Re: Apparmor (and other) Issues

[Andrea Bolognani <abologna@redhat.com>]

On Tue, Feb 04, 2025 at 09:50:00AM +0100, Stefano Brivio wrote:
> On Tue, 04 Feb 2025 08:21:53 +0000 Prafulla Giri <prafulla.giri@protonmail.com> wrote:
> > type=SERVICE_START msg=audit(1738501309.082:134): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=polkit comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
> > type=AVC msg=audit(1738501309.118:135): apparmor="DENIED" operation="file_mmap" class="file" profile="passt" name="/usr/bin/passt" pid=2030 comm="passt" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0FSUID="larryboy" OUID="root"
> > type=SYSCALL msg=audit(1738501309.118:135): arch=c000003e syscall=59 success=no exit=-13 a0=7faf24035fc0 a1=7faf24035210 a2=7ffc063280d0 a3=0 items=0 ppid=1964 pid=2030 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="passt" exe="/usr/bin/passt" subj=passt key=(null)ARCH=x86_64 SYSCALL=execve AUID="larryboy" UID="larryboy" GID="larryboy" EUID="larryboy" SUID="larryboy" FSUID="larryboy" EGID="larryboy" SGID="larryboy" FSGID="larryboy"
> > type=PROCTITLE msg=audit(1738501309.118:135): proctitle="(null)"
> > type=ANOM_ABEND msg=audit(1738501309.118:136): auid=1000 uid=1000 gid=1000 ses=1 subj=passt pid=2030 comm="passt" exe="/usr/bin/passt" sig=11 res=1AUID="larryboy" UID="larryboy" GID="larryboy"
>
> So, it looks like passt is running as its own profile. This shouldn't
> happen because the libvirt profile has an own subprofile and we should
> see that in "profile" on the type=AVC line but... I just reproduced
> this! Clean Debian sid install, fresh install of libvirtd:
>
> error: internal error: Child process (passt --one-off --socket /run/user/1000/libvirt/qemu/run/passt/1-alpine-net0.socket --pid /run/user/1000/libvirt/qemu/run/passt/1-alpine-net0-passt.pid --tcp-ports 40922:22) unexpected fatal signal 11
>
> I'll keep you posted.

I've skimmed the conversation trying to understand whether there's
anything that I need do from the libvirt side, but AFAICT no explicit
action has been called for so far.

It looks like you're making good progress in figuring out what's
going on. Being able to reproduce the issue yourself is certainly
going to help. I'm happy to leave all the debugging to you, since as
you know I'm not very good at the AppArmor stuff and I'm really,
really bad at the networking stuff ;)

Once a clearer picture emerges, if it turns out that changes are
needed in either libvirt or its Debian packaging, I can definitely
look into making that happen.

-- 
Andrea Bolognani / Red Hat / Virtualization