[Bug 2172229] Re: AppArmor: profile attachment fails for diff-encoded xmatch DFAs (leftmatch_fb ignores MATCH_FLAG_DIFF_ENCODE) - firefox profile never attaches

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2172229 Title: AppArmor: profile attachment fails for diff-encoded xmatch DFAs (leftmatch_fb ignores MATCH_FLAG_DIFF_ENCODE) - firefox profile never attaches Status in linux package in Ubuntu: New Bug description: [Impact] Profiles whose attachment pattern compiles to a differentially encoded DFA never attach. The exec stays "unconfined", and because no conflict is involved, nothing is audited. Visible example: /etc/apparmor.d/firefox (from the apparmor package) profile firefox /{usr/lib/firefox{,-esr,-beta,-devedition,-nightly},opt/firefox}/firefox{,-esr,-bin} flags=(unconfined) { userns, ... } never attaches to /usr/lib/firefox/firefox-bin (Firefox .deb from packages.mozilla.org). Firefox therefore runs unconfined and is moved to unprivileged_userns, which denies CAP_SYS_ADMIN. Its content sandbox loses user-namespace isolation: apparmor="AUDIT" operation="userns_create" info="Userns create - transitioning profile" profile="unconfined" comm="firefox-bin" target="unprivileged_userns" execpath="/usr/lib/firefox/firefox-bin" apparmor="DENIED" operation="capable" class="cap" profile="unprivileged_userns" comm="firefox-bin" capability=21 capname="sys_admin" ps -eo label,args shows "unconfined" for every firefox-bin process, although "firefox (unconfined)" is loaded. [Cause] security/apparmor/match.c: leftmatch_fb(), used by aa_dfa_leftmatch() and therefore by find_attach(), takes the default transition as if (check[pos] == state) state = next[pos]; else state = def[state]; and moves on to the next input character. It does not handle MATCH_FLAG_DIFF_ENCODE. match_char(), used by aa_dfa_match() for file rules, does: for a diff-encoded state it follows def[state] and retries the SAME character. apparmor_parser emits diff-encoded DFAs by default whenever the kernel advertises policy/diff_encode (it does), so larger attachment patterns end in a non-accepting state. File rules are not affected, since they go through match_char(). Simple attachments (plain paths, "/a/{b,c}/x", "/a/x{,-y}", "/{,usr/}{,s}bin/unix_chkpwd") still attach. Larger or nested alternations fail. [Test case] The attached aa-repro.sh (run as root) loads the firefox profile's attachment pattern, relocated to a scratch directory, twice: once with default options and once with "-O no-diff-encode". It then executes a copy of dash under each path and prints /proc/$$/attr/current. Expected: enc -> repro_enc (unconfined) noenc -> repro_noenc (unconfined) Actual: enc -> unconfined noenc -> repro_noenc (unconfined) The two profiles differ only in diff encoding. Reproduced on the stock 7.0.0-38-generic kernel (output attached as repro- output-7.0.0-38-generic.txt). Further confirmation: Ubuntu's real firefox profile does not attach, while a copy with the simpler attachment /usr/lib/firefox/firefox{,-bin} does. [Workarounds] - Set "Optimize=no-diff-encode" in /etc/apparmor/parser.conf and reload all profiles. - Alternatively, add a local profile with a simpler attachment, e.g. /usr/lib/firefox/firefox{,-bin}. [Suggested fix - untested] In leftmatch_fb(), compute the input byte first (c = equiv[(u8) *str++] or (u8) *str++), then replace the open-coded transition with match_char(state, def, base, next, check, c), as aa_dfa_match() does. The is_loop() history and longest-left count logic should then be reviewed for diff-encoded default chains. Upstream report: https://gitlab.com/apparmor/apparmor- kernel/-/work_items/8 [Environment] Ubuntu 26.04.1 LTS (resolute) linux-image-7.0.0-38-generic 7.0.0-38.38 (/proc/version_signature: Ubuntu 7.0.0-38.38-generic 7.0.14) apparmor / libapparmor1 5.0.2-0ubuntu1~26.04.1 firefox 158.0.1~build1 (packages.mozilla.org) /sys/kernel/security/apparmor/features/policy/diff_encode: yes --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: invarianz 1478 F.... wireplumber /dev/snd/controlC1: invarianz 1478 F.... wireplumber /dev/snd/seq: invarianz 1454 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-06-27 (121 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) MachineType: LENOVO 30DH00H7GE Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=tmux-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=3c69bedc-0154-4019-a8e3-99860442ddb8 ro quiet splash ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 RebootRequiredPkgs: Error: path contained symlinks. Tags: resolute wayland-session Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: No upgrade log present (probably fresh install) UserGroups: adm cdrom dip lpadmin lxd plugdev sudo users _MarkForUpload: True dmi.bios.date: 03/21/2025 dmi.bios.release: 1.94 dmi.bios.vendor: LENOVO dmi.bios.version: S08KT5EA dmi.board.name: 1048 dmi.board.vendor: LENOVO dmi.board.version: SDK0T08861 WIN 3305348596304 dmi.chassis.type: 3 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrS08KT5EA:bd03/21/2025:br1.94:efr1.12:svnLENOVO:pn30DH00H7GE:pvrThinkStationP340:rvnLENOVO:rn1048:rvrSDK0T08861WIN3305348596304:cvnLENOVO:ct3:cvrNone:skuLENOVO_MT_30DH_BU_Think_FM_ThinkStationP340:pfaThinkStationP340: dmi.product.family: ThinkStation P340 dmi.product.name: 30DH00H7GE dmi.product.sku: LENOVO_MT_30DH_BU_Think_FM_ThinkStation P340 dmi.product.version: ThinkStation P340 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172229/+subscriptions