On 5/17/24 14:28, Stefano Brivio wrote:
Hi Maxime,
Hi Stefano,
Commit
b686afa2 introduced the invalid apparmor rule `mount options=(rw, runbindable) /,` since
runbindable mount rules cannot have a source.
Therefore running aa-logprof/aa-genprof will trigger errors (see
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685)
$ sudo aa-logprof
ERROR: Operation {'runbindable'} cannot have a source. Source =
AARE('/')
Oops, right, I didn't actually drop the source specification there. :(
Thanks for fixing this.
After investigating this issue, I found that this bug stems from the following
restriction not being implemented consistently in aa-* and apparmor_parser.
$ man 2 mount
If mountflags includes one of MS_SHARED, MS_PRIVATE, MS_SLAVE, or MS_UNBINDABLE [...]
The source, and filesystemtype [...] arguments are ignored.
Therefore, your rule was valid for apparmor_parser, but not for aa-logprof/aa-genprof, as
explained in
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685 . I proposed
a fix in
https://gitlab.com/apparmor/apparmor/-/merge_requests/1236 .
I wonder why I don't see this on Debian
testing with AppArmor 3.0.13
(same on openSUSE Tumbleweed).
Is there something in particular I should do to reproduce/check this?
These new mount features have been added recently
(
https://gitlab.com/apparmor/apparmor/-/merge_requests/1153/diffs#b1394545ea…)
: the bug can only be triggered by apparmor 4.0+