debcrafters-packages team mailing list archive

[Andreas Hasenack <2123821@xxxxxxxxxxxxxxxxxx>]

Several things on unpack in that DENIED message:

a) "sendmsg": something is trying to send a message. Given that "name"
is a unix socket, it's presumably about writing to that socket.

b) rsyslogd profile is denying that operation

c) comm(and) is "systemd-journal". That doesn't make sense. rsyslogd
would not exec systemd-journal: that is a daemon. rsyslogd does link
with libsystemd, though, so perhaps the library is doing something?

d) denied_mask="r". What was denied was a read, not a write. That's
weird. "sendmsg" implies a write, but a read was denied. The rsyslogd
profile does allow a write to that dev-log socket (via the base
abstraction), and not a read. But something tried to read from it.
systemd-journal looks like, but why would that be confined by the
rsyslog profile??

e) To check for (c), I ran execsnoop on the vm do see if I could catch
an exec of systemd-journal, but no such exec happened.


So current theory is that somehow by virtue of linking with libsystemd, rsyslogd is trying to read from dev-log and that is being denied.

-- 
You received this bug notification because you are a member of
Debcrafters packages, which is subscribed to rsyslog in Ubuntu.
https://bugs.launchpad.net/bugs/2123821

Title:
  bad restriction: apparmor="DENIED" [...] namespace="root//lxd-n_<var-
  snap-lxd-common-lxd>" profile="rsyslogd"
  name="/run/systemd/journal/dev-log"

Status in apparmor package in Ubuntu:
  Invalid
Status in rsyslog package in Ubuntu:
  Confirmed

Bug description:
  On my Questing system running LXD containers, my kernel log is full of
  messages like:

  [  129.551382] audit: type=1400 audit(1757925628.229:1005):
  apparmor="DENIED" operation="sendmsg" class="file"
  namespace="root//lxd-q_<var-snap-lxd-common-lxd>" profile="rsyslogd"
  name="/run/systemd/journal/dev-log" pid=5370 comm="systemd-journal"
  requested_mask="r" denied_mask="r" fsuid=1000000 ouid=1000000

  One of my containers is named "q", hence the "root//lxd-q...". Some
  actual functionality is likely broken in the container.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2123821/+subscriptions