[Bug 2148717] Re: rust-coreutils 0.8.0 new locales apparmor accesses

[Simon Johnsson]

Hey there! I've had a look at this and it seems the error relates to an
optimization patch where the locales are installed into
/usr/share/coreutils/locales rather than /usr/share/locale.

IIUC both versions always load the locales (no change there). However
0.7.0-0ubuntu1 did not generate any apparmor denials since the
/usr/share/locale directory is covered in the abstractions/base profile.

I would say that the suggested course of action is to either drop the
optimization patch or include /usr/share/coreutils/locales in the
abstractions/base profile if possible.

** Changed in: rust-coreutils (Ubuntu)
   Importance: Undecided => High

** Changed in: rust-coreutils (Ubuntu)
       Status: New => Triaged

** Changed in: rust-coreutils (Ubuntu)
     Assignee: (unassigned) => Simon Johnsson (bamf0)

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rust-coreutils in Ubuntu.
https://bugs.launchpad.net/bugs/2148717

Title:
  rust-coreutils 0.8.0 new locales apparmor accesses

Status in pollinate package in Ubuntu:
  New
Status in rust-coreutils package in Ubuntu:
  Triaged

Bug description:
  Between 0.7.0-0ubuntu1 and 0.8.0-0ubuntu3 rust-coreutils has new file
  accesses for at least head, cat, and touch:

  Apr 17 17:01:09 alan-resolute-eyfpotmgij kernel: audit: type=1400 audit(1776445269.452:184): apparmor="DENIED" operation="open" class="file" profile="pollinate" name="/usr/share/coreutils/locales/uucore/en-US.ftl" pid=809 comm="head" requested_mask="r" denied_mask="r" fsuid=100 ouid=0
  Apr 17 17:01:09 alan-resolute-eyfpotmgij kernel: audit: type=1400 audit(1776445269.459:185): apparmor="DENIED" operation="open" class="file" profile="pollinate" name="/usr/share/coreutils/locales/uucore/en-US.ftl" pid=812 comm="cat" requested_mask="r" denied_mask="r" fsuid=100
  ouid=0
  Apr 17 17:01:09 alan-resolute-eyfpotmgij kernel: audit: type=1400 audit(1776445269.475:186): apparmor="DENIED" operation="open" class="file" profile="pollinate" name="/usr/share/coreutils/locales/uucore/en-US.ftl" pid=819 comm="touch" requested_mask="r" denied_mask="r" fsuid=100
  ouid=0

  Maybe these have been moved from an on-demand loading to an always
  loading? That'd feel pretty wasteful, given that cat, head, touch, are
  used thousands of times more often than they need to report errors or
  help messages.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pollinate/+bug/2148717/+subscriptions