OS: Debian 12 stable Kernel: Linux debian 6.1.0-11-amd64 Evolution: 3.46.4-2 When trying to start the Evolution mail app, AppArmor does not allow it to start and displays a message: apparmor="DENIED" operation="mount" info="failed mntpnt match" error=-13 profile="/usr/bin/evolution" name="/" pid=1923 comm="bwrap" flags="rw, silent, rslave" Logprof does not provide any solution to this message. So now it is not possible to run Evolution mail together with AppArmor? There was some similar problems with app mount found in the past, but with different apps. However, the problem had to be solved by a patch, not by an AA profile. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883703 https://github.com/lxc/lxc/issues/1895 Is there a solution to run Evolution together with AppArmor? Thank you.
Hi, dp217 (2023-09-08): As far as I know we don't confine Evolution with AppArmor in Debian, so I suppose you've installed or enabled a profile yourself, and then I would encourage you to report this problem to the authors of said profile. If my assumptions are incorrect, please help me understand :) Cheers,
Hello,
Am Samstag, 9. September 2023, 13:25:30 CEST schrieb intrigeri:
comm="bwrap" looks like a hint towards bubblewrap, therefore my guess
is that we are looking at a flatpak-packaged evolution here. But that's
just a guess, so I'll wait for the feedback from the reporter.
That said:
The profile will need a mount rule added, probably
mount options=(rw, silent, rslave) -> /,
(I know allowing evolution or bwrap to mount / looks strange, even if
it's inside a sandbox. But I'm afraid that's what the sandbox needs.)
For the records. aa-logprof doesn't support mount rules yet (besides
keeping/not breaking existing rules) which is why it doesn't ask
anything for the DENIED event quoted above.
Regards,
Christian Boltz
Hello, Evolution is not a flatpak version, it is the default version installed with the OS (Debian 12) Yes, the Profile is not part of Debian 12, I tried to install the profile from the https://packages.debian.org/bookworm/apparmor-profiles package, but it didn't work at all. So I am trying to create my own profile, mostly using aa-logprof. Thanks for the info, I hadn't thought of that, so I'll try to resolve unsupported records manually. (It might be a good idea to mention this somewhere, perhaps for other users, if not directly when generating via aa-logprof, at least in its manual) Thanks for the syntax. So probably even the default version (non flatpak version) tries to create a sandbox to run Evolution? Without a deeper knowledge of the operating system and especially the application, it's not that easy to make rules as mentioned on the internet.
Hi, thanks for clarifying that this is a request for help writing a new profile, rather than a bug report about policy we ship in Debian. Hence I'm closing this bug report.
Hello, That wasn't a request for help with a new profile. (which you cite as the reason for closing the bug report) aa-logprof "is an interactive tool used to review AppArmor generated messages and update AppArmor security profiles. Running aa-logprof will scan the log file and if there are new AppArmor events that are not covered by the existing profile set, the user will be prompted with suggested modifications to augment the profile." But nowhere is it stated that some messages are quietly ignored, which leads to unexpected results.The user then has a legitimate right to assume that it is a bug. See wiki "A software bug is an error, flaw or fault in the design, development, or operation of computer software that causes it to produce an incorrect or unexpected result, or to behave in unintended ways." If a program doesn't do what it claims to do, then what is it if not a bug? Thank you ------- Original Message -------
Hi, dp217 (2023-09-11): Please forgive me for drawing incorrect conclusions:the initial bug report, its title, the fact it was reported against another package than the one that ships aa-logprof, suggested to me something very different than what you're saying now. Thanks for clarifying. I'm reopening the bug report and fixing the metadata to make it clearer what it is about. Cheers,
Hi intrigeri, Yes, I understand. At first it wasn't even very clear what the problem was. Maybe it would be better to change the title to: aa-logprof quietly ignore some messages without the user knowing Because the problem isn't so much that the mount isn't supported, although it would be nice if it were, but that the messages that aa-logprof is supposed to reviewed are ignored without the user knowing. Also, mount isn't the only thing that isn't supported, the same problem also applies to pivotroot.