AppArmor

AppArmor should support changing the security context of a threaded process

Bug #1552341 reported by Tyler Hicks
224
This bug affects 49 people
Affects Status Importance Assigned to Milestone
AppArmor
Triaged
Low
Unassigned
Canonical System Image
Confirmed
Low
Zoltan Balogh

Bug Description

The aa_change_profile() and aa_change_onexec() functions are not safe to use with multi-threaded processes because only the main thread will be transitioned. We should support a way to transition all threads of a multi-threaded process.

One immediate user of the feature would be mapplauncherd in Ubuntu Touch. The QML booster starts the QML engine as part of its pre-caching work. Since the QML engine is multi-threaded, the QML booster cannot be used for confined apps on Ubuntu Touch because there's no way to transition all the threads to the necessary profile for app confinement.

Revision history for this message
Andrea Bernabei (faenil) wrote :

This would be immensely beneficial to our platform, it would be great to get some resources assigned to it :)

Revision history for this message
Pat McGowan (pat-mcgowan) wrote :

Note that testing results concluded the applauncherd approach did not yield any notable improvement in startup time.

Changed in canonical-devices-system-image:
assignee: nobody → Zoltan Balogh (bzoltan)
importance: Undecided → Low
status: New → Confirmed
Revision history for this message
Tyler Hicks (tyhicks) wrote :

Thanks for the update, Pat. The AppArmor project, in general, wants to support multi threaded security context changes but we can lower the priority of this feature request now that we know it won't benefit app startup times.

Changed in apparmor:
importance: High → Low
Revision history for this message
Pat McGowan (pat-mcgowan) wrote :

To clarify the actual benefit, on a first run before the cache is created it was seen to save as much as 1 to 1.5 secs on some apps, which is equivalent to what the cache provides. So providing this would improve the overall experience, and I believe it would allow us to stop using the cache which occasionally causes app starting issues, for example when it somehow becomes corrupted.(see bug #1560020)

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.