Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 543502 - sys-apps/apparmor not working with sys-kernel/vanilla-sources
Summary: sys-apps/apparmor not working with sys-kernel/vanilla-sources
Status: RESOLVED WONTFIX
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Hardened (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Michael Palimaka (kensington)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-16 12:05 UTC by Oleg Gawriloff
Modified: 2018-01-01 02:40 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Oleg Gawriloff 2015-03-16 12:05:18 UTC
When using sys-apps/apparmor-2.8.4 and sys-kernel/vanilla-sources-3.4.106 (or 3.10.71) we have following error during startup of apparmor init.d:
AppArmor parser error for /etc/apparmor.d/usr.sbin.nscd in /etc/apparmor.d/usr.sbin.nscd at line 19: ???????????? ??????????? block_suspend.
 *   /etc/apparmor.d/usr.sbin.nscd failed to load

after that aa-status fails with:
albatros2-vbox1 apparmor # aa-status
apparmor module is loaded.
You do not have enough privilege to read the profile set.

According to http://wiki.gentoo.org/wiki/AppArmor apparmor should work with vanilla-kernel. But in apparmor ebuild I didn't find any sings of applying apparmor kernel-patches (which lies is kernel-patches/3.4 dir in apparmor distfile).

Also I should mention that according to http://wiki.apparmor.net/index.php/AppArmor_versions kernel version supported is 3.3 and up and there is no any restriction on it in ebuild (also check kernel option CONFIG_SECURITY_APPARMOR is present in kernel config is absent).


Reproducible: Always
Comment 1 Michael Palimaka (kensington) gentoo-dev 2015-03-16 13:11:40 UTC
(In reply to Oleg Gawriloff from comment #0)
> When using sys-apps/apparmor-2.8.4 and sys-kernel/vanilla-sources-3.4.106
> (or 3.10.71) we have following error during startup of apparmor init.d:
> AppArmor parser error for /etc/apparmor.d/usr.sbin.nscd in
> /etc/apparmor.d/usr.sbin.nscd at line 19: ???????????? ???????????
> block_suspend.

I'm assuming the error message there is 'Invalid capability', which is expected since BLOCK_SUSPEND exists only in >=3.5 (it was called EPOLLWAKEUP before that).
Comment 2 Oleg Gawriloff 2015-03-16 13:19:34 UTC
Yes, I'm figured it out. And commented in nscd file (I assume there should be also check for kernel version for that not support it, or at least not bundle it to load at startup if there can be a kernel vesion dependency).

PS: After appying patches from kernel-patches/3.4 to vanilla-sources all working as intended.
Comment 3 Michael Palimaka (kensington) gentoo-dev 2015-03-16 13:30:45 UTC
There's no version check because there isn't any reliable information about what the minimum should be. It's not possible to have AppArmor patch the kernel automatically because a package cannot interfere with the install files of another package.
Comment 4 Oleg Gawriloff 2015-03-16 13:42:20 UTC
Then at least docs at http://wiki.gentoo.org/wiki/AppArmor should be changed with mention that patching of vanilla-sources is needed.
Comment 5 Oleg Gawriloff 2015-04-01 09:56:40 UTC
I moved to hardened-sources-3.14 (expecting that there apparmor will be usable without any patches) and found another 'missing patch problem' that is described here:
https://forums.gentoo.org/viewtopic-p-7694104.html
It seems that it requires at least apparmor 2.9.4 which is not in portage now and again applying patches from aparmor sources to kernel-sources.

So, it turns out that apparmor support in Gentoo is somewhat broken, and keeping in mind https://bugs.gentoo.org/show_bug.cgi?id=496040 which exactly says:
"AppArmor support in Gentoo is pretty much limited to what upstream provides due to manpower/interest. The hardened team isn't able to take care of yet another MAC and although I'm the primary AppArmor maintainer, my interest is more academic so I can't vouch for and maintain a patch set for hardened-sources."

There is smth that should be pointed out at documentation at http://wiki.gentoo.org/wiki/AppArmor. And if _that_ MAC is not supported the question is _which_ MAC is supported?
Comment 6 Michael Palimaka (kensington) gentoo-dev 2015-04-01 10:04:20 UTC
It is a wiki after all, so feel free to update it with any new information.

Otherwise, unfortunately the situation hasn't changed so support is still limited to vanilla upstream.
Comment 7 Oleg Gawriloff 2015-04-01 13:35:28 UTC
Yes. But as I see Gentoo a lit bit unconvient for any apparmor uses, because in current state 'gentoo way' is make a separate vanilla/hardened overlay with appropriate apparmor patches.
Is there any problems to add those 4 patches from apparmor to hardened sources?
Comment 8 Michael Palimaka (kensington) gentoo-dev 2015-04-01 13:41:53 UTC
Previously they were declined from hardened-sources since nobody was working to test them and keep them up to date.
Comment 9 Michael Palimaka (kensington) gentoo-dev 2018-01-01 02:40:46 UTC
Unfortunately it seems unlikely that anyone is going to pick up maintaining the custom patchset.