[Bug 2107402] Re: lsblk blocked by apparmor in 25.04

[Ryan Lee]

This is a problem with the lsblk profile shipped by AppArmor and not a
problem with the util-linux package. I am not super familiar with IBM z
Systems, but I think the path that would need to be added is
/sys/devices/css0/**. @fheimes could you confirm whether this path
always includes "css0" as opposed to "css[some other number]"?

** Summary changed:

- lsblk blocked by apparmor in 25.04
+ lsblk on IBM z Systems blocked by apparmor in 25.04

** Tags added: sec-6152

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to util-linux in Ubuntu.
https://bugs.launchpad.net/bugs/2107402

Title:
  lsblk on IBM z Systems blocked by apparmor in 25.04

Status in Ubuntu on IBM z Systems:
  New
Status in apparmor package in Ubuntu:
  New
Status in util-linux package in Ubuntu:
  Invalid

Bug description:
  Fresh install of 25.04 on s390x. Same happens also on upgrade from
  24.10 to 25.04

  lsblk returns no output

  journactl shows it is blocked by apparmor

  This works fine for SCSI devices, it fails only for DASD.

  ```
  2025-04-15T15:02:26.048055+00:00 s5lp1-gen03 kernel: kauditd_printk_skb: 6 callbacks suppressed
  2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:270): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0000/0.0.0101/block/dasda/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  2025-04-15T15:02:26.048077+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:271): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0000/0.0.0101/block/dasda/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  2025-04-15T15:02:26.048078+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:272): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0003/0.0.0104/block/dasdd/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  2025-04-15T15:02:26.048079+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:273): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0003/0.0.0104/block/dasdd/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  2025-04-15T15:02:26.048080+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:274): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0001/0.0.0102/block/dasdb/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  2025-04-15T15:02:26.048080+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:275): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0001/0.0.0102/block/dasdb/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  2025-04-15T15:02:26.048081+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:276): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0002/0.0.0103/block/dasdc/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  2025-04-15T15:02:26.048081+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:277): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0002/0.0.0103/block/dasdc/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  ```

  
  Attaching also strace

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/2107402/+subscriptions