23

On my newly installed Ubuntu 12.04 machine, with ntp and slapd installed, the following messages appear in /var/log/syslog at regular intervals:

Feb 23 18:54:07 my-host kernel: [ 24.610703] type=1400 audit(1393181647.872:15): apparmor="DENIED" operation="open" parent=1 profile="/usr/sbin/ntpd" name="/etc/ldap/ldap.conf" pid=1526 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

I've searched, but can't find any info on what may be causing these messages and how to fix the problem. Can anyone shed any light on what's causing this and what to do about it?

3 Answers 3

25

This is what it is telling you:

  • apparmor="DENIED" AppArmor denied something based on a profile (we'll get to that later).

  • operation="open" The operation AppArmor denied (in this case opening something, probably a file).

  • profile="/usr/sbin/ntpd" The profile that made AppArmor deny this action.

  • name="/etc/ldap/ldap.conf" The file that something was trying to open.

  • pid=1526 The PID of the process trying to open it.

  • comm="ntpd" The command/name of the process that tried to open it.

  • requested_mask="r" What ntpd wanted to do with the file (r for read in this case).

  • denied_mask="r" What AppArmor stopped it from doing.

So, in plain English, ntpd wanted to read LDAP's config file, AppArmor thought it had no business in LDAP's config file, so it blocked the action according to ntpd's profile for /usr/sbin/ntpd.

If you haven't been tinkering with NTP to make it want to read LDAP's config file, and haven't been tinkering with NTP's AppArmor profile and this isn't causing you problems, you shouldn't need to take any action.

Why is AppArmor even there in first place? AppArmor's main purpose is to prevent compromised apps/processes from doing things they shouldn't.

4
  • Thanks for the comprehensive response. I haven't touched NTP, apart from apt-get'ing it. Any idea how I can stop NTP attempting to read the LDAP config and producing the error messages in the log?
    – FixMaker
    Feb 25, 2014 at 13:19
  • @Lorax I'm pretty sure the only way to stop the message would be to disable ntpd's profile in AppArmor, which isn't a good idea. It isn't a problem, so I wouldn't be worried about it. Or you could tell AppArmor to log things differently.
    – Seth
    Feb 25, 2014 at 18:32
  • "ntpd wanted to read LDAP's config file, AppArmor thought it had no business in LDAP's config file, so it blocked the action" ... I thought that was what chown/chmod were for. If you want to keep ntp out of ldap's business, then don't make /etc/ldap/ readable to user ntp. It's sad that this has become yet another bloated unwieldy nuisance that we have to Google Ubuntu disable apparmor. Small problems rarely warrant big solutions.
    – Jim L.
    Jan 20 at 21:59
  • Since the OP's system has a LDAP server (slapd) installed, it might also have ldap on one or more lines in /etc/nsswitch.conf. That would make glibc's resolver library component prepare for resolving names from a LDAP directory, which would explain the access attempt. The fact that every process that needs names resolved would have to have their own LDAP connection is not ideal, and explains why modern solutions like sssd were developed.
    – telcoM
    Aug 9 at 8:53
0

The answer by Seth already covers how to interpret the message and the direct cause.

But the root cause might be that you have installed and configured libnss-ldap but have not told AppArmor about it.

Ubuntu 12.04 is old enough to have libnss-ldap, which has no separate service for sending LDAP queries out to the server(s); instead, it makes every process that uses glibc have its own LDAP connection if they need LDAP-based name resolution services, according to /etc/nsswitch.conf.

This is very inconvenient when using extra access control like AppArmor, because you'll effectively have to allow every process to access the LDAP client configuration and to make outgoing LDAP connections. And that is probably one of the reasons why libnss-ldap fell out of favor and was replaced by libnss-ldapd, which centralizes the job of making outgoing LDAP connections for name resolution to a dedicated service process. Unfortunately Ubuntu 12.04 LTS is old enough to not have had that package.

The default /etc/apparmor.d/abstractions/nameservice file already includes the line:

#include <abstractions/ldapclient>

which should have covered the files required by libnss-ldap.

Unfortunately, the /etc/apparmor.d/abstractions/ldapclient file that is referred to by this line was adopted to Ubuntu 12.04 LTS unmodified from SuSE, and Ubuntu has slightly different paths for LDAP client configuration files. You would have to modify that file first to change the line

  /etc/ldap.conf            r,

to

  /etc/ldap/ldap.conf       r,

and similarly fix any other path referred to in the file to match actual Ubuntu file locations too.

After that, you would have to either reboot the system or use a command like

sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.ntpd

to refresh each AppArmor profile that is currently loaded (see sudo aa-status for the list of loaded profiles).

-1

Seems this is a simple permission issue, by assigning the right permission/ownership will solve this issue.

Mar 15 12:15:45 user-sys kernel: [  673.423996] audit: type=1400 audit(1552632345.954:91): apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/home/path/path1/file.html" pid=4949 comm=46532042726F6B65722035313639 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Fixed this with chown command:

e.g.: chown user:user file.html

Before it was -rwxrwxrwx 1 root root 37K Mar 14 20:47 file.html, so Firefox interface shows the below warning, this might be Firefox browser limitations since it works on Chromium browser.

Access to the file was denied
The file at /home/path/path1/file.html is not readable.
It may have been removed, moved, or file permissions may be preventing access."
1
  • 1
    the deny is because of apparmor, not because there is a lack of access right to the files. If apparmor has no configuration directives that allow access, then it deny it, regardless of the right that the file has.
    – dominix
    Dec 10, 2021 at 4:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .