1

Would very much like to use apparmor to restrict specific dbus communications within my system. However the following line appears in my syslog:

Dec 28 09:36:21 apex snapd[1127]: AppArmor status: apparmor is enabled but some features are missing: dbus, network

Have tested with the following apparmor profile. Sadly, it does not restrict the DBUS :_(

# Last Modified: Fri Dec 28 09:20:30 2018
#include <tunables/global>

/usr/bin/budgie-panel {
  #include <abstractions/base>

  # allow all rules
  allow *,

  # Then deny bind access, for the program /usr/bin/budgie-panel, 
  # on any bus (either the user's session bus, or the system wide bus),
  # to prevent registering the dbus endpoint address "org.freedesktop.Notifications"
  # 
  # This is to keep the address free, for other notification daemons to use
  # (such as 'dunst', or 'mako', which provide multi-monitor support)
  # This will also mean budgie cannot receive notifications (raven sidebar, and applets)
  #
  deny dbus bind name=org.freedesktop.Notifications,

}

Well aparrently, there is supposed to be a kernel flag? To see if this feature is enabled in the kernel, there should be a folder at /sys/kernel/security/apparmor/features/dbus, containing a file named mask. However that folder is missing on my system.

Perhaps this is because I have switched to using update_ubuntu_kernel.sh. Which gets its .deb kernel packages from https://kernel.ubuntu.com/. They are not the typical / standard ubuntu kernel? According to ubuntu's own documentation, the dbus feature in apparmor should be present ever since ubuntu 13.10.

$ uname -a
Linux apex 4.20.0-042000-lowlatency #201812232030 SMP PREEMPT Mon Dec 24 01:42:05 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

So then! ...would like to find out how to enable kernel boot flags. Or load a module (modprobe). Or other steps required to get this feature working in those newer linux kernels. Not sure what to look for / search for!

4

The dbus mediation in apparmor requires cooperation of the apparmor userspace, kernel and dbus daemon. All parts must contain the necessary support or dbus mediation will not be enabled.

From your description the apparmor userspace and the dbus daemon should support dbus mediation but your kernel does not. Currently dbus mediation requires an out of tree patch providing fine grained mediation for af_unix sockets that Ubuntu kernels are carrying as a sauce patch in currently releases.

The upstream kernels (including the just released 4.20 and next release 4.21) do not yet have support for fine grained af_unix mediation. Several prerequisite patches have landed in the recent 4.18, 4.19, and 4.20 kernels and the upstream apparmor project is hoping to have fine grained af_unix mediation land in 4.22

  • However we have recently jumped now from 4.20.14 kernel to v5.0 now. Skipping over 4.22 entirely it would seem? If the plans / roadmap has changed from what was initially expected. Then perhaps there is also new target kernel version / milestone for this feature? – Dreamcat4 Mar 7 at 9:47
  • 1
    4.21 was renamed to 5.0 (just released this week) 4.22 would have been 5.1 which was the target. Unfortunately there has been need of a some changes to the patch and it has been pulled from the 5.1 merge request. It will be re-added to the apparmor-next tree and should land into linux-next after the 5.1 merge window closes at the end of next week. This means this feature is now targeted to land in 5.2 along with some other network mediation changes. Until 5.2 releases, it will be available from apparmor-next, Ubuntu 19.04 kernel and gitlab.com/apparmor/apparmor-kernel – John R Johansen Mar 8 at 2:47
  • Hello again. Has this made it into the upstream kernel yet? Installed 5.2.6 kernel today Linux apex 5.2.6-050206-generic #201908040832 SMP Sun Aug 4 08:34:40 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux. But still cannot see dbus in the features folder. Is there some flag I must switch on in my kernel boot flags? Or has the requested patch just been pushed back again / not taken yet by the mainline kernel? – Dreamcat4 Aug 5 at 20:55
  • @JohnRJohansen, do you know where to find patches to backport the D-Bus mediation functionality to 4.19? In kernel.ubuntu.com/git/jj/linux-apparmor-backports there seem to be patches up to 4.15 only. – mardy Aug 29 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.