ac100 team mailing list archive

[Stéphane Graber <stgraber@xxxxxxxxxxxx>]

Hello Federico, or anyone else affected,

Accepted apparmor into saucy-proposed. The package will build now and be
available at
http://launchpad.net/ubuntu/+source/apparmor/2.8.0-0ubuntu31.1 in a few
hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to
enable and use -proposed.  Your feedback will aid us getting this update
out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, and change the tag
from verification-needed to verification-done. If it does not fix the
bug for you, please add a comment stating that, and change the tag to
verification-failed.  In either case, details of your testing will help
us make a better decision.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance!

** Changed in: apparmor (Ubuntu Saucy)
       Status: In Progress => Fix Committed

** Tags added: verification-needed

-- 
You received this bug notification because you are a member of AC100
Team, which is subscribed to AC100_enablement.
https://bugs.launchpad.net/bugs/1231778

Title:
  wifi not working on Saucy Salamander

Status in Enablement project for the Toshiba AC100 NetBook:
  New
Status in AppArmor Linux application security framework:
  Fix Committed
Status in “apparmor” package in Ubuntu:
  Fix Released
Status in “network-manager” package in Ubuntu:
  Invalid
Status in “apparmor” source package in Saucy:
  Fix Committed
Status in “network-manager” source package in Saucy:
  Invalid
Status in “apparmor” source package in Trusty:
  Fix Released
Status in “network-manager” source package in Trusty:
  Invalid

Bug description:
  [Impact]

  On older kernels that are missing certain AppArmor patches related to
  AppArmor D-Bus mediation, the presence of dbus rules in the binary
  AppArmor policy will result in policy load failures and, as a result,
  applications may run unconfined. On newer kernels that are missing the
  same patches mentioned above, the policy load will succeed but the
  dbus rules will be quietly ignored.

  [Automated Test Case]

  * test_lp1231778 has been added to QRT's test-apparmor.py script
  * Run the test under the latest Saucy, Raring, and Lucid kernels to excercise all possible test load scenarios

  [Manual Test Case]

  * Install and reboot into older, unpatched mainline kernel (such as
  3.1.10-030110-generic)

  * Bad test results on the mainline 3.1.10 kernel:
  $ echo "/t { dbus, }" | sudo apparmor_parser -r
  Cache read/write disabled: /sys/kernel/security/apparmor/features interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
  Warning from stdin (line 1): apparmor_parser: cannot use or update cache, disable, or force-complain via stdin
  apparmor_parser: Unable to replace "/t".  Profile doesn't conform to protocol

  * Good test results on the mainline 3.1.10 kernel with a patched apparmor_parser:
  $ echo "/t { dbus, }" | sudo apparmor_parser -r
  Cache read/write disabled: /sys/kernel/security/apparmor/features interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
  Warning from stdin (line 1): apparmor_parser: cannot use or update cache, disable, or force-complain via stdin
  Warning from stdin (stdin line 2): profile /t dbus rules not enforced

  * Install and reboot into newer, unpatched mainline kernel (such as
  3.12.0-031200-generic)

  * Bad test results on the mainline 3.12.0 kernel:
  $ echo "/t { dbus, }" | sudo apparmor_parser -r
  Warning from stdin (line 1): apparmor_parser: cannot use or update cache, disable, or force-complain via stdin

  * Good test results on the mainline 3.12.0 kernel with a patched apparmor_parser:
  $ echo "/t { dbus, }" | sudo apparmor_parser -r
  Warning from stdin (line 1): apparmor_parser: cannot use or update cache, disable, or force-complain via stdin
  Warning from stdin (stdin line 2): profile /t dbus rules not enforced

  * Reboot into Ubuntu 3.11.0-12-generic kernel

  * Good test results on the Ubuntu 3.11.0-12-generic kernel with or without a patched apparmor_parser:
  $ echo "/t { dbus, }" | sudo apparmor_parser -r
  Warning from stdin (line 1): apparmor_parser: cannot use or update cache, disable, or force-complain via stdin

  * Verify that dbus mediation occurs under the Ubuntu 3.11.0-12-generic kernel:
  $ echo "profile nodbus { file, }" | sudo apparmor_parser -rq
  $ dbus-send --print-reply --system --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.ListNames | head
  method return sender=org.freedesktop.DBus -> dest=:1.51 reply_serial=2
     array [
        string "org.freedesktop.DBus"
  ...
  $ aa-exec -p nodbus -- dbus-send --print-reply --system --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.ListNames
  Failed to open connection to "system" message bus: An AppArmor policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender="(null)" (inactive) interface="org.freedesktop.DBus" member="Hello" error name="(unset)" requested_reply="0" destination="org.freedesktop.DBus" (bus)

  [Regression Potential]

  * The regression potential is minor because the fix is small and easy
  to test

  [Original Bug Report]

  Note that apparmor_parser warns that the dbus rule(s) will not be
  enforced and then loads the binary policy without any dbus rules.

  Lubuntu 13.10 installed from daily image have wifi not working, even
  with BT disabled.

  confirmed by stuw on IRC at Sun Sep 22
  15:40 < stuw> iz1glg, I saw similar problem, but I don't know the reason and solution.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ac100/+bug/1231778/+subscriptions