Ubuntu
apparmor package

/etc/init.d/apparmor reload complains if /var/lib/apparmor/profiles doesn't have profiles

Bug #1295816 reported by Jamie Strandboge
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
Fix Released
Low
Jamie Strandboge
Ubuntu ubuntu-14.04

Bug Description

On a new trusty install with click-apparmor installed:
$ sudo /etc/init.d/apparmor reload
 * Reloading AppArmor profiles
Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
Warning from stdin (line 1): /sbin/apparmor_parser: cannot use or update cache, disable, or force-complain via stdin

Add ing 'set -x' to /lib/apparmor/functions, we can see why:

+ [ ! -d /var/lib/apparmor/profiles ]
+ wc -l
+ find /var/lib/apparmor/profiles -type f
+ num=2
+ [ 2 = 0 ]
+ cache_args=--cache-loc=/etc/apparmor.d/cache
+ [ /var/lib/apparmor/profiles = /var/lib/apparmor/profiles ]
+ [ -d /var/cache/apparmor ]
+ cache_args=--cache-loc=/var/cache/apparmor
+ getconf _NPROCESSORS_ONLN
+ + read profile
egrep+ -v (\.dpkg-(new|old|dist|bak)|~)$
ls -1 /var/lib/apparmor/profiles
+ xargs -n1 -d\n -P1 /sbin/apparmor_parser --write-cache --replace --cache-loc=/var/cache/apparmor --
Warning from stdin (line 1): /sbin/apparmor_parser: cannot use or update cache, disable, or force-complain via stdin

The two files that are there are:
$ ls -a /var/lib/apparmor/profiles/.a*
/var/lib/apparmor/profiles/.apparmor-easyprof-ubuntu.md5sums
/var/lib/apparmor/profiles/.apparmor.md5sums

but these are state files, not profiles. Ideally they wouldn't exist and this will go away when we revamp policy load, but we should probably do this:
num=`find "$pdir" -type f ! -regex '.*\.md5sums$' | wc -l`

instead of:
num=`find "$pdir" -type f | wc -l`

See original description
Jamie Strandboge (jdstrand)
Changed in apparmor (Ubuntu):
status: New → Triaged
importance: Undecided → Low
Jamie Strandboge (jdstrand)
summary: - /etc/init.d/apparmor reload complains if /var/lib/apparmor/profiles is
- empty
+ /etc/init.d/apparmor reload complains if /var/lib/apparmor/profiles
+ doesn't have profiles
Jamie Strandboge (jdstrand)
description: updated
Changed in apparmor (Ubuntu):
milestone: none → ubuntu-14.04
Jamie Strandboge (jdstrand)
Changed in apparmor (Ubuntu):
status: Triaged → In Progress
Jamie Strandboge (jdstrand)
description: updated
Jamie Strandboge (jdstrand)
Changed in apparmor (Ubuntu):
status: In Progress → Fix Committed
assignee: nobody → Jamie Strandboge (jdstrand)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.8.95~2430-0ubuntu3

---------------
apparmor (2.8.95~2430-0ubuntu3) trusty; urgency=medium

  [ Jamie Strandboge ]
  * debian/lib/apparmor/functions: properly calculate number of profiles in
    /var/lib/apparmor/profiles (LP: #1295816)
  * autostart aa-notify via /etc/xdg/autostart instead of /etc/X11/Xsession.d
    (LP: #1288241)
    - remove debian/notify/90apparmor-notify
    - add debian/notify/apparmor-notify.desktop
    - debian/apparmor-notify.install: adjust for the above
    - add debian/apparmor-notify.maintscript to remove 90apparmor-notify
  * debian/notify/notify.conf: use_group should be set to "sudo" instead of
    "admin" (LP: #1009666)

  [ Tyler Hicks ]
  * debian/patches/initialize-mount-flags.patch: Initialize the variables
    containing mount rule flags to zero. Otherwise, the parser may set
    unexpected bits in the mount flags field for rules that do not specify
    mount flags. The uninitialized mount flag variables may have caused
    unexpected AppArmor denials during mount mediation. (LP: #1296459)
  * debian/patches/fix-typo-in-dbus_write.patch: Fix a bug in the
    apparmor/aa.py module that caused the utilities in the apparmor-utils
    package to write out network rules instead of dbus rules
  * debian/patches/limited-mount-rule-support.patch: Fix a bug in the
    apparmor/aa.py module that caused the utilities in the apparmor-utils
    package to traceback when encountering a mount rule (LP: #1294825)
  * debian/patches/bare-capability-rule-support.patch: Fix a bug in the
    apparmor/aa.py module that caused the utilities in the apparmor-utils
    package to traceback when encountering a bare capability rule
    (LP: #1294819)
  * debian/patches/check-config-for-sysctl.patch,
    debian/patches/increase-swap-size.patch: Fix bugs in the regression test
    suite that caused errors when running on ppc64el
  * debian/patches/test-v6-policy.patch,
    debian/patches/test-mount-mediation.patch: Improve the regression tests
    by increasing the mount rule test coverage
 -- Tyler Hicks <email address hidden> Thu, 27 Mar 2014 14:12:29 -0500

Changed in apparmor (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.