<HTML><BODY><br><br>Кому: intrigeri <intrigeri@debian.org><br>
Дата: Пятница, 19 июля 2019, 18:57 +03:00<br>
Тема: Re[2]: [Pkg-privacy-maintainers] Bug#932150: ricochet-im doesn't save user preferences due to broken(?) apparmor profile<br>
<br>
<div class="js-helper js-readmsg-msg">
<style type="text/css"></style>
<div>
<div id="style_15635518731697839477_BODY"><div class="class_1563565407">
Hi, <br>Ricochet with new profile seems working as expected, but there are still some 'DENIED' messages in syslog from apparmor<br><br><p><br>Jul 19 18:50:43 horse kernel: [ 1559.190204] audit: type=1400 audit(1563551443.503:29): apparmor="STATUS" operation="profile_replace" info="s<br>ame as current profile, skipping" profile="unconfined" name="/usr/bin/ricochet" pid=7996 comm="apparmor_parser"<br>Jul 19 18:50:57 horse kernel: [ 1573.503100] audit: type=1400 audit(1563551457.815:30): apparmor="DENIED" operation="open" profile="/usr/bin/<br>ricochet" name="/proc/sys/kernel/random/boot_id" pid=8045 comm="ricochet" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0<br>Jul 19 18:50:57 horse kernel: [ 1573.527617] audit: type=1400 audit(1563551457.843:31): apparmor="DENIED" operation="open" profile="/usr/bin/<br>ricochet" name="/etc/ssl/openssl.cnf" pid=8051 comm="tor" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0<br>Jul 19 18:51:15 horse kernel: [ 1591.410341] audit: type=1400 audit(1563551475.723:32): apparmor="DENIED" operation="open" profile="/usr/bin/<br>ricochet" name="/proc/sys/kernel/random/boot_id" pid=8109 comm="ricochet" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0<br>Jul 19 18:51:15 horse kernel: [ 1591.426174] audit: type=1400 audit(1563551475.739:33): apparmor="DENIED" operation="open" profile="/usr/bin/<br>ricochet" name="/etc/ssl/openssl.cnf" pid=8115 comm="tor" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0</p> <br><br><br><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;">
Пятница, 19 июля 2019, 17:41 +03:00 от intrigeri <<a href="mailto:intrigeri@debian.org">intrigeri@debian.org</a>>:<br>
<br>
<div id="">
<div class="js-helper_mailru_css_attribute_postfix js-readmsg-msg_mailru_css_attribute_postfix">
<style></style>
<div>
<div id="style_15635472970492684532_BODY_mailru_css_attribute_postfix">Hi,<br>
<br>
Given Buster shipped with AppArmor enabled by default, arguably this<br>
bug should be RC. I confirm this bug and adding these rules should fix<br>
this:<br>
<br>
owner @{HOME}/.local/share/Ricochet/ rw,<br>
owner @{HOME}/.local/share/Ricochet/** mrwlk,<br>
<br>
Constantin, can you please try this out? You'll need to reload the<br>
profile after modifying it:<br>
<br>
sudo apparmor_parser -r /etc/apparmor.d/usr.bin.ricochet<br>
<br>
Now, on a current Debian sid default GNOME (+ Wayland) desktop, the<br>
profile denies tons of other stuff which triggers tons of noise in the<br>
logs. The attached profile fixes some (not all) of it but I'm not<br>
familiar enough with Ricochet to tell whether the denied access should<br>
be allowed or silently denied (with "deny" rules) so I'll let folks<br>
more familiar with Ricochet look into the fine details — and that<br>
should be for another bug anyway.<br>
<br>
</div>
</div>
</div>
</div>
</blockquote>
Best regards,</div></div></div></div>-- <br>Constantin Dunayev<br></BODY></HTML>