cboltz:branches:GNOME:Factory/colord) and reload the profile. Run/use
colord for some time and then check your log again if there are more DENIED
messages.
--- usr.lib.colord (revision ac5ee6b1da903f6ac36c39493c59c617)
+++ usr.lib.colord (working copy)
@@ -1,7 +1,7 @@
# Last Modified: Thu Oct 17 14:07:52 2013
#include
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c10
Jean Delvare
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c11
Christian Boltz
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c12
--- Comment #12 from Bernhard Wiedemann
https://bugzilla.novell.com/show_bug.cgi?id=846301
https://bugzilla.novell.com/show_bug.cgi?id=846301#c13
--- Comment #13 from Swamp Workflow Management
participants (1)
-
bugzilla_noreply＠novell.com