Bugzilla bug status workflow Patch#
Bugzilla bug status workflow code#

> operation='capable' profile='smbd' pid=4119 comm='smbd' capability=12 > Below is some analysis on what happens now

Bugzilla bug status workflow code#

> systemd) it appears systemd has reintroduced this issue as part of some code > While bug #991901 refers to a similar bug (one that was fixed in the past in > require (see bug #991901, comment #12 for some more detail) > dangerous as it unnecessarily allows samba access to privileges it doesn't > profile(s) which has disadvantages or allow net_admin (which is inherently > The net_admin ones are a bit trickier, while we could deny net_admin in the > requested_mask='r' denied_mask='r' fsuid=0 ouid=0'

> afaics only one of the DENIES here can be (safely) squashed. I don't think we should fix the other one

Bugzilla bug status workflow Patch#

I will submit a patch for the /proc/blah/fd DENY. So basically systemd tries to use setsockopt to set the buffer size to SO_SNDBUF, in the case where this size exceeds the kernel limit (which is what is happening here) systemd just tries to force the buffer size with a call that needs net_admin capabilities R = setsockopt_int(fd, SOL_SOCKET, SO_SNDBUFFORCE, n) * If we have the privileges we will ignore the kernel limit. If (r >= 0 & l = sizeof(value) & increase ? (size_t) value >= n*2 : (size_t) value = n*2) *** Note: from strace above seems value is 425984 (which fails the test below) R = getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &value, &l) * So, we need to check the actual buffer size here. * SO_SNDBUF above may set to the kernel limit, instead of the requested size. Int fd_set_sndbuf(int fd, size_t n, bool increase) > fd_inc_sndbuf(fd, SNDBUF_SIZE) (systemd/src/basic/socket-util.h) > sd_notify(0, 'STATUS=Starting process.') (systemd/src/libsystemd/sd-daemon/sd-daemon.c)

Smbd and samba-bgqd processes call samba function become_daemonīecome_daemon() (samba/lib/util/become_daemon.c) Type=AVC msg=audit(1646832789.663:482): apparmor='DENIED' operation='capable' profile='samba-bgqd' pid=4123 comm='samba-bgqd' capability=12 capname='net_admin'Ĥ119 getsockopt(0, SOL_SOCKET, SO_TYPE, 0x7ffd89d820b0, ) = -1 ENOTSOCK (Socket operation on non-socket)Ĥ119 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 11Ĥ119 getsockopt(11, SOL_SOCKET, SO_SNDBUF,, ) = 0Ĥ119 setsockopt(11, SOL_SOCKET, SO_SNDBUF,, 4) = 0Ĥ119 setsockopt(11, SOL_SOCKET, SO_SNDBUFFORCE,, 4) = -1 EPERM (Operation not permitted)Ĥ123 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4Ĥ123 getsockopt(4, SOL_SOCKET, SO_SNDBUF,, ) = 0Ĥ123 setsockopt(4, SOL_SOCKET, SO_SNDBUF,, 4) = 0Ĥ123 setsockopt(4, SOL_SOCKET, SO_SNDBUFFORCE,, 4) = -1 EPERM (Operation not permitted)

While bug #991901 refers to a similar bug (one that was fixed in the past in systemd) it appears systemd has reintroduced this issue as part of some code changes or rewrite.īelow is some analysis on what happens now The net_admin ones are a bit trickier, while we could deny net_admin in the profile(s) which has disadvantages or allow net_admin (which is inherently dangerous as it unnecessarily allows samba access to privileges it doesn't require (see bug #991901, comment #12 for some more detail) Type=AVC msg=audit(1646702374.355:183): apparmor='DENIED' operation='capable' profile='samba-bgqd' pid=1933 comm='samba-bgqd' capability=12 capname='net_admin'Īfaics only one of the DENIES here can be (safely) squashed. run '# cat /var/log/audit/audit.log' to check the audit record, got run '# echo '' > /var/log/audit/audit.log'Ĥ. Run '# systemctl restart smb' with Apparmor profile '' in enforcing mode reports 'DENIED' audit records.Ģ. This issue is found in openQA 'security/apparmor_profile' test case in recent builds such as sle15sp4 build 101.1/88.1.