On 5/17/24 14:28, Stefano Brivio wrote:Hi Maxime,Hi Stefano,After investigating this issue, I found that this bug stems from the following restriction not being implemented consistently in aa-* and apparmor_parser. $ man 2 mount If mountflags includes one of MS_SHARED, MS_PRIVATE, MS_SLAVE, or MS_UNBINDABLE [...] The source, and filesystemtype [...] arguments are ignored. Therefore, your rule was valid for apparmor_parser, but not for aa-logprof/aa-genprof, as explained in https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685 . I proposed a fix in https://gitlab.com/apparmor/apparmor/-/merge_requests/1236 .Commit b686afa2 introduced the invalid apparmor rule `mount options=(rw, runbindable) /,` since runbindable mount rules cannot have a source. Therefore running aa-logprof/aa-genprof will trigger errors (see https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685) $ sudo aa-logprof ERROR: Operation {'runbindable'} cannot have a source. Source = AARE('/')Oops, right, I didn't actually drop the source specification there. :( Thanks for fixing this.I wonder why I don't see this on Debian testing with AppArmor 3.0.13 (same on openSUSE Tumbleweed). Is there something in particular I should do to reproduce/check this?These new mount features have been added recently (https://gitlab.com/apparmor/apparmor/-/merge_requests/1153/diffs#b1394545ea…) : the bug can only be triggered by apparmor 4.0+This patch fixes it to the intended behavior. Signed-off-by: Maxime Bélair <maxime.belair(a)canonical.com> --- contrib/apparmor/abstractions/passt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt index 61ec32c..d245115 100644 --- a/contrib/apparmor/abstractions/passt +++ b/contrib/apparmor/abstractions/passt @@ -26,7 +26,7 @@ capability sys_ptrace, / r, # isolate_prefork(), isolation.c - mount options=(rw, runbindable) /, + mount options=(rw, runbindable) -> /, mount "" -> "/", mount "" -> "/tmp/", pivot_root "/tmp/" -> "/tmp/",-- Stefano