AppArmor denied message in precise

Bug #912754 reported by Marc Deslauriers
16
This bug affects 3 people
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
Fix Released
Low
Jamie Strandboge

Bug Description

When booting precise, I get the following AppArmor message:

[ 134.888984] type=1400 audit(1325856016.434:32): apparmor="DENIED" operation="open" parent=1 profile="/usr/sbin/cupsd" name="/etc/pkcs11/modules/" pid=2529 comm="cupsd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: cups 1.5.0-13bzr1
ProcVersionSignature: Ubuntu 3.2.0-7.13-generic 3.2.0-rc7
Uname: Linux 3.2.0-7-generic x86_64
ApportVersion: 1.90-0ubuntu1
Architecture: amd64
Date: Fri Jan 6 08:30:29 2012
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Alpha amd64 (20110302)
Lpstat:
 device for LaserJet-CP2025dn: hp:/net/HP_Color_LaserJet_CP2025dn?zc=NPI8209DF
 device for Officejet-J4680: hp:/net/Officejet_J4680_series?zc=HPOccam
MachineType: LENOVO 4313CTO
Papersize: letter
PpdFiles:
 LaserJet-CP2025dn: HP Color LaserJet cp2025dn pcl3, hpcups 3.11.10
 Officejet-J4680: HP Officejet j4680 Series, hpcups 3.11.10
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.2.0-7-generic root=UUID=66b32bb3-1e18-436e-8f6e-62b8419ed48d ro quiet splash vt.handoff=7
SourcePackage: cups
UpgradeStatus: Upgraded to precise on 2012-01-03 (2 days ago)
dmi.bios.date: 05/24/2011
dmi.bios.vendor: LENOVO
dmi.bios.version: 6MET86WW (1.46 )
dmi.board.name: 4313CTO
dmi.board.vendor: LENOVO
dmi.board.version: Not Available
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Not Available
dmi.modalias: dmi:bvnLENOVO:bvr6MET86WW(1.46):bd05/24/2011:svnLENOVO:pn4313CTO:pvrThinkPadT510:rvnLENOVO:rn4313CTO:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
dmi.product.name: 4313CTO
dmi.product.version: ThinkPad T510
dmi.sys.vendor: LENOVO

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :
Revision history for this message
Till Kamppeter (till-kamppeter) wrote :

pitti, this is a problem of the AppArmor config. Can you have a look into this? Thanks.

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Actually, this is likely going to be fixed in an abstraction since it affects telepathy also.

Changed in cups (Ubuntu):
status: New → Triaged
importance: Undecided → Low
Revision history for this message
Martin Pitt (pitti) wrote :

Indeed, I think it makes more sense in <abstractions/authentication> or similar.

affects: cups (Ubuntu) → apparmor (Ubuntu)
Changed in apparmor (Ubuntu):
status: Triaged → In Progress
Changed in apparmor (Ubuntu):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (4.0 KiB)

This bug was fixed in the package apparmor - 2.7.0-0ubuntu1

---------------
apparmor (2.7.0-0ubuntu1) precise; urgency=low

  * New upstream release. Fixes the following:
    - LP: #794974
    - LP: #815883
    - LP: #840973
  * Drop the following patches, included upstream:
    - af_names-generation.patch
    - 0004-adjust-logprof-log-search-order.patch
    - 0005-lp826914.patch
    - 0006-lp838275.patch
    - 0007-fix-introspection-tests.patch
  * Rename 0003-add-debian-integration-to-lighttpd.patch to 0002
  * debian/patches/0003-commits-through-r1882.patch: several bug,
    documentation and performance fixes on our road to AppArmor 2.8
    (LP: #840734, LP: #905412)
  * debian/patches/0004-lp887992.patch: cups-client abstraction should allow
    owner read of @{HOME}/.cups/client.conf and @{HOME}/.cups/lpoptions
    (LP: #887992)
  * update debian/patches/0001-add-chromium-browser.patch for deeper
    directories of /sys/devices/pci (LP: #885833)
  * debian/patches/0005-lp884748.patch: allow kate as text editor in the
    browsers abstraction (LP: #884748)
  * debian/patches/0006-lp870992.patch: abstractions/fonts should allow access
    to ~/.fonts.conf.d (LP: #870992)
  * debian/patches/0007-lp860856.patch: allow read access to sitecustomize.py
    in the python abstraction, which is needed for apport hooks to work in
    python applications (LP: #860856)
  * debian/patches/0008-lp852062.patch: update binaries for transmission
    clients (LP: #852062)
  * debian/patches/0009-lp851977.patch: allow ixr access to exo-open for
    Xubuntu and friends (LP: #851977)
  * debian/patches/0010-lp890894.patch: allow access to Thunar as well as
    thunar in ubuntu-integration abstraction (LP: #890894)
  * debian/patches/0011-lp817956.patch: update usr.sbin.sshd example profile
    (LP: #817956)
  * debian/patches/0012-lp458922.patch: update dovecot deliver profile to
    access various .conf files for dovecot (LP: #458922)
  * debian/patches/0013-lp769148.patch: allow avahi to do dbus introspection
    (LP: #769148)
  * debian/patches/0014-lp904548.patch: fix typo for multiarch line for gconv
    (LP: #904548)
  * debian/patches/0015-lp712584.patch: Nvidia users need access to
    /dev/nvidia* files for various plugins to work right. Since these are all
    focused around multimedia, add the acceses to the multimedia abstraction.
    (LP: #712584)
  * debian/patches/0016-lp562831.patch: allow fireclam plugin to work
    (LP: #562831)
  * debian/patches/0017-lp662906.patch: allow software-center in the ubuntu
    integration browser abstraction (LP: #662906)
  * debian/patches/0018-deny-home-pki-so.patch: update private-files
    abstraction to deny write and link to ~/.pki/nssdb/*so files (LP: #911847)
  * debian/patches/0019-lp899963.patch: add audacity to the
    ubuntu-media-players abstraction (LP: #899963)
  * debian/patches/0020-lp912754a.patch,0021-lp912754b.patch: add p11-kit
    abstraction and add it to the authentication abstraction (LP: #912754)
  * debian/patches/0022-workaround-lp851986.patch: instead of using Ux
    in the ubuntu and launchpad abstractions, use a helper child profile.
    This will help work around the lack of en...

Read more...

Changed in apparmor (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
Ilya (iva2k) wrote :

I also received the same error for slapd:

Jul 23 09:14:16 fs1 kernel: [244335.632000] type=1400 audit(1374596056.945:53): apparmor="DENIED" operation="open" parent=29577 profile="/usr/sbin/slapd" name="/etc/pkcs11/modules/" pid=29578 comm="slapd" requested_mask="r" denied_mask="r" fsuid=114 ouid=0

Should "#include <abstractions/p11-kit>" be also added to /etc/apparmor.d/usr.sbin.slapd? I realize it's a part of slapd installation package and perhaps should be reported there.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.