FS#68943 - AppArmor aa_getcon fails on LTS kernel
Attached to Project:
Arch Linux
Opened by David Parrish (dmp1ce) - Friday, 11 December 2020, 15:00 GMT
Last edited by Andreas Radke (AndyRTR) - Wednesday, 21 April 2021, 12:00 GMT
Opened by David Parrish (dmp1ce) - Friday, 11 December 2020, 15:00 GMT
Last edited by Andreas Radke (AndyRTR) - Wednesday, 21 April 2021, 12:00 GMT
|
Details
Description:
AppArmor on LTS seems to behave differently than non-LTS kernels. Running the following script (https://gist.github.com/bboozzoo/840cdbd066ab81ca438fab6b0b75ea1b) I get an error: ``` david@bar:/tmp/apparmor_test$ gcc a.c -lapparmor david@bar:/tmp/apparmor_test$ ls a.c a.out david@bar:/tmp/apparmor_test$ ./a.out aa_getcon: Invalid argument 1 david@bar:/tmp/apparmor_test$ uname -a Linux bar 5.4.82-1-lts #1 SMP Tue, 08 Dec 2020 12:10:59 +0000 x86_64 GNU/Linux ``` Script: ``` // gcc -lapparmor #include <sys/apparmor.h> #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { char *label, *mode = NULL; if (aa_getcon(&label, &mode) == -1) { perror("aa_getcon"); exit(EXIT_FAILURE); } printf("label: %s\nmode: %s\n", label, mode); free(label); free(mode); return 0; } ``` I'm not sure the reason for this, but it is causing some of my custom application to fail on LTS. Steps to reproduce: 1. Install LTS 2. Setup AppArmor 3. Try to run the aa_getcon function as shown in the gist: https://gist.github.com/bboozzoo/840cdbd066ab81ca438fab6b0b75ea1b |
This task depends upon
Closed by Andreas Radke (AndyRTR)
Wednesday, 21 April 2021, 12:00 GMT
Reason for closing: None
Additional comments about closing: current supported LTS kernel is 5.10.x
Wednesday, 21 April 2021, 12:00 GMT
Reason for closing: None
Additional comments about closing: current supported LTS kernel is 5.10.x
If you still can reproduce this, can you attach the output from running your test program under strace? e.g. "strace -f -o apparmor_test.output ./a.out".
Doing so would help confirm whether the issue that is causing the problem you're experiencing is what I think it might be.
Thanks!
```
david@bar:/tmp$ gcc a.c -lapparmor
david@bar:/tmp$ ./a.out
label: unconfined
mode: (null)
david@bar:/tmp$ uname -a
Linux bar 5.10.17-1-lts #1 SMP Wed, 17 Feb 2021 11:11:31 +0000 x86_64 GNU/Linux
```
```
david@bar:/tmp$ gcc a.c -lapparmor
david@bar:/tmp$ ./a.out
label: unconfined
mode: (null)
david@bar:/tmp$ uname -a
Linux bar 5.10.16-arch1-1 #1 SMP PREEMPT Sat, 13 Feb 2021 20:50:18 +0000 x86_64 GNU/Linux
```
[1] https://wiki.archlinux.org/index.php/Unofficial_user_repositories#kernel-lts
I'm not interested in the 5.4 kernel anymore though. Perhaps someone can reproduce with the steps I provided.