← Back to team overview

kernel-packages team mailing list archive

[Bug 1560583] Re: reading /sys/kernel/security/apparmor/profiles requires CAP_MAC_ADMIN


To clarify "necessary to open up".

1. the old behavior was wrong. It allowed introspection of policy in situation that it should not have.
2. In order to open up the profiles file so that more than the system root could introspect it, DAC restrictions needed to be removed and the permission checking of what is allowed needed to be moved fully into apparmor. Since there was not time for fine grained mediation in the first iteration, the tightest restriction with original intent was used.

That is that only the policy admin is allowed fully view of loaded
policy. This can be opened up with further development but is the
original intent of how policy introspection was supposed to work (hence
#1 noting that implementation was flawed and wrong).

You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.

  reading /sys/kernel/security/apparmor/profiles requires CAP_MAC_ADMIN

Status in linux package in Ubuntu:
  Fix Committed
Status in linux source package in Xenial:
  Fix Committed

Bug description:
  $ cat ./t
  #include <tunables/global>

  profile t {
     #include <abstractions/base>
     /bin/cat ixr,
     /sys/kernel/security/apparmor/profiles r,

  $ sudo apparmor_parser -r ./t
  $ sudo aa-exec -p t -- cat /sys/kernel/security/apparmor/profiles 
  cat: /sys/kernel/security/apparmor/profiles: Permission denied

  kernel: [   62.203035] audit: type=1400 audit(1458665428.726:128):
  apparmor="DENIED" operation="capable" profile="t" pid=3683 comm="cat"
  capability=33  capname="mac_admin"

  This is new in the -15 kernel.

To manage notifications about this bug go to: