roddhjav / apparmor.d

Full set of AppArmor profiles (~ 1500 profiles)
https://apparmor.pujol.io
GNU General Public License v2.0
395 stars 34 forks source link

fix(pacman): add `attach_disconnected` #356

Closed REmerald closed 3 weeks ago

REmerald commented 4 weeks ago

Should fix #350

$ aa-log -r | grep pacman -A 2
profile pacman flags=(attach_disconnected) {
  owner dev/tty2 rw,  # file_inherit Failed name lookup - disconnected path
}
roddhjav commented 4 weeks ago

Thanks. I wanted to do some test with this. Can you tell me in witch context this log was raised?

curiosityseeker commented 3 weeks ago

ALLOWED pacman open owner apparmor/.null info="Failed name lookup - disconnected path" comm=pacman requested_mask=wr denied_mask=wr error=-13 I had added deny /apparmor/.null rw, as a silencer.

I found it also necessary to add attach_disconnected to the gpg child profile.

roddhjav commented 3 weeks ago

I meant what was your use of pacman?

REmerald commented 3 weeks ago

I meant what was your use of pacman?

Actually none, I just boot into the system and get spammed with this error in the logs.

ALLOWED pacman file_inherit owner dev/tty2 info="Failed name lookup - disconnected path" comm=pacman requested_mask=wr denied_mask=wr error=-13

But, I have waybar with waybar-module-pacman-updates-git installed, it checks for updates after I boot (actually it seems to do it constanly, but I'm not sure), which is likely to be the cause of the error.

curiosityseeker commented 3 weeks ago

I meant what was your use of pacman?

Normal update with sudo pacman -Syu. It might be related to the mentioned deny rule.

roddhjav commented 3 weeks ago

Ok, I think some usage of pacman (with the --sysroot option) may require it anyway.

Merged, thanks.