This bug is imho not fixed for my Ubuntu 14.04.2 LTS Server with this
current "fixed" version of isc-dhcp-server 4.2.4-7ubuntu12.1.
I assume the lease file can't be rotated because its owned by root.
# ls -la /var/lib/dhcp
total 24
5374571 drwxr-xr-x 2 root root 4096 Apr 19 14:54 .
5374092 drwxr-xr-x 92 root root 4096 Apr 4 17:31 ..
5374293 -rw-r--r-- 1 root root 6319 Apr 19 14:54 dhcpd.leases
5379328 -rw-r--r-- 1 root root 6319 Apr 19 14:53 dhcpd.leases~
It occours also after a restart of isc-dhcp-server.
The only quick solution for me was to add a "chown .." in the
/etc/init.d/isc-dhcp-server startscript (at the end of the start/stop/restart
sections, i.e. to prevent overwrites during process starts
restart | force-reload)
test_config
$0 stop
sleep 2
$0 start
if [ "$?" != "0" ]; then
exit 1
fi
chown dhcpd /var/lib/dhcp/*
;;
additional I changed "chown root:root" to "chown dhcpd:dhcpd" in the file:
/etc/init/isc-dhcp-server.conf
# Allow dhcp server to write lease and pid file as 'dhcpd' user
mkdir -p /var/run/dhcp-server
chown dhcpd:dhcpd /var/run/dhcp-server
# The leases files need to be root:root even when dropping privileges
[ -e /var/lib/dhcp/dhcpd.leases ] || touch /var/lib/dhcp/dhcpd.leases
#chown root:root /var/lib/dhcp /var/lib/dhcp/dhcpd.leases
chown dhcpd:dhcpd /var/lib/dhcp /var/lib/dhcp/dhcpd.leases
if [ -e /var/lib/dhcp/dhcpd.leases~ ]; then
#chown root:root /var/lib/dhcp/dhcpd.leases~
chown dhcpd:dhcpd /var/lib/dhcp/dhcpd.leases~
fi
The properties of the affected Ubuntu system (dhclient is disabled)
# dpkg -l |grep isc-dhcp-server
ii isc-dhcp-server 4.2.4-7ubuntu12.1 amd64 ISC DHCP server for automatic IP
address assignment
# uname -a
Linux gandalf 3.13.0-49-generic #83-Ubuntu SMP Fri Apr 10 20:11:33 UTC 2015
x86_64 x86_64 x86_64 GNU/Linux
# cat /etc/issue
Ubuntu 14.04.2 LTS \n \l
Apparmor config looks like
# grep leases /etc/apparmor.d/usr.sbin.dhcpd
/var/lib/dhcp/dhcpd{,6}.leases* lrw,
/etc/dhcpd{,6}.leases* lrw,
/{,var/}run/eucalyptus/net/*.leases* lrw,
# tail -f syslog
Apr 19 16:51:06 gandalf dhcpd: Wrote 24 leases to leases file.
Apr 19 16:51:06 gandalf dhcpd: Can't backup lease database
/var/lib/dhcp/dhcpd.leases to /var/lib/dhcp/dhcpd.leases~: Operation not
permitted
Apr 19 16:51:06 gandalf dhcpd: Added reverse map from 10.2.10.10.in-addr.arpa.
to lab-01.lab.foo.bar.
Apr 19 16:51:06 gandalf kernel: [14157.954888] audit_printk_skb: 57 callbacks
suppressed
Apr 19 16:51:06 gandalf kernel: [14157.954892] type=1702
audit(1429455066.150:174): op=linkat ppid=1 pid=2240 auid=4294967295 uid=121
gid=130 euid=121 suid=121 fsuid=121 egid=130 sgid=130 fsgid=130 tty=(none)
ses=4294967295 comm="dhcpd" exe="/usr/sbin/dhcpd" res=0
Apr 19 16:51:06 gandalf kernel: [14157.954899] type=1302
audit(1429455066.150:175): item=0 name="/var/lib/dhcp/dhcpd.leases"
inode=5375035 dev=08:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
# tail -f /var/log/kern.log
Apr 19 16:51:06 gandalf kernel: [14157.954892] type=1702
audit(1429455066.150:174): op=linkat ppid=1 pid=2240 auid=4294967295 uid=121
gid=130 euid=121 suid=121 fsuid=121 egid=130 sgid=130 fsgid=130 tty=(none)
ses=4294967295 comm="dhcpd" exe="/usr/sbin/dhcpd" res=0
Apr 19 16:51:06 gandalf kernel: [14157.954899] type=1302
audit(1429455066.150:175): item=0 name="/var/lib/dhcp/dhcpd.leases"
inode=5375035 dev=08:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu.
https://bugs.launchpad.net/bugs/1417658
Title:
apparmor denied operation file_inherit from networkmanager when using
HWE kernel
Status in isc-dhcp package in Ubuntu:
Fix Released
Status in isc-dhcp source package in Trusty:
Fix Released
Status in isc-dhcp source package in Vivid:
Fix Released
Bug description:
[Impact]
AppArmor denials appear in dhclient when using using HWE kernel on 14.04.
This can result in incorrect dhcp operation on client systems. The fix is to
add these rules:
network inet dgram,
network inet6 dgram,
to the dhclient profile for nm-dhcp-client.action and dhclient-script,
like we did in 4.2.4-7ubuntu14.
[Test Case]
Install HWE kernel and use network manager to obtain an IP address.
[Regression Potential]
Extremely low since the update only adds access that dhclient didn't have.
Original description:
Hallo,
on Kubuntu 14.04.x dmesg shows me the following apparmor messages;
Is this normal or is this a security issue together with network-
manager?
[ 16.171766] audit: type=1400 audit(1422595680.679:68): apparmor="DENIED"
operation="file_inherit"
profile="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=2229
comm="nm-dhcp-client." lport=10320 family="inet" sock_type="dgram" protocol=17
[ 16.171772] audit: type=1400 audit(1422595680.679:69): apparmor="DENIED"
operation="file_inherit"
profile="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=2229
comm="nm-dhcp-client." lport=21985 family="inet6" sock_type="dgram" protocol=17
[ 16.199936] audit: type=1400 audit(1422595680.707:70): apparmor="DENIED"
operation="file_inherit"
profile="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=2246
comm="nm-dhcp-client." lport=10320 family="inet" sock_type="dgram" protocol=17
[ 16.199943] audit: type=1400 audit(1422595680.707:71): apparmor="DENIED"
operation="file_inherit"
profile="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=2246
comm="nm-dhcp-client." lport=21985 family="inet6" sock_type="dgram" protocol=17
[ 16.201369] audit: type=1400 audit(1422595680.707:72): apparmor="DENIED"
operation="file_inherit"
profile="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=2248
comm="nm-dhcp-client." lport=10320 family="inet" sock_type="dgram" protocol=17
[ 16.201379] audit: type=1400 audit(1422595680.707:73): apparmor="DENIED"
operation="file_inherit"
profile="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=2248
comm="nm-dhcp-client." lport=21985 family="inet6" sock_type="dgram" protocol=17
[ 17.206342] audit: type=1400 audit(1422595681.711:74): apparmor="DENIED"
operation="file_inherit"
profile="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=2468
comm="nm-dhcp-client." lport=10320 family="inet" sock_type="dgram" protocol=17
[ 17.206349] audit: type=1400 audit(1422595681.711:75): apparmor="DENIED"
operation="file_inherit"
profile="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=2468
comm="nm-dhcp-client." lport=21985 family="inet6" sock_type="dgram" protocol=17
When I logon to KDE, KDE hangs sometimes for 3sec at the login-
process , when there is no internet connection (DSL modem did not
dial-in yet).
Thanks for your help!
Best regards, Bernhard
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/1417658/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
