[apparmor] [Bug 933440] Re: AppArmor profile (in enforce mode) breaks skype

[Ivan Frederiks]

@Jamie Strandboge, I tried your fix. It didn't help.

Skype says:
(<unknown>:4447): Gtk-WARNING **: /usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so: failed to map segment from shared object: Permission denied
(<unknown>:4447): Gtk-WARNING **: Loading IM context type 'ibus' failed
(<unknown>:4447): Gtk-WARNING **: /usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so: failed to map segment from shared object: Permission denied
(<unknown>:4447): Gtk-WARNING **: Loading IM context type 'ibus' failed
(<unknown>:4447): Gtk-WARNING **: /usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so: failed to map segment from shared object: Permission denied
(<unknown>:4447): Gtk-WARNING **: Loading IM context type 'ibus' failed
Aborted

kern.log says:
May  3 10:35:39 awgtest kernel: [668597.982051] type=1400 audit(1336034139.171:47): apparmor="STATUS" operation="profile_replace" name="/usr/bin/skype" pid=4410 comm="apparmor_parser"
May  3 10:36:13 awgtest kernel: [668632.027783] type=1400 audit(1336034173.216:48): apparmor="DENIED" operation="file_mmap" parent=604 profile="/usr/bin/skype" name="/etc/passwd" pid=4447 comm="skype" requested_mask="m" denied_mask="m" fsuid=1001 ouid=0
May  3 10:36:13 awgtest kernel: [668632.045057] type=1400 audit(1336034173.236:49): apparmor="DENIED" operation="open" parent=604 profile="/usr/bin/skype" name="/etc/xdg/Trolltech.conf" pid=4447 comm="skype" requested_mask="r" denied_mask="r" fsuid=1001 ouid=0
May  3 10:36:13 awgtest kernel: [668632.405860] type=1400 audit(1336034173.596:50): apparmor="DENIED" operation="open" parent=604 profile="/usr/bin/skype" name="/home/ifred/.gtkrc-2.0" pid=4447 comm="skype" requested_mask="r" denied_mask="r" fsuid=1001 ouid=1001
May  3 10:36:13 awgtest kernel: [668632.406107] type=1400 audit(1336034173.596:51): apparmor="DENIED" operation="open" parent=604 profile="/usr/bin/skype" name="/usr/share/themes/Simple/gtk-2.0/gtkrc" pid=4447 comm="skype" requested_mask="r" denied_mask="r" fsuid=1001 ouid=0
May  3 10:36:13 awgtest kernel: [668632.534414] type=1400 audit(1336034173.724:52): apparmor="DENIED" operation="file_mmap" parent=604 profile="/usr/bin/skype" name="/usr/share/fonts/truetype/ttf-liberation/LiberationSans-Regular.ttf" pid=4447 comm="skype" requested_mask="m" denied_mask="m" fsuid=1001 ouid=0
May  3 10:36:13 awgtest kernel: [668632.547412] type=1400 audit(1336034173.736:53): apparmor="DENIED" operation="file_mmap" parent=604 profile="/usr/bin/skype" name="/usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so" pid=4447 comm="skype" requested_mask="m" denied_mask="m" fsuid=1001 ouid=0
May  3 10:36:13 awgtest kernel: [668632.551206] type=1400 audit(1336034173.740:54): apparmor="DENIED" operation="file_mmap" parent=604 profile="/usr/bin/skype" name="/usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so" pid=4447 comm="skype" requested_mask="m" denied_mask="m" fsuid=1001 ouid=0
May  3 10:36:13 awgtest kernel: [668632.555495] type=1400 audit(1336034173.744:55): apparmor="DENIED" operation="file_mmap" parent=604 profile="/usr/bin/skype" name="/usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so" pid=4447 comm="skype" requested_mask="m" denied_mask="m" fsuid=1001 ouid=0
May  3 10:36:14 awgtest kernel: [668632.832541] type=1400 audit(1336034174.024:56): apparmor="DENIED" operation="file_mmap" parent=604 profile="/usr/bin/skype" name="/usr/share/skype/lang/skype_en.qm" pid=4447 comm="skype" requested_mask="m" denied_mask="m" fsuid=1001 ouid=0

** Changed in: apparmor (Ubuntu)
       Status: Incomplete => Confirmed

** Changed in: apparmor-profiles
       Status: New => Confirmed

-- 
You received this bug notification because you are a member of AppArmor
Developers, which is the registrant for AppArmor Profiles.
https://bugs.launchpad.net/bugs/933440

Title:
  AppArmor profile (in enforce mode) breaks skype

Status in AppArmor Profiles:
  Confirmed
Status in “apparmor” package in Ubuntu:
  Confirmed

Bug description:
  When usr.bin.skype profile from apparmor-profiles package is enabled
  skype is unable to start.

  I use Ubuntu 11.04 i386

  apt-cache policy apparmor-profiles
  apparmor-profiles:
    Installed: 2.6.1-0ubuntu3
    Candidate: 2.6.1-0ubuntu3
    Version table:
   *** 2.6.1-0ubuntu3 0
          500 http://de.archive.ubuntu.com/ubuntu/ natty/universe i386 Packages
          100 /var/lib/dpkg/status

  apt-cache policy skype
  skype:
    Installed: 2.2.0.35-0natty1
    Candidate: 2.2.0.35-0natty1
    Version table:
   *** 2.2.0.35-0natty1 0
          500 http://archive.canonical.com/ubuntu/ natty/partner i386 Packages
          100 /var/lib/dpkg/status

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor-profiles/+bug/933440/+subscriptions