Why am I getting apparmor error messages in the syslog about NTP and LDAP?

Question

On my newly installed Ubuntu 12.04 machine, with ntp and slapd installed, the following messages appear in /var/log/syslog at regular intervals:

Feb 23 18:54:07 my-host kernel: [ 24.610703] type=1400 audit(1393181647.872:15): apparmor="DENIED" operation="open" parent=1 profile="/usr/sbin/ntpd" name="/etc/ldap/ldap.conf" pid=1526 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

I've searched, but can't find any info on what may be causing these messages and how to fix the problem. Can anyone shed any light on what's causing this and what to do about it?

Answer 1

This is what it is telling you:

• apparmor="DENIED" AppArmor denied something based on a profile (we'll get to that later).

• operation="open" The operation AppArmor denied (in this case opening something, probably a file).

• profile="/usr/sbin/ntpd" The profile that made AppArmor deny this action.

• name="/etc/ldap/ldap.conf" The file that something was trying to open.

• pid=1526 The PID of the process trying to open it.

• comm="ntpd" The command/name of the process that tried to open it.

• requested_mask="r" What ntpd wanted to do with the file (r for read in this case).

• denied_mask="r" What AppArmor stopped it from doing.

So, in plain English, ntpd wanted to read LDAP's config file, AppArmor thought it had no business in LDAP's config file, so it blocked the action according to ntpd's profile for /usr/sbin/ntpd.

If you haven't been tinkering with NTP to make it want to read LDAP's config file, and haven't been tinkering with NTP's AppArmor profile and this isn't causing you problems, you shouldn't need to take any action.

Why is AppArmor even there in first place? AppArmor's main purpose is to prevent compromised apps/processes from doing things they shouldn't.

Answer 2

The answer by Seth already covers how to interpret the message and the direct cause.

But the root cause might be that you have installed and configured libnss-ldap but have not told AppArmor about it.

Ubuntu 12.04 is old enough to have libnss-ldap, which has no separate service for sending LDAP queries out to the server(s); instead, it makes every process that uses glibc have its own LDAP connection if they need LDAP-based name resolution services, according to /etc/nsswitch.conf.

This is very inconvenient when using extra access control like AppArmor, because you'll effectively have to allow every process to access the LDAP client configuration and to make outgoing LDAP connections. And that is probably one of the reasons why libnss-ldap fell out of favor and was replaced by libnss-ldapd, which centralizes the job of making outgoing LDAP connections for name resolution to a dedicated service process. Unfortunately Ubuntu 12.04 LTS is old enough to not have had that package.

The default /etc/apparmor.d/abstractions/nameservice file already includes the line:

#include <abstractions/ldapclient>

which should have covered the files required by libnss-ldap.

Unfortunately, the /etc/apparmor.d/abstractions/ldapclient file that is referred to by this line was adopted to Ubuntu 12.04 LTS unmodified from SuSE, and Ubuntu has slightly different paths for LDAP client configuration files. You would have to modify that file first to change the line

  /etc/ldap.conf            r,

to

  /etc/ldap/ldap.conf       r,

and similarly fix any other path referred to in the file to match actual Ubuntu file locations too.

After that, you would have to either reboot the system or use a command like

sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.ntpd

to refresh each AppArmor profile that is currently loaded (see sudo aa-status for the list of loaded profiles).

Answer 3

Seems this is a simple permission issue, by assigning the right permission/ownership will solve this issue.

Mar 15 12:15:45 user-sys kernel: [  673.423996] audit: type=1400 audit(1552632345.954:91): apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/home/path/path1/file.html" pid=4949 comm=46532042726F6B65722035313639 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Fixed this with chown command:

e.g.: chown user:user file.html

Before it was -rwxrwxrwx 1 root root 37K Mar 14 20:47 file.html, so Firefox interface shows the below warning, this might be Firefox browser limitations since it works on Chromium browser.

Access to the file was denied
The file at /home/path/path1/file.html is not readable.
It may have been removed, moved, or file permissions may be preventing access."