[Bug 1918410] Please test proposed package

[Robie Basak]

Hello Anisse, or anyone else affected,

Accepted isc-dhcp into impish-proposed. The package will build now and
be available at https://launchpad.net/ubuntu/+source/isc-
dhcp/4.4.1-2.3ubuntu1.1 in a few hours, and then in the -proposed
repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
impish to verification-done-impish. If it does not fix the bug for you,
please add a comment stating that, and change the tag to verification-
failed-impish. In either case, without details of your testing we will
not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: isc-dhcp (Ubuntu Focal)
       Status: In Progress => Fix Committed

** Tags added: verification-needed-focal

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to isc-dhcp in Ubuntu.
https://bugs.launchpad.net/bugs/1918410

Title:
  isc-dhcp-client denied by apparmor

Status in isc-dhcp package in Ubuntu:
  Fix Released
Status in isc-dhcp source package in Focal:
  Fix Committed
Status in isc-dhcp source package in Impish:
  Fix Committed
Status in isc-dhcp source package in Jammy:
  Fix Committed
Status in isc-dhcp source package in Kinetic:
  Fix Released

Bug description:
  [Impact]

   * dmesg is flooded with apparmor="DENIED" messages for dhclient
   * can lead to situations where dhclient is blocked to assign an IP address
   * also impacts NetworkManager, when dhclient is being used as DHCP client

  Examples:
  [    7.339430] audit: type=1400 audit(1655804569.920:30): apparmor="DENIED" operation="open" profile="/{,usr/}sbin/dhclient" name="/proc/451/task/452/comm" pid=451 comm="dhclient" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0
  [    7.402768] audit: type=1400 audit(1655804569.984:33): apparmor="DENIED" operation="mknod" profile="/{,usr/}sbin/dhclient" name="/run/NetworkManager/dhclient-enp5s0.pid" pid=451 comm="dhclient" requested_mask="c" denied_mask="c" fsuid=0 ouid=0

  [Test Plan]
  $ apt install network-manager
  $ netplan set "network.renderer=NetworkManager"
  $ netplan get
  network:
    version: 2
    renderer: NetworkManager
    ethernets:
      enp5s0:
        dhcp4: true
  $ mkdir /etc/NetworkManager/conf.d
  $ cat /etc/NetworkManager/conf.d/dhcp-client.conf
  [main]
  dhcp=dhclient

  $ apparmor_parser -r /etc/apparmor.d/sbin.dhclient
  $ netplan apply
  $ dmesg | grep dhclient
  $ reboot
  $ netplan apply
  $ dmesg | grep dhclient

  => make sure there are no (new) apparmor="DENIED" messages in there,
  especially not after a reboot

  $ ip addr
  [...]
  2: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
      link/ether 00:16:3e:60:dd:dc brd ff:ff:ff:ff:ff:ff
      inet 10.238.94.44/24 brd 10.238.94.255 scope global dynamic noprefixroute enp5s0
         valid_lft 3576sec preferred_lft 3576sec
  [...]

  => make sure a dynamic IP address got assigned via DHCP

  [Where problems could occur]

   * We're touching the apparmor profile for dhclient
   * If anything goes wrong, we could potentially reduce the security confinement of dhclient
   * Or we could potentially block additional functionality of dhclient via apparmor, rendering it unusable

  [Other Info]

   * Also affects salesforce case "[SFDC-LAN] Case 00332266"
   * Fixed in the upstream apparmor profile for sbin.dhclient:
     https://gitlab.com/apparmor/apparmor/-/merge_requests/730
   * The 2nd fix for "/run/NetworkManager/dhclient-enp5s0.pid" was taken from the very same profile's "connman" section and adopted for NetworkManager, as /var/run/sendsigs.omit.d/network-manager.dhclient*.pid is not used anymore.

  === original description ===

  Hi, I get weird errors in the audit log, seeing dhclient is being
  denied reading its comm or the comm of one of its tasks:

  [1383307.827378] audit: type=1400 audit(1615367094.054:162):
  apparmor="DENIED" operation="open" profile="/{,usr/}sbin/dhclient"
  name="/proc/1095210/task/1095213/comm" pid=1095210 comm="dhclient"
  requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

  This might or might not be linked with the fact that I can't get an
  IPv4 on this interface. Note that it happened to other, see this
  comment:

  https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1413232/comments/8

  Or even an article recommending disabling apparmor for dhclient(!):
  https://blog.anthony-jacob.com/perte-dip-v4-sous-ubuntu-20-04-apparmor-et-dhclient/

  As I said, I'm not sure this is the root cause of the lack of IPv4
  renewal, because running it manually *does* succeed in getting an IP.
  And running it in strace shows the EACCES failure:

  [pid 1095210] openat(AT_FDCWD, "/proc/self/task/1095211/comm", O_RDWRstrace: Process 1095211 attached
  ) = -1 EACCES (Permission non accordée)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/1918410/+subscriptions