Quack,

If you use the xline_db module and try to list or add lines you end-up
with the following error:
Wed Apr  1 11:01:50 2020: ANNOUNCEMENT: database: cannot create new db:
Permission denied (13)

Indeed inspircd is not allowed to create a new database (which is then
renamed to the previous file, see src/modules/m_xline_db.cpp):
type=AVC msg=audit(1585731820.176:604602): apparmor="DENIED"
operation="mknod" profile="/usr/sbin/inspircd"
name="/etc/inspircd/xline.db.new" pid=28308 comm="inspircd"
requested_mask="c" denied_mask="c" fsuid=39 ouid=39

I guess it would be even better to create such files in
/var/lib/inspircd but the package does not provide it. I nevertheless
did the change myself and added this line to the apparmor policy:
   /var/lib/inspircd/* rw,

Similar problem when trying to use the geoip module:
Apr 01 11:28:40 Jinta inspircd[7048]: Error Opening file
/usr/share/GeoIP/GeoIP.dat
Apr 01 11:28:40 Jinta inspircd[7048]: [*] Unable to initialize
m_geoip.so: Unable to initialize geoip, are you missing GeoIP.dat?
and:
type=AVC msg=audit(1585733319.998:605041): apparmor="DENIED"
operation="open" profile="/usr/sbin/inspircd"
name="/usr/share/GeoIP/GeoIP.dat" pid=7048 comm="inspircd"
requested_mask="r" denied_mask="r" fsuid=39 ouid=0

I added this line to the apparmor policy:
   /usr/share/GeoIP/GeoIP.dat r,

Btw the package could also Suggest geoip-database needed for this
module.

Regards.
\_o<

Thank you for the report, I'm not an apparmor expert but I'm happy to
include support in the package (at
https://salsa.debian.org/debian/inspircd)

Suggesting 'geoip-database' is a good idea, I'll add that!

Quack,
the release is close.

v3 now uses the GeoLite2 DB and that's not available without
registration IIUC. But for people OK to register there is the
geoipupdate package that can use a token to download it.
I have no idea where it stores the files but it should not be difficult
to get this information. Then you can simply update the path in the
apparmor profile.

Another suggestion: to allow admins to add little fixes or adaptations
to the apparmor policy I saw that several packages include a file in
/etc/apparmor.d/local/ (chronyd for eg), which is ignored if the file is
missing, very practical. For Inspircd that would give (at the end of the
rules but inside the braquets):
#include <local/usr.sbin.inspircd>

Hope that helps.
\_o<

It seems like Debian are not shipping the AppArmor file that the InspIRCd build system generates and instead are shipping an incomplete custom one.

This problem can be fixed by using the AppArmor file that InspIRCd generates and installs to the script directory (named "apparmor").

Hi There

This Bug hit me too for using the permchannel module.
It would really really help us, if at least the

  #include <local/usr.sbin.inspircd>

would make it to the next debian release.

greeting and thanks
Björn Lässig

We believe that the bug you reported is fixed in the latest version of
inspircd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 955479@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Filippo Giunchedi <filippo@debian.org> (supplier of updated inspircd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 15 Jan 2023 16:05:01 +0100
Source: inspircd
Architecture: source
Version: 3.15.0-1
Distribution: unstable
Urgency: medium
Maintainer: Filippo Giunchedi <filippo@debian.org>
Changed-By: Filippo Giunchedi <filippo@debian.org>
Closes: 955479 1000104
Changes:
 inspircd (3.15.0-1) unstable; urgency=medium
 .
   * New upstream release
     + build libpcre2-dev, not libpcre3-dev (Closes: #1000104)
     + ship upstream apparmor configuration (Closes: #955479)
   * apparmor: allow local includes, part of #955479
Checksums-Sha1:
 d2b90c33d52ade4d75fd468ea3590fa5a0205679 2174 inspircd_3.15.0-1.dsc
 418e203c8e241983f1e4ba2880a9cf04d6602ad5 874629 inspircd_3.15.0.orig.tar.gz
 d097d654a3dae25734965bab131b23a1e805016a 14580 inspircd_3.15.0-1.debian.tar.xz
 6d9324f0d067aef91bedafcdf93b9f7f5a9c7f64 8277 inspircd_3.15.0-1_amd64.buildinfo
Checksums-Sha256:
 59a118363b649530fb27230d15b25907b6be100d44e151db511d670aef153cd2 2174 inspircd_3.15.0-1.dsc
 c3d201dd3577917bc94257ed8aa373c24bc03c456e55886497eb87e8520f2d4d 874629 inspircd_3.15.0.orig.tar.gz
 aad526acdf0c954fca7c71000a6bbbefe426fa62f3ff74aa2582a2462a41c563 14580 inspircd_3.15.0-1.debian.tar.xz
 c20099757db6867e93d50ae681bceab132b232253ca04ef2176d0d4dd3d530ae 8277 inspircd_3.15.0-1_amd64.buildinfo
Files:
 aeef1d513c10ab2536a951988ac50455 2174 net optional inspircd_3.15.0-1.dsc
 fd72195fd840b1025cc237caa60d79ce 874629 net optional inspircd_3.15.0.orig.tar.gz
 bd234f248244c49d66f557bb4285c76b 14580 net optional inspircd_3.15.0-1.debian.tar.xz
 d17b8fe3dc5e5112cb10a6d8b864973c 8277 net optional inspircd_3.15.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJHBAEBCAAxFiEESpRSzEXGrZapQW7YaWZyoGTcEJQFAmPJQ6sTHGZpbGlwcG9A
ZGViaWFuLm9yZwAKCRBpZnKgZNwQlNkZEADACES5EruRRc+rclEsYxMEi78qAntZ
LnMO59fsLbJteiW/9iqRk4grYWtrmvTxJGC5aTsGrlRBEWxEHwugYcFXg+hRiisH
ffysXAyfTfsrLsAa4stlJPKkN6dwnWxkI8UXuw43PxwjNjk4kAGmPckrKyKmtzNl
WN3T/CDNw4Lp+48pXHU5mpDaimPPT+B36hkk2guFVnRt2CY8QEcpHWXDi4SDMpmU
+BLpIff/j/HWvtOkM+Xm7bwDzlgHdrlLCHu30SZcrZpMxapCN/4gpr3GPJar0+Ky
2rLOePxZUEl3a/Cr2s244UXETL8a6oDS+m3L40foxFToNvBw+NkUEKLal7ecUBkU
59xv6j4a+wm61lQPe7nMnyQHlh5knT68HQO3T/98TiruLHkFJemcJkOjCR5lWQnl
5NyanZfykjzfOb89G++9weU2MpcvnsY6AogO7B4ItvRqNsLVPAy9wia3r4mSr7N8
/w4HmihyUmP2JaRWDEdicWBiV1HsvWZYsgr6mlatT6IZxYh39bks9iyiMkpA48ys
KuXr07cIMz0BRwrAJLphc+KyqW3QQybWTxObdGKdt9CEgoefHhOdKtzY77T+F4T5
i/88r0jnCQ3mFw9FbmvTrbyltu5Mf9qfKfMA+S5DudWUje1lPAOoI2zJPrSwNtPL
q/AqIC734DFVCg==
=CGvc
-----END PGP SIGNATURE-----