Glibc in 2.36 and later will [1] access sysfs at
/sys/devices/system/cpu/possible when usig sysconf
for _SC_NPROCESSORS_CONF.
That will make a lot of different code, for example
anything linked against libnuma, trigger this apparmor
denial.
apparmor="DENIED" operation="open" class="file" ...
name="/sys/devices/system/cpu/possible" ...
requested_mask="r" denied_mask="r" fsuid=0 ouid=0

This entry seems rather safe, and it follows others
that are already in place. Instead of fixing each
software individually this should go into the base
profile as well.
Initially reported via
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1989073
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/267
MR: none - ML
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit c159d0925a)
Signed-off-by: John Johansen <john.johansen@canonical.com>
When WSL automatically generates a resolv.conf for an instance, the /etc/resolv.conf file is a symlink to /mnt/wsl/resolv.conf. This patch adds an entry for this to the other policies to handle such management.
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/935
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 8fa77e9e6c)
5232eaa2 Adds /mnt/wsl/resolv.conf to nameservices.
`codecs.open()` splits lines at unexpected characters like 0x1d.
Switch `open_file_*()` to use `open()` which does not have this problem.
(Note: 3.1 and master already use `open()`.)
This fixes the test failure introduced in the 3.0 branch in commit
ea681c4638 which contains an example log
with a 0x1d character.
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/945
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
`codecs.open()` splits lines at unexpected characters like 0x1d.
Switch `open_file_*()` to use `open()` which does not have this problem.
(Note: 3.1 and master already use `open()`.)
This fixes the test failure introduced in the 3.0 branch in commit
ea681c4638 which contains an example log
with a 0x1d character.
... instead of slicing to check for prefixes and suffixes.
This change prevents a crash in aa-mergeprof - if `replacement` is empty,
trying to access `replacement[0]` causes an IndexError.
Using `.startswith()` works without crashing.
This backports parts of the severity.py changes in
commit 091c6ad59d
by Mark Grassi.
I propose this fix for 2.13 and 3.0. (3.1 and master already have this fix.)
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/931
Approved-by: Jon Tourville <jon.tourville@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
... instead of slicing to check for prefixes and suffixes.
This change prevents a crash in aa-mergeprof - if `replacement` is empty,
trying to access `replacement[0]` causes an IndexError.
Using `.startswith()` works without crashing.
This backports parts of the severity.py changes in
commit 091c6ad59d
by Mark Grassi.
Note: This was reported for /usr/libexec/libvirt_leaseshelper, but since
this is probably unrelated to the path or a path change, this commit
also adds r permissions for the previous path.
Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1202161
I propose this patch for 3.0 and master (optionally also for 2.12 and 2.13 - please tell me if you want that after reviewing the patch, or just merge ;-)
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/905
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit f51049ea2e)
c9c5208f dnsmasq: Add missing r permissions for libvirt_leaseshelper
test -f ./.libs/$(EXPECTED_SO_NAME)||{echo'*** unexpected .so name/number for libapparmor (expected $(EXPECTED_SO_NAME), the actual filename is shown below) ***'; ls -l ./.libs/libapparmor.so.*.* ;exit 1;}
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
