upsteam move_mount mediation now allows for a detached (disconnected)
mount to be move mounted into a namespace.
Add support for this by detecting 'detached' as a keyword for the
source/device and using it to create a null match. Because existing
mount encoding using a null separator between the mount terms null
match followed by the null seperator will separate detached mounts
within the existing encoding.
```
Eg.
mount detached -> /destination,
mount options=(ro) fstype=ext4 detached -> /destination,
```
This is functionally equivalent to using
```
mount "" -> /destination,
```
However using ```""``` does not provide any context that about what the rule is allowing or why so the ```detached``` form is preferred.
This is not a perfect solution, but is what can be currently supported
by the kernel without more LSM hooks.
On kernels that don't support detached mount detection, rules using
the detached source conditional will be ignored (never matched).
This encoding also allows the existing
```
mount,
mount options=(move),
mount options=(move) -> /destination,
```
to continue to work with both detached and regular mounts on kernels
that support the move_mount() syscall.
Signed-off-by: John Johansen <john.johansen@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1561
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
The tools are wrong in parsing the detached mount test.
Until that can be fixed, mark the tools as wrong.
Signed-off-by: John Johansen <john.johansen@canonical.com>
upsteam move_mount mediation now allows for a detached (disconnected)
mount to be move mounted into a namespace.
Add support for this by detecting 'detached' as a keyword for the
source/device and using it to create a null match. Because existing
mount encoding using a null separator between the mount terms null
match followed by the null seperator will separate detached mounts
within the existing encoding.
Eg.
mount detached -> /destination,
mount options=(ro) fstype=ext4 detached -> /destination,
This is functionally equivalent to using
mount "" -> /destination,
However using "" does not provide any context that about what the rule is allowing or why so the 'detached' form is preferred.
This is not a perfect solution, but is what can be currently supported
by the kernel without more LSM hooks.
On kernels that don't support detached mount detection, rules using
the detached souce conditional will be ignored (never matched).
This encoding also allows the existing
mount,
mount options=(move),
mount options=(move) -> /destination,
to continue to work with both detached and regular mounts on kernels
that support the move_mount() syscall.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Without the kernel patches in
https://lists.ubuntu.com/archives/apparmor/2025-March/013533.html
these tests will fail. This means spread ci for the majority of
kernels will fail.
Indeed disconnected paths failing in complain mode was always expected
behavior until the above kernel patches were posted.
Instead mark these patches as xpass, so spread CI can pass. These
tests will need to be updated to make them detect if the kernel
supports complain mode with disconnected paths.
Fixes: 089539cbf Merge regression: test complain-mode operations on disconnected paths in mounts
Signed-off-by: John Johansen <john.johansen@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1614
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
Without the kernel patches in
https://lists.ubuntu.com/archives/apparmor/2025-March/013533.html
these tests will fail. This means spread ci for the majority of
kernels will fail.
Indeed disconnected paths failing in complain mode was always expected
behavior until the above kernel patches were posted.
Instead mark these patches as xpass, so spread CI can pass. These
tests will need to be updated to make them detect if the kernel
supports complain mode with disconnected paths.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Two fixes for the remmina profile so we can merge this
1. mknod is not currently an allowed permission. It has to be
downgraded to w
Do that with a note about how this needs to change in the future
2. The original fix adds direct references to peer=(label=unconfined)
Fix this to use a variable. So it will be easier to refactor and
update.
While doing it for the PMR also fixup the other direct unconfined
references.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Disconnected paths on lookups have caused actual permission denials, even
when the loaded profile is in complain mode. This is a test that causes
disconnections using mounts (both old and new API) and then verifies that
a complain mode profile doesn't prevent operations with disconnected fds.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1568
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
Representative log lines from the [LaunchPad bug](https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2098838):
```
Feb 19 16:34:01 kernel: audit: type=1400 audit(1740000841.920:621): apparmor="DENIED" operation="create" class="net" profile="wpa_supplicant" pid=2211 comm="wpa_supplicant" family="netlink" sock_type="raw" protocol=0 requested="create" denied="create"
Feb 19 16:34:01 kernel: audit: type=1400 audit(1740000841.920:622): apparmor="DENIED" operation="open" class="file" profile="wpa_supplicant" name="/sys/devices/pci0000:00/0000:00:14.3/ieee80211/phy0/name" pid=2211 comm="wpa_supplicant" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Feb 19 16:34:01 kernel: audit: type=1400 audit(1740000841.920:623): apparmor="DENIED" operation="create" class="net" profile="wpa_supplicant" pid=2211 comm="wpa_supplicant" family="inet" sock_type="dgram" protocol=0 requested="create" denied="create"
Feb 19 16:34:01 kernel: audit: type=1400 audit(1740000841.920:624): apparmor="DENIED" operation="open" class="file" profile="wpa_supplicant" name="/sys/devices/pci0000:00/0000:00:14.3/ieee80211/phy0/name" pid=2211 comm="wpa_supplicant" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
```
However, regression potential remains for other setups (e.g. USB WiFi dongles), and we should maybe open up a discussion about when we want to target profiles into `apparmor.d` as opposed to `extras`.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1554
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
--configdir is meant for testing and should override all other configs,
instead of being combined with them. Config combination causes aa-notify
test failures if e.g. the user-local config sets filtering options.
Also supply a notify.conf file for exclusive use during testing.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1610
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
The feature matching done in aa_feature_supports calls walk_one to
traverse the features string. This function is supposed to match on
the feature and return, but it matches the feature based on the length
of the feature to check. If the feature to check shorter, then it
would return as if the feature was not present - which was the case
for the following example:
feature_file contains (shortened for example purposes):
```
network_v9 {af_unix {yes
}
}
network_v8 {af_inet {yes
}
}
network {af_unix {yes
}
}
```
if the feature to be checked was simply "network", then walk_one would
return that the feature was not present.
Fix this by restarting the matching if there was not a full match at
the end of the feaure to check.
Fixes: https://bugs.launchpad.net/apparmor/+bug/2105986
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1608
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: John Johansen <john@jjmx.net>
Both the unconfined profile and unprivileged_userns are part of the
default notify.conf, so the default fallback when no configurations are
present should also match this default.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1609
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
--configdir is meant for testing and should override all other configs,
instead of being combined with them. Config combination causes aa-notify
test failures if e.g. the user-local config sets filtering options.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Both the unconfined profile and unprivileged_userns are part of the
default notify.conf, so the default fallback when no configurations are
present should also match this default.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
The feature matching done in aa_feature_supports calls walk_one to
traverse the features string. This function is supposed to match on
the feature and return, but it matches the feature based on the length
of the feature to check. If the feature to check shorter, then it
would return as if the feature was not present - which was the case
for the following example:
feature_file contains (shortened for example purposes):
network_v9 {af_unix {yes
}
}
network_v8 {af_inet {yes
}
}
network {af_unix {yes
}
}
if the feature to be checked was simply "network", then walk_one would
return that the feature was not present.
Fix this by restarting the matching if there was not a full match at
the end of the feaure to check.
Fixes: https://bugs.launchpad.net/apparmor/+bug/2105986
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Fixes https://bugs.launchpad.net/apparmor/+bug/2106033
Improve the validation of AARE file paths by introducing a new regex
that supports paths starting with '{' (e.g. '{/,/org/freedesktop/DBus}').
These paths are notably used in snap.lxd.* profiles.
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1607
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
These are the default directory mounts used by Flatpak's system cache for mounting revokefs-fuse. Unfortunately, the new rules are quite broad, but we might not be able to do much better than that.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1562
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
The original location of the error count checks in the middle of the priority function helper was completely nonsensical. We can instead do this check just once after running all the tests.
In addition, some tests in the priority helper don't use the priority variables at all, and are moved out of the helper to avoid repeating the exact same sequence of tests 16 times.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1604
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
The original location in the middle of the priority function helper was
completely nonsensical. We can instead do this check just once after
running all the tests.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Fixes https://bugs.launchpad.net/apparmor/+bug/2106033
Improve the validation of AARE file paths by introducing a new regex
that supports paths starting with '{' (e.g. '{/,/org/freedesktop/DBus}').
These paths are notably used in snap.lxd.* profiles.
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Fixes: https://bugs.launchpad.net/maas/+bug/2092232
In the lsblk profile, the rule responsible for allowing to read disks
over network was not generic enough to handle some cases, such as IBM
Power. The new rule, `@{sys}/devices/**/host@{int}/** r`, should support
all cases.
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1606
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Alex <alexandre@pujol.io>
Merged-by: Maxime Bélair <maxime.belair@canonical.com>
Fixes: https://bugs.launchpad.net/maas/+bug/2092232
In the lsblk profile, the rule responsible for allowing to read disks
over network was not generic enough to handle some cases, such as IBM
Power. The new rule, `@{sys}/devices/**/host@{int}/** r`, should support
all cases.
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
If the following scenario was present in a profile, cleanprof
would fail with a RecursionError exception (maximum recursion
depth exceeded)
/parent { }
/parent///child { }
This occured because in aa.py, in the write_piece function, the
wrong depth was being passed, along with a wrong hat. The
formatting of the spaces was also incorrect.
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1605
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
If the following scenario was present in a profile, cleanprof
would fail with a RecursionError exception (maximum recursion
depth exceeded)
/parent { }
/parent///child { }
This occured because in aa.py, in the write_piece function, the
wrong depth was being passed, along with a wrong hat. The
formatting of the spaces was also incorrect.
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Profiles that are defined like below did not have the parent attribute
set in profile storage:
/parent///child {}
The condition on which child profiles were written was also changed so
they are not removed from the profile if /parent does not exist.
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Commit c9d41a3ebb introduced a regression on profile header
generation.
This commit removes the name parameter from the get_header function
since the ProfileStorage should already contain all the information
required to generate the header for profiles and hats. The tests
needed to be updated as well to make sure the ProfileStorage object
contained the information needed by the get_header method.
Fixes: c9d41a3ebb ("utils: fix profile and hat header generation")
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1602
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
Commit c9d41a3ebb introduced a regression on profile header
generation.
This commit removes the name parameter from the get_header function
since the ProfileStorage should already contain all the information
required to generate the header for profiles and hats. The tests
needed to be updated as well to make sure the ProfileStorage object
contained the information needed by the get_header method.
Fixes: c9d41a3ebb ("utils: fix profile and hat header generation")
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Profile header was being generated incorrectly in 2 cases:
When the profile contained the parent profile in its name, as in
profile firefox//dash {
and in the unit tests, the child profile was being named as the parent
profile. This was not caught by the general case because the code has
not yet been fully adapted to handle multiple nested child profiles.
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/493
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Closes#493
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1592
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
We are seeing some test failures caused by the fact that a fixed kernel,
while available, is not installed the CI image. Since cloud-init does
not itself offer a way to express precise dependency on a package
version we may use a crude replacement of upgrading all the packages at
image construction time.
The next time this happens all we need is to touch the .image-garden.mk
file, so that it is more recent than the image kept in CI cache for the
re-generation to occur.
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1595
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
We are seeing some test failures caused by the fact that a fixed kernel,
while available, is not installed the CI image. Since cloud-init does
not itself offer a way to express precise dependency on a package
version we may use a crude replacement of upgrading all the packages at
image construction time.
The next time this happens all we need is to touch the .image-garden.mk
file, so that it is more recent than the image kept in CI cache for the
re-generation to occur.
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
The header was being generated incorrectly in 2 cases:
When the profile/hat contained the parent profile in its name, as in
profile firefox//dash {
hat ^firefox//dash {
and in the unit tests, the child profile or hat was being named as the
parent profile. This was not caught by the general case because the
code has not yet been fully adapted to handle multiple nested child
profiles.
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/493
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
The test is added as XFAIL for all images because the kernel patches
required for them to pass have not yet been upstreamed into any published
kernel.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
