** Changed in: apparmor (Ubuntu Stonking)
Status: In Progress => Fix Released
** Description changed:
- On Resolute, running `lsusb` may produce AppArmor denials from the
- `lsusb` profile for PCI parent uevent files.
+ [ Impact ]
- The current profile allows USB node uevent reads:
- `@{sys}/devices/**/usb[0-9]**/uevent r,` but lsusb/libudev also reads
- PCI parent uevent files above the USB nodes (see paths below, which are
- not matched by this rule). I will submit a PR upstream and SRU the
- changes once they've landed.
+ On 26.04 Resolute, the AppArmor `lsusb` profile can produce denials when
+ libudev walks from USB devices to their PCI parent devices and reads
+ parent `uevent` files under `/sys/devices/`, resulting in denial noise
+ from normal `lsusb` usage.
- Observed on:
- 26.04 Resolute
- apparmor 5.0.0~beta1-0ubuntu7
- usbutils 1:019-1
- kernel 7.0.0-2012-nvidia-bos-64k
- MGX VERA CX / Vera Rubin C2
+ This fix is ported from the upstream AppArmor `lsusb` profile, and
+ updates only the `lsusb` profile:
+
https://gitlab.com/apparmor/apparmor/-/commit/af7d610531c85fea620c05d6c2ae3af8cc0160c9
- Reproduce:
+ The new rule resolving this is:
+
+ ```
+ @{sys}/devices/@{pci_bus}/uevent r,
+ @{sys}/devices/@{pci_bus}/**/uevent r,
+ ```
+
+ The upstream commit being backported here also includes
+ `<abstractions/consoles>` and adds a root read rule `/ r`, which are
+ also present in the Stonking version of this profile.
+
+ [ Test Plan ]
+
+ These steps should be run on Ubuntu 26.04 Resolute with AppArmor
+ enabled. The pre-fix reproduction is most useful on hardware where
+ `lsusb`/libudev walks USB controllers through PCI parent devices.
+
+ A package with these changes is staged in the following PPA:
+ https://launchpad.net/~ks0/+archive/ubuntu/apparmor-lsusb-fix
+ Adding it:
+ sudo add-apt-repository ppa:ks0/apparmor-lsusb-fix
+ sudo apt update
+
+ 1. Confirm the baseline package and profile:
+
+ ```
+ apt-cache policy apparmor usbutils
+ sudo aa-status | grep -E '(^|/)lsusb\b' || true
+ ```
+
+ 2. Reproduce the denial with the release package:
+
+ ```
sudo dmesg -C
sudo lsusb >/dev/null
- sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb"'
+ sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb".*/sys/devices/.*uevent'
+ ```
- Example denials in dmesg:
- apparmor="DENIED" operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0002:60/0002:60:00.0/0002:61:00.0/uevent"
requested_mask="r" denied_mask="r"
- apparmor="DENIED" operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0002:60/0002:60:00.0/uevent" requested_mask="r"
denied_mask="r"
- apparmor="DENIED" operation="open" class="file" profile="lsusb"
name="/sys/devices/pci0002:60/uevent" requested_mask="r" denied_mask="r"
+ Expected before the fix on affected hardware: one or more denials for
+ PCI parent `uevent` paths, for example `/sys/devices/pci.../.../uevent`.
- With topology:
- /sys/devices/pci0002:60
- 0002:60:00.0 NVIDIA PCI bridge [10de:2f98]
- 0002:61:00.0 Renesas uPD720201 USB 3.0 Host Controller [1912:0014]
- usb1 / usb2
+ 3. Install `apparmor` version `5.0.0~beta1-0ubuntu7.1~ppa1` from the
+ PPA, or the corresponding version once in -proposed, then reload
+ AppArmor:
+
+ ```
+ apt-cache policy apparmor
+ sudo systemctl reload apparmor
+ sudo apparmor_parser -Q -K /etc/apparmor.d/lsusb
+ ```
+
+ 4. Verify the denial is gone:
+
+ ```
+ sudo dmesg -C
+ sudo lsusb >/dev/null
+ sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb".*/sys/devices/.*uevent'
+ ```
+
+ Expected after the fix: `grep` returns no matching denials.
+
+ 5. Run basic regression checks:
+
+ ```
+ lsusb >/dev/null
+ lsusb -t >/dev/null
+ sudo lsusb -v >/dev/null
+ sudo dmesg | grep 'apparmor="DENIED".*profile="lsusb"' || true
+ ```
+
+ Expected result: the commands complete successfully and no new `lsusb` profile
+ denials are logged.
+
+ [ Where problems could occur ]
+
+ If the new rules related to `lsusb` are too narrow, users will continue
+ to see `lsusb` AppArmor denials as reported in this bug. If the new
+ rules are too broad, the `lsusb` process gets additional read access.
+ The added file rules are read-only, aside from the addition of
+ <abstractions/consoles> which is rw.
+
+ A regression would most likely appear as new or continuing AppArmor
+ denials while running `lsusb`, or in the worst case, as `lsusb` failing
+ to show USB devices normally.
+
+ [ Other Info ]
+
+ The upstream AppArmor task is Fix Released. 26.10 Stonking carries a
+ version of AppArmor which contain the upstream commits which this fix
+ backports, though it was still `In Progress` when this was originally
+ triaged. So marking this `Fix Released` for Stonking, while an SRU is
+ still needed for Resolute.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2158939
Title:
lsusb profile denies PCI parent uevent reads for USB controllers
To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/2158939/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
