panlinux
commented
4 months ago Ok, had an excellent troubleshoting session with @renanrodrigo and we found the origin of the problem.
Basically, just the presence of /var/lib/dpkg/arch is enough to trigger the attempted access and subsequent DENIED. Even if the file is empty. But the most common case seems to be systems that have a subarchitecture, like i386, added like dpkg --add-architecture i386. That will create /var/lib/dpkg/arch with amd64 and i386 in it.
We don't know yet the consequence of this DENIED error. It looks like it's triggered by apt-cache policy called by Pro, which ends up calling dpkg --print-foreign-architectures, which is what attempts to read /var/lib/dpkg/arch.
I diffed the output of apt-cache policy with and without the apparmor profile, and even though the run with the apparmor profile had the DENIED log entries, the actual output has no differences:
$ sudo aa-exec -p ubuntu_pro_esm_cache apt-cache policy > denied
$ sudo apt-cache policy > allowed
$ diff -u allowed denied
$It's the same attached or unattached.
dominicraf
renanrodrigo
eugenesan
Description of the bug
Seen in the logs from https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2067728:
Unsure if that's the cause of the LP bug, though, as the ua logs also show errors contacting the contract server (timeouts).
The journal logs at those times are fine:
Incidentally, looks like apport is trying to report the version of the ubuntu-advantage-tools package, but it should also check ubuntu-pro-client.
Expected behavior
No apparmor denied errors.
Current behavior For some unknown operation, the pro client on that system is triggering dpkg apparmor denied errors. We haven't seen those in our testing.
in uaclient/system.py, we have get_dpkg_arch() which calls
dpkg --print-architecture, and that works just fine with the current apparmor profile:And strace confirms that that command does not touch /var/lib/dpkg:
To Reproduce Unknown at the moment.
System information:
Additional context
Add any other context about the problem here.