[pkg-apparmor] Bug#962405: /proc/sys/kernel/random/boot_id DENIED

[Alan Sermons]

Package: apparmor
Version: 2.13.4-1+b1
Followup-For: Bug #962405

Dear Maintainer,

Complete apparmor novice here, so I'm not the best person to troubleshoot
things (but I'm willing to learn)...

Although I have a previous version of the package, I have had similar issues. I
had a look at the Ubuntu bug listed and had a look at the upstream files. There
is a reference to the abstractions/nameservice file at
https://gitlab.com/apparmor/apparmor/-/blob/apparmor-2.13/profiles/apparmor.d/abstractions/nameservice#L35
(included below). I found that adding the last of the three rules, listed in
that block, into local/usr.sbin.cupsd solved the recurring messages.

I hadn't realised, but I was having similar problems with freshclam, so when I
put the first and last of the rules into local/usr.bin.freshclam it fixed the
problem. However, the variable declaration wasn't working (I had to modify it
to put in /run specifically).

The cups issue has also been reported as https://bugs.debian.org/cgi-
bin/bugreport.cgi?bug=954953 against cups-daemon, but the freshclam one doesn't
appear that I can see.

If you need any other information, I can see what I can do.

Many thanks.

>From upstream abstractions/nameservice
(https://gitlab.com/apparmor/apparmor/-/blob/apparmor-2.13/profiles/apparmor.d/abstractions/nameservice#L35)

  # NSS records from systemd-userdbd.service
  @{run}/systemd/userdb/ r,
@{run}/systemd/userdb/io.systemd.{NameServiceSwitch,Multiplexer,DynamicUser,Home}
r,
  @{PROC}/sys/kernel/random/boot_id r,




-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.6.0-2-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apparmor depends on:
ii  debconf [debconf-2.0]  1.5.74
ii  libc6                  2.30-8
ii  lsb-base               11.1.0
ii  python3                3.8.2-3

apparmor recommends no packages.

Versions of packages apparmor suggests:
pn  apparmor-profiles-extra  <none>
ii  apparmor-utils           2.13.4-1+b1

-- debconf information:
  apparmor/homedirs: