On Tue, 21 May 2024 09:50:04 +0200
Maxime Bélair
On 5/17/24 14:28, Stefano Brivio wrote:
Hi Maxime,
Hi Stefano,
Commit b686afa2 introduced the invalid apparmor rule `mount options=(rw, runbindable) /,` since runbindable mount rules cannot have a source. Therefore running aa-logprof/aa-genprof will trigger errors (see https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685)
$ sudo aa-logprof ERROR: Operation {'runbindable'} cannot have a source. Source = AARE('/')
Oops, right, I didn't actually drop the source specification there. :( Thanks for fixing this.
After investigating this issue, I found that this bug stems from the following restriction not being implemented consistently in aa-* and apparmor_parser.
$ man 2 mount
If mountflags includes one of MS_SHARED, MS_PRIVATE, MS_SLAVE, or MS_UNBINDABLE [...] The source, and filesystemtype [...] arguments are ignored.
Therefore, your rule was valid for apparmor_parser, but not for aa-logprof/aa-genprof, as explained in https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685 . I proposed a fix in https://gitlab.com/apparmor/apparmor/-/merge_requests/1236 .
I wonder why I don't see this on Debian testing with AppArmor 3.0.13 (same on openSUSE Tumbleweed). Is there something in particular I should do to reproduce/check this?
These new mount features have been added recently (https://gitlab.com/apparmor/apparmor/-/merge_requests/1153/diffs#b1394545ea3...) : the bug can only be triggered by apparmor 4.0+
Ah-ha! Thanks for explaining. The patch looks good to me, let me quickly check things again on Debian and openSUSE (in a bit) before applying it. -- Stefano