Qubes-Whonix obfsproxy AppArmor issue

[phabricator-migrator]

Information

ID: 396
PHID: PHID-TASK-qgyrfm4fg4iqljkuixjp
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Found in Qubes-Whonix 11. (Other versions untested.)

user@host:~$ obfsproxy -h
Traceback (most recent call last):
  File "/usr/bin/obfsproxy", line 5, in <module>
    from pkg_resources import load_entry_point
  File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2876, in <module>
    working_set = WorkingSet._build_master()
  File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 440, in _build_master
    ws = cls()
  File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 433, in __init__
    self.add_entry(entry)
  File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 489, in add_entry
    for dist in find_distributions(entry, True):
  File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 1902, in find_on_path
    for entry in os.listdir(path_item):
OSError: [Errno 13] Permission denied: '/rw/usrlocal/lib/python2.7/dist-packages'

audit: type=1400 audit(1439566453.497:15): apparmor="DENIED" operation="open" profile="/usr/bin/obfsproxy" name="/rw/usrlocal/lib/python2.7/dist-packages/" pid=4078 comm="obfsproxy" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

I have no idea why obfsproxy or some lib it is using tries to access /usr/local.

in Qubes, /usr/local is a symlink to /rw/usrlocal.

Comments

---

Patrick

2015-08-15 18:49:40 UTC

Related:

• https://debathena.mit.edu/trac/ticket/166
• [config-package-dev] config-package-dev clashes with AppArmor profiles

A real fix would require having an AppArmor option to follow symlinks.

Workaround…
fixed obfsproxy AppArmor issue "OSError: [Errno 13] Permission denied: '/rw/usrlocal/lib/python2.7/dist-packages'" - https://phabricator.whonix.org/T396:
fixed obfsproxy AppArmor issue "OSError: [Errno 13] Permission denied… · Kicksecure/apparmor-profile-dist@d8a5fae · GitHub

---

Patrick

2015-08-14 16:56:31 UTC

AppArmor upstream feature request - symlink support:
Bug #1485055 “symlink support” : Bugs : AppArmor

---

Patrick

2015-08-14 21:54:16 UTC

! In T396#6413, @Patrick wrote:
AppArmor upstream feature request - symlink support:
Bug #1485055 “symlink support” : Bugs : AppArmor

Got Won't Fix.

Seth Arnold:

This is not a design choice that can be revisited; this is a consequence of the kernel internal implementation. Sorry.

---

Patrick

2015-08-15 14:19:34 UTC

Got another answer.

Christian Boltz (cboltz):

You can use alias rules for directory symlinks - add them to /etc/apparmor.d/tunables/alias. This avoids the need to modify all profiles.

For example, my /tmp/ is a symlink to /home/sys-tmp/, and the alias rule for it is
alias /tmp/ → /home/sys-tmp/,

Another possible solution is using mount --bind instead of symlinks.

---

Patrick

2015-08-15 18:41:23 UTC

Actually, that’s a much better solution.

/etc/apparmor.d/tunables/home.d/qubes-whonix:

alias /usr/local -> /rw/usrlocal/,

Tested. Works. Will revert the above commit (T396#6412). And use this solution instead. Does /etc/apparmor.d/tunables/home.d/qubes-whonix fit better into the qubes-whonix or the apparmor-profile-anondist package? @troubadour

Also suggested to Qubes to fix this at a higher level… (But in meanwhile we need the quicker above fix.)
Qubes /usr/local symlink /rw/usrlocal AppArmor issue:
Qubes /usr/local symlink /rw/usrlocal AppArmor issue · Issue #1122 · QubesOS/qubes-issues · GitHub

---

Patrick

2015-08-19 17:45:50 UTC

Reverted:
Revert "fixed obfsproxy AppArmor issue "OSError: [Errno 13] Permissio… · Kicksecure/apparmor-profile-dist@da380cf · GitHub

fixed obfsproxy AppArmor issue "OSError: [Errno 13] Permission denied: '/rw/usrlocal/lib/python2.7/dist-packages'" using superior /etc/apparmor.d/tunables/home.d/qubes-whonix-anondist solution - https://phabricator.whonix.org/T396:
fixed obfsproxy AppArmor issue "OSError: [Errno 13] Permission denied… · Kicksecure/apparmor-profile-dist@8785d31 · GitHub