<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hi,</div><div class=""><br class=""></div><div class="">After getting comfortable with mod_apparmor and slowly migrating sites to it, I'm seeing some weird audit logs from the HANDLING_UNTRUSTED_INPUT hat on a virtual host. The weird entries all have this form:</div><div class=""><br class=""></div><div class=""> apparmor="DENIED" operation=“file_perm"</div><div class=""> profile="/usr/sbin/apache2//HANDLING_UNTRUSTED_INPUT"</div><div class=""> name="/usr/opt/httpd/sites/<a href="http://example.com/www/wp-content/themes/art/images/search.gif" class="">example.com/www/wp-content/themes/art/images/search.gif</a>"</div><div class=""> pid=31631 comm="apache2" requested_mask="r" denied_mask="r" fsuid=33 ouid=1002</div><div class=""><br class=""></div><div class="">These occur every few minutes, although in <1% of requests. (Otherwise the site works totally fine under its AADefaultHatName, which is the only hat that should access sites/<a href="http://example.com/*" class="">example.com/*</a>*.)</div><div class=""><br class=""></div><div class="">According to Apache’s access_logs, these resources are actually requested by a client at the exact time of audit entry, and the response appears to be sometimes 0 bytes, so it looks like a reliability issue first and foremost. (It might be a security issue in case clients could force a specific request to stay in HANDLING_UNTRUSTED_INPUT *and* this hat would be more privileged than the uri/vhost-specific hat. Probably a contrived example in most cases.)</div><div class=""><br class=""></div><div class="">After correlating the AppArmor log messages with access_logs, I found that some requirements must be met for the problem to happen:</div><div class=""><br class=""></div><div class="">1. The Apache 2.4 server must have HTTP keep-alive enabled</div><div class="">2. The client user-agent is Safari on iOS (seen 8_1_2, 8_1_3 and 8_2, either iPad or iPhone)</div><div class="">3. The client visits a HTML web page with some sub resources</div><div class="">4. Some requests to sub resources are now liable to cause a file access attempt from HANDLING_UNTRUSTED_INPUT, e.g. one or more gif/jpg/png images.</div><div class=""><br class=""></div><div class="">There are likely additional confounding variables, as I am seeing this problem only on one machine, even though others are running normally for weeks. I suspect it's related to a mostly mobile regional audience and a very narrow timing window during which subsequent HTTP keepalive requests trigger the problem.</div><div class=""><br class=""></div><div class="">Setting "KeepAlive Off" on the server stops the audit entries completely for many hours, so this seems a workaround.</div><div class=""><br class=""></div><div class="">The symptoms seem to be very similar to a thread by Christian Boltz in 2012: <a href="https://lists.ubuntu.com/archives/apparmor/2012-March/002414.html" class="">https://lists.ubuntu.com/archives/apparmor/2012-March/002414.html</a> (in that case it's .css files, I wonder if it was ever solved?)</div><div class=""><br class=""></div><div class="">From the possible scenarios in that thread, it seems here (due to relationship with keepalive) that either Apache or mod_apparmor would be the most likely location. No errors are logged by Apache (the requests seem to get a 200 response although its bytes transferred are lower than normal requests).</div><div class=""><br class=""></div><div class="">I'd be happy to experiment a bit. I couldn't yet reproduce by talking to port 80, however I can now get a reasonably consistent reproduce by reloading a webpage from my iPhone in a private browsing tab.</div><div class=""><br class=""></div><div class="">Configuration: Ubuntu 14.04 LTS x64, Linux 3.13.0-46-generic, Apache 2.4 prefork 2.4.12-1+<a href="http://deb.sury.org" class="">deb.sury.org</a>~trusty+5, mod_apparmor 2.9.1.</div><div class=""><br class=""></div><div class="">Cheers!</div><div class="">WH</div><div class=""><br class=""></div><div apple-content-edited="true" class=""> <div style="color: rgb(0, 0, 0); font-family: 'Lucida Grande'; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">-- <br class="">Walter Hop | PGP key: <a href="https://lifeforms.nl/pgp" class="">https://lifeforms.nl/pgp</a></div> </div> <br class=""></body></html>