mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-06 17:31:01 +01:00
2aabf0c0f0
Merge branch 'update-java' into 'master'
I have discovered denies on Debian Sid by Thunderbird being unable to load IcedTead plugin upon profile creation (can be reproduced by deleteing/moving `$HOME/.thunderbird` directory).
Additionally, profile was tested with (modified) `usr.lib.firefox.firefox` and made it run some random IcedTea applet successfully [0].
There are still denies for `/usr/bin/logger`, but I left this for later patches.
Please note that path to Java 9 binary is different that to previous versions.
Relevant DENIED messages:
```
type=AVC msg=audit(1511099962.556:810): apparmor="DENIED" operation="file_mmap" profile="thunderbird" name="/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so" pid=5186 comm="thunderbird" requested_mask="m" denied_mask="m" fsuid=1000 ouid=0
type=SYSCALL msg=audit(1511099962.556:810): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=296bc8 a2=5 a3=802 items=0 ppid=1541 pid=5186 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=3 comm="thunderbird" exe="/usr/lib/thunderbird/thunderbird" key=(null)
type=PROCTITLE msg=audit(1511099962.556:810): proctitle="/usr/lib/thunderbird/thunderbird"
```
```
type=AVC msg=audit(1511100105.471:1018): apparmor="DENIED" operation="open" profile="/usr/lib/firefox{,-esr}/firefox{,-esr}{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/icedteaplugin-vincas-gHIeGy/6064-icedteanp-plugin-debug-to-appletviewer" pid=6073 comm="java" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
type=SYSCALL msg=audit(1511100105.471:1018): arch=c000003e syscall=2 success=no exit=-13 a0=7f3638000cb0 a1=0 a2=1b6 a3=7f36ae502620 items=0 ppid=6064 pid=6073 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=3 comm="java" exe="/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java" key=(null)
type=PROCTITLE msg=audit(1511100105.471:1018): proctitle=2F7573722F6C69622F6A766D2F6A6176612D382D6F70656E6A646B2D616D6436342F62696E2F6A617661002D44696365647465612D7765622E62696E2E6C6F636174696F6E3D2F7573722F62696E2F6A6176617773002D44696365647465612D7765622E62696E2E6E616D653D6A6176617773002D58626F6F74636C61737370
```
```
type=AVC msg=audit(1511100105.471:1019): apparmor="DENIED" operation="open" profile="/usr/lib/firefox{,-esr}/firefox{,-esr}{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/icedteaplugin-vincas-gHIeGy/6064-icedteanp-plugin-to-appletviewer" pid=6073 comm="java" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
type=SYSCALL msg=audit(1511100105.471:1019): arch=c000003e syscall=2 success=no exit=-13 a0=7f36a822bdc0 a1=0 a2=1b6 a3=10002ae08 items=0 ppid=6064 pid=6073 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=3 comm="java" exe="/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java" key=(null)
type=PROCTITLE msg=audit(1511100105.471:1019): proctitle=2F7573722F6C69622F6A766D2F6A6176612D382D6F70656E6A646B2D616D6436342F62696E2F6A617661002D44696365647465612D7765622E62696E2E6C6F636174696F6E3D2F7573722F62696E2F6A6176617773002D44696365647465612D7765622E62696E2E6E616D653D6A6176617773002D58626F6F74636C61737370
```
```
type=AVC msg=audit(1511100221.153:1132): apparmor="DENIED" operation="open" profile="/usr/lib/firefox{,-esr}/firefox{,-esr}{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/icedteaplugin-vincas-JY8Sat/6405-icedteanp-appletviewer-to-plugin" pid=6414 comm="java" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
type=SYSCALL msg=audit(1511100221.153:1132): arch=c000003e syscall=2 success=no exit=-13 a0=7f20e025e280 a1=241 a2=1b6 a3=10002ae08 items=0 ppid=6405 pid=6414 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=3 comm="java" exe="/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java" key=(null)
type=PROCTITLE msg=audit(1511100221.153:1132): proctitle=2F7573722F6C69622F6A766D2F6A6176612D382D6F70656E6A646B2D616D6436342F62696E2F6A617661002D44696365647465612D7765622E62696E2E6C6F636174696F6E3D2F7573722F62696E2F6A6176617773002D44696365647465612D7765622E62696E2E6E616D653D6A6176617773002D58626F6F74636C61737370
```
[0] https://centra.tecnico.ulisboa.pt/~amaro/Spline3D.html
See merge request https://gitlab.com/apparmor/apparmor/merge_requests/13/
|
||
|---|---|---|
| .. | ||
| apparmor_api | ||
| ubuntu-browsers.d | ||
| apache2-common | ||
| aspell | ||
| audio | ||
| authentication | ||
| base | ||
| bash | ||
| consoles | ||
| cups-client | ||
| dbus | ||
| dbus-accessibility | ||
| dbus-accessibility-strict | ||
| dbus-session | ||
| dbus-session-strict | ||
| dbus-strict | ||
| dconf | ||
| dovecot-common | ||
| enchant | ||
| fcitx | ||
| fcitx-strict | ||
| fonts | ||
| freedesktop.org | ||
| gnome | ||
| gnupg | ||
| ibus | ||
| kde | ||
| kerberosclient | ||
| launchpad-integration | ||
| ldapclient | ||
| libpam-systemd | ||
| likewise | ||
| mdns | ||
| mir | ||
| mozc | ||
| mysql | ||
| nameservice | ||
| nis | ||
| nvidia | ||
| openssl | ||
| orbit2 | ||
| p11-kit | ||
| perl | ||
| php | ||
| php5 | ||
| postfix-common | ||
| private-files | ||
| private-files-strict | ||
| python | ||
| ruby | ||
| samba | ||
| smbpass | ||
| ssl_certs | ||
| ssl_keys | ||
| svn-repositories | ||
| ubuntu-bittorrent-clients | ||
| ubuntu-browsers | ||
| ubuntu-console-browsers | ||
| ubuntu-console-email | ||
| ubuntu-email | ||
| ubuntu-feed-readers | ||
| ubuntu-gnome-terminal | ||
| ubuntu-helpers | ||
| ubuntu-konsole | ||
| ubuntu-media-players | ||
| ubuntu-unity7-base | ||
| ubuntu-unity7-launcher | ||
| ubuntu-unity7-messaging | ||
| ubuntu-xterm | ||
| user-download | ||
| user-mail | ||
| user-manpages | ||
| user-tmp | ||
| user-write | ||
| video | ||
| wayland | ||
| web-data | ||
| winbind | ||
| wutmp | ||
| X | ||
| xad | ||
| xdg-desktop | ||