Skip to content
Snippets Groups Projects
Commit e964f819 authored by Frederic Danis's avatar Frederic Danis
Browse files

Fix access to run/systemd/notify for systemd-logind in apparmor rule

Systemd-logind fails to start in SDK, preventing other subsystem like
PipeWire or WirePlumber to start, with error:
- kernel: audit: type=1400 audit(1623416689.776:50): apparmor="DENIED"
  operation="sendmsg" info="Failed name lookup - disconnected path"
  error=-13 profile="/lib/systemd/systemd-logind" name="run/systemd/notify"
  pid=393 comm="systemd-logind" requested_mask="w" denied_mask="w" fsuid=0
  ouid=0

From https://lists.ubuntu.com/archives/apparmor/2018-July/011718.html about
`attach_disconnected` flag, this error occurs for:
> a fd that was opened outside of the namespace and "passed in".
> The "passed in" could be via some fd passing scheme, process inheritance
> - file open at exec, process inheritance - file open at clone newns,
> unshare, setns, or file open at pivot_root/chroot with the fd outside of
> the new root.

AppArmor's default behavior is to reject new accesses to disconnected paths
reporting back the pathname without a leading `/`. Unfortunately this can
break some applications, if a profile must allow for mediation of
disconnected paths then the profile flag `attach_disconnected` can be used.
This prepend a leading `/` to the reported name, however this may not
result in the original name of the file as AppArmor can only attach the
file to root, not to its original location.

See https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.5#path-name-lookup-and-mediation-of



Signed-off-by: default avatarFrédéric Danis <frederic.danis@collabora.com>
parent 9c290029
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment