[Bug 1869629] [NEW] please add /etc/mdns.allow to /etc/apparmor.d/abstractions/mdns

[Launchpad Bug Tracker]

You have been subscribed to a public bug by Ubuntu Foundations Team Bug Bot (crichton):

In focal users of mdns get denials in apparmor confined applications.
An exampel can be found in the original bug below.

It seems it is a common pattern, see
https://github.com/lathiat/nss-mdns#etcmdnsallow

Therefore I'm asking to add
   /etc/mdns.allow r,
to the file
   /etc/apparmor.d/abstractions/mdns"
by default.

--- original bug ---

Many repetitions of

audit: type=1400 audit(1585517168.705:63): apparmor="DENIED"
operation="open" profile="/usr/sbin/chronyd" name="/etc/mdns.allow"
pid=1983815 comm="chronyd" requested_mask="r" denied_mask="r" fsuid=123
ouid=0

in log.  I use libnss-mdns for .local name resolution, so
/etc/nsswitch.conf contains

hosts:          files mdns [NOTFOUND=return] myhostname dns

and /etc/mnds.allow contains the domains to resolve with mDNS (in may
case, "local." and "local"; see /usr/share/doc/libnss-mdns/README.html.)

Presumably cronyd calls a gethostbyX() somewhere, thus eventually
trickling down through the name service switch and opening
/etc/mdns.allow, which the AppArmor profile in the chrony package does
not allow.

ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: chrony 3.5-6ubuntu1
ProcVersionSignature: Ubuntu 5.4.0-18.22-generic 5.4.24
Uname: Linux 5.4.0-18-generic x86_64
NonfreeKernelModules: zfs zunicode zavl icp zcommon znvpair
ApportVersion: 2.20.11-0ubuntu21
Architecture: amd64
Date: Sun Mar 29 15:02:39 2020
InstallationDate: Installed on 2020-03-26 (3 days ago)
InstallationMedia: Xubuntu 20.04 LTS "Focal Fossa" - Alpha amd64 (20200326)
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: chrony
UpgradeStatus: No upgrade log present (probably fresh install)

** Affects: apparmor (Ubuntu)
     Importance: Critical
     Assignee: Ubuntu Security Team (ubuntu-security)
         Status: Fix Committed

** Affects: chrony (Ubuntu)
     Importance: Undecided
         Status: Invalid


** Tags: amd64 apport-bug focal patch rls-ff-incoming
-- 
please add /etc/mdns.allow to /etc/apparmor.d/abstractions/mdns
https://bugs.launchpad.net/bugs/1869629
You received this bug notification because you are a member of Ubuntu Sponsors Team, which is subscribed to the bug report.