Comment 0 for bug 1691761

Revision history for this message
Mikhail Kurinnoi (viewizard) wrote :

I play around confined init (disabled SECURITY_APPARMOR_UNCONFINED_INIT kernel config option). And faced one issue connected to apparmor utils.

apparmor utils v 2.11.0

1) Kernel configured with disabled SECURITY_APPARMOR_UNCONFINED_INIT.
2) default profile not reloaded by user's default profile.
3) # ps aux -Z | grep "default"
   ...
default (-) root 2 0.0 0.0 0 0 ? S 16:16 0:00 [kthreadd]
default (-) root 3 0.0 0.0 0 0 ? S 16:16 0:00 [ksoftirqd/0]
   ...
4) # aa-status

Traceback (most recent call last):
  File "/usr/lib/python-exec/python3.4/aa-status", line 255, in <module>
    commands[cmd]()
  File "/usr/lib/python-exec/python3.4/aa-status", line 59, in cmd_verbose
    profiles = get_profiles()
  File "/usr/lib/python-exec/python3.4/aa-status", line 149, in get_profiles
    profiles[match.group(1)] = match.group(2)
AttributeError: 'NoneType' object has no attribute 'group'

1) Kernel configured with disabled SECURITY_APPARMOR_UNCONFINED_INIT.
2) default profile reloaded by user's default profile, for example:
profile default flags=(complain) {}
3) # ps aux -Z | grep "default"
   ...
default (complain) root 2 0.0 0.0 0 0 ? S 16:16 0:00 [kthreadd]
default (complain) root 3 0.0 0.0 0 0 ? S 16:16 0:00 [ksoftirqd/0]
   ...
4) # aa-status
  ...
142 processes are in complain mode.
   default (2)
   default (3)
  ...