|
Bugzilla – Full Text Bug Listing |
| Summary: | Latest apparmor updates breaks nagios check_zypper causing check to always fail. | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE Tumbleweed | Reporter: | William Brown <william.brown> |
| Component: | AppArmor | Assignee: | Christian Boltz <suse-beta> |
| Status: | RESOLVED FIXED | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Major | ||
| Priority: | P5 - None | CC: | lars.vogdt, william.brown |
| Version: | Current | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: | Updated profile | ||
|
Description
William Brown
2023-08-01 01:05:50 UTC
I slightly ;-) doubt that this is caused by a new AppArmor version. The only relevant (and possibly problematic) changes in recent 3.1.x releases affect mount rules, and your log doesn't mention anything related to mount.
I'm not sure why these denials appear now (maybe a change in zypper or libzypp?), but I'm quite sure the issues don't come from AppArmor changes.
That said - the check_zypper profile needs several updates, for example the zypper child profile needs
/run/zypp-rpm.pid rw,
/run/zypp.pid rw,
Also, zypper needs to execute /usr/bin/gpgconf and /usr/bin/gpgsm (see the null-* profiles). You can either make this ix rules to run them inside the zypper profile, or use Px -> /usr/lib/nagios/plugins/check_zypper//gpgconf to run it in a separate child profile.
BTW: I'd recommend to change the profile name to something shorter, from
/usr/lib/nagios/plugins/check_zypper {
to a named profile, for example
profile nagios_check_zypper /usr/lib/nagios/plugins/check_zypper {
(if you do that, you'll also need the Px rule I proposed above to
Px -> nagios_check_zypper//gpgconf )
That said - are you familiar enough with AppArmor to update the profile yourself, or do you want/need help?
(In reply to Christian Boltz from comment #1) > I slightly ;-) doubt that this is caused by a new AppArmor version. The only > relevant (and possibly problematic) changes in recent 3.1.x releases affect > mount rules, and your log doesn't mention anything related to mount. > > I'm not sure why these denials appear now (maybe a change in zypper or > libzypp?), but I'm quite sure the issues don't come from AppArmor changes. Sadly though, its the only thing that changed and it's triggered a lot of alerts for me :) > > That said - the check_zypper profile needs several updates, for example the > zypper child profile needs > /run/zypp-rpm.pid rw, > /run/zypp.pid rw, > Also, zypper needs to execute /usr/bin/gpgconf and /usr/bin/gpgsm (see the > null-* profiles). You can either make this ix rules to run them inside the > zypper profile, or use Px -> /usr/lib/nagios/plugins/check_zypper//gpgconf > to run it in a separate child profile. > > BTW: I'd recommend to change the profile name to something shorter, from > /usr/lib/nagios/plugins/check_zypper { > to a named profile, for example > profile nagios_check_zypper /usr/lib/nagios/plugins/check_zypper { > (if you do that, you'll also need the Px rule I proposed above to > Px -> nagios_check_zypper//gpgconf ) > > That said - are you familiar enough with AppArmor to update the profile > yourself, or do you want/need help? I have no skill in apparmor at all, I had to google everything I did yesterday in a hope it would give you the info needed. Surprisingly I'm actually better at selinux .... So if you could help here, that would be great. Created attachment 868605 [details] Updated profile (In reply to William Brown from comment #2) > (In reply to Christian Boltz from comment #1) > > I'm not sure why these denials appear now (maybe a change in zypper or > > libzypp?), but I'm quite sure the issues don't come from AppArmor changes. > > Sadly though, its the only thing that changed and it's triggered a lot of > alerts for me :) That sounds interesting[tm]. I'll ask upstream if someone has an explanation, but I'm still quite sure that this isn't caused by changes in AppArmor. (maybe you can check your /var/log/zypp/history if there were other updates, or try the previous AppArmor package) > I have no skill in apparmor at all, I had to google everything I did > yesterday in a hope it would give you the info needed. Looks like you were quite successful :-) Nevertheless, may I point you to https://doc.opensuse.org/documentation/leap/security/html/book-security/part-apparmor.html ? ;-) That said - I attached an updated AppArmor profile. Please test if it works - and if you still hit denials, switch it to complain mode with aa-complain /etc/apparmor.d/usr.lib.nagios.plugins.check_zypper and provide a new round of log events. As a sidenote - the profile would need some modernization (most visible: giving it a profile name, which would also make all the "px -> ..." more readable), but that's outside the scope of this bugreport ;-) Updated policy file works! Hooray! Thank you very much :) (In reply to William Brown from comment #4) > Updated policy file works! Hooray! I'm glad to hear this :-) May I ask you to do another test?I was quite surprised to see that zypper wants to write to /usr/lib/sysimage/rpm/Index.db while checking for updates (which should be a read-only operation for the rpm database). Can you please remove the line /usr/lib/sysimage/rpm/Index.db rwlk, # why write? Then reload the profile and test if it still works. (In case you wonder - abstractions/rpm has /usr/lib/sysimage/rpm/** rlk, which covers read access to the rpm database.) After that is clarified, I'll send the updated profile upstream. (In reply to Christian Boltz from comment #5) > (In reply to William Brown from comment #4) > > Updated policy file works! Hooray! > > I'm glad to hear this :-) > > May I ask you to do another test?I was quite surprised to see that zypper > wants to write to /usr/lib/sysimage/rpm/Index.db while checking for updates > (which should be a read-only operation for the rpm database). > > Can you please remove the line > /usr/lib/sysimage/rpm/Index.db rwlk, # why write? > Then reload the profile and test if it still works. > > (In case you wonder - abstractions/rpm has /usr/lib/sysimage/rpm/** rlk, > which covers read access to the rpm database.) > > After that is clarified, I'll send the updated profile upstream. Looks like that line is critical - check_zypper triggers a repo refresh which requires that to be present. Submitted upstream: https://github.com/lrupp/monitoring-plugins-zypper/pull/3 Thank you! Any guesses to when this will be in an update in tumbleweed? (In reply to William Brown from comment #8) > Thank you! Any guesses to when this will be in an update in tumbleweed? The bug number didn't make it into the changelog, which also broke the automated bugzilla notification. Therefore here's the manual notification: https://build.opensuse.org/request/show/1105442 was merged into Tumbleweed 6 days ago. No problem, thanks so much for your help :) |