mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00
Code Issues Releases Wiki Activity

profiles: add ix permissions for mount and umount on fusermount3 profile

Browse Source 
After an upgrade to libfuse 3.17.1-rc0, autopkgtests started to fail
due to a missing x permission for /usr/bin/mount. After looking at the
source code for fusermount, I noticed that it does call /bin/mount and
/bin/umount in certain cases. These uses were already there in
previous versions of libfuse but I'm still not sure why it hasn't
triggered before.

To reproduce it:
sudo autopkgtest-buildvm-ubuntu-cloud -v -r questing
autopkgtest archivemount -U --apt-pocket=proposed=src:fuse3 --shell-fail -- qemu autopkgtest-questing-amd64.img

After the test fails, enter the vm by

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p 10022 ubuntu@localhost

You can reproduce the test by running

cd /tmp/autopkgtest.*/build.*/src/
/tmp/autopkgtest.*/build.*/src/debian/tests/test

Note that ix for mount and umount were enough to make the autopkgtest
failures to start passing, but there could be issues in the future
regarding the use of fs specific mount binaries like
/usr/sbin/mount.fuse

Fixes: http://bugs.launchpad.net/bugs/2111845
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
This commit is contained in:
Georgia Garcia 2025-06-11 17:41:00 -03:00
parent 2d58858c27
commit 9d2aca7945
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
profiles/apparmor.d/fusermount3
View File

@ -34,8 +34,12 @@ profile fusermount3 /usr/bin/fusermount3 {
/dev/fuse rw, /dev/fuse rw,
# needed since libfuse 3.17.1-rc0 (LP: #2111845)
/usr/bin/mount ix,
/usr/bin/umount ix,
@{etc_ro}/fuse.conf r, @{etc_ro}/fuse.conf r,
@{PROC}/@{pid}/mounts r, @{PROC}/@{pid}/{mounts,mountinfo} r,
@{exec_path} mr, @{exec_path} mr,