geoclue service prevented from working by apparmor profile

Ignore the dconf ones, I manually tried to start it, but that seems to be an apparmor profile issue:

Aug 10 10:55:54 jak-t14-g3 kernel: audit: type=1400 audit(1691657754.860:110): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="/usr/libexec/geoclue" name="run/dbus/system_bus_socket" pid=6521 comm="pool-geoclue" requested_mask="wr" denied_mask="wr" fsuid=123 ouid=0
Aug 10 10:55:54 jak-t14-g3 kernel: audit: type=1400 audit(1691657754.860:111): apparmor="DENIED" operation="sendmsg" class="file" info="Failed name lookup - disconnected path" error=-13 profile="/usr/libexec/geoclue" name="run/systemd/journal/socket" pid=6521 comm="geoclue" requested_mask="w" denied_mask="w" fsuid=123 ouid=0
Aug 10 10:56:36 jak-t14-g3 kernel: audit: type=1400 audit(1691657796.149:114): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="/usr/libexec/geoclue" name="run/dbus/system_bus_socket" pid=8550 comm="pool-geoclue" requested_mask="wr" denied_mask="wr" fsuid=123 ouid=0
Aug 10 10:56:36 jak-t14-g3 kernel: audit: type=1400 audit(1691657796.149:115): apparmor="DENIED" operation="sendmsg" class="file" info="Failed name lookup - disconnected path" error=-13 profile="/usr/libexec/geoclue" name="run/systemd/journal/socket" pid=8550 comm="geoclue" requested_mask="w" denied_mask="w" fsuid=123 ouid=0
Aug 10 10:59:20 jak-t14-g3 kernel: audit: type=1400 audit(1691657960.520:116): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="/usr/libexec/geoclue" name="run/dbus/system_bus_socket" pid=13529 comm="pool-geoclue" requested_mask="wr" denied_mask="wr" fsuid=123 ouid=0
Aug 10 10:59:20 jak-t14-g3 kernel: audit: type=1400 audit(1691657960.520:117): apparmor="DENIED" operation="sendmsg" class="file" info="Failed name lookup - disconnected path" error=-13 profile="/usr/libexec/geoclue" name="run/systemd/journal/socket" pid=13529 comm="geoclue" requested_mask="w" denied_mask="w" fsuid=123 ouid=0
Aug 10 11:00:22 jak-t14-g3 kernel: audit: type=1107 audit(1691658022.425:118): pid=1996 uid=102 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.13" pid=14683 label="/usr/libexec/geoclue" peer_pid=2096 peer_label="unconfined"
Aug 10 11:00:22 jak-t14-g3 kernel: audit: type=1400 audit(1691658022.429:119): apparmor="DENIED" operation="open" class="file" profile="/usr/libexec/geoclue" name="/run/user/1000/dconf/user" pid=14683 comm="geoclue" requested_mask="wrc" denied_mask="wrc" fsuid=1000 ouid=1000
Aug 10 11:00:22 jak-t14-g3 kernel: audit: type=1400 audit(1691658022.429:120): apparmor="DENIED" operation="open" class="file" profile="/usr/libexec/geoclue" name="/home/jak/.config/dconf/user" pid=14683 comm="geoclue" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Aug 10 11:00:22 jak-t14-g3 kernel: audit: type=1400 audit(1691658022.429:121): apparmor="DENIED" operation="open" class="file" profile="/usr/libexec/geo...

https://launchpad.net/ubuntu/+source/geoclue-2.0/2.7.0-3ubuntu1 landed in mantic today. Does it fix your issue?

No of course not, the AppArmor profile has not yet been fixed such that the geoclue service can actually start.

Hi! I updated the AppArmor policy from geoclue-2.0 and uploaded to a PPA https://launchpad.net/~georgiag/+archive/ubuntu/lp2030951/+packages

From what I checked, it is starting successfully now, but let me know if it's not.

$ sudo systemctl status geoclue.service
● geoclue.service - Location Lookup Service
     Loaded: loaded (/lib/systemd/system/geoclue.service; static)
     Active: active (running) since Fri 2023-08-25 16:20:34 -03; 1s ago
   Main PID: 14146 (geoclue)
      Tasks: 5 (limit: 1056)
     Memory: 1.9M
        CPU: 56ms
     CGroup: /system.slice/geoclue.service
             └─14146 /usr/libexec/geoclue

Aug 25 16:20:34 sec-mantic-amd64 systemd[1]: Starting geoclue.service - Location Lookup Service...
Aug 25 16:20:34 sec-mantic-amd64 systemd[1]: Started geoclue.service - Location Lookup Service.

Hello Georgia,

I noticed that you subscribed ubuntu-sponsors to this bug, but haven't provided a debdiff or an MP with the proposed change to be reviewed. I know I could obtain it from the PPA, but I'd prefer if you could put something more "official" together.

Thanks!

Thanks for the fix Georgia, I've uploaded it to mantic now and also sent it back to the Debian maintainer

This bug was fixed in the package geoclue-2.0 - 2.7.0-3ubuntu2

---------------
geoclue-2.0 (2.7.0-3ubuntu2) mantic; urgency=medium

  * debian/local/usr.libexec.geoclue:
    - Update apparmor policy to allow several DBus operations.
      (LP: #2030951)

 -- Georgia Garcia <email address hidden> Fri, 25 Aug 2023 15:20:04 -0300

Reopening, it owns the dbus name fine now but is still not working

Starts here afaict, gps blocked by apparmor though.

What do you see, seb?

● geoclue.service - Location Lookup Service
     Loaded: loaded (/lib/systemd/system/geoclue.service; static)
     Active: active (running) since Wed 2023-09-20 18:53:28 CEST; 35s ago
   Main PID: 1594438 (geoclue)
      Tasks: 4 (limit: 37482)
     Memory: 2.4M
        CPU: 153ms
     CGroup: /system.slice/geoclue.service
             └─1594438 /usr/libexec/geoclue

Sep 20 18:53:28 jak-t14-g3 systemd[1]: Starting geoclue.service - Location Lookup Service...
Sep 20 18:53:28 jak-t14-g3 systemd[1]: Started geoclue.service - Location Lookup Service.
Sep 20 18:53:28 jak-t14-g3 geoclue[1594438]: Failed to set GPS refresh rate: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender=":1.2613" (uid=123 pid=1594438 comm="/usr/libexec/geoclue" label="/usr/libexec/geoclue (enforce)") interface="org.freedesktop.ModemManager1.Modem.Location" member="SetGpsRefreshRate" error name="(unset)" requested_reply="0" destination=":1.17" (uid=0 pid=2021 comm="/usr/sbin/ModemManager" label="unconfined")

Julian, I think you're saying the same as Seb. The service can start but the new apparmor profile in Ubuntu 23.10 is preventing geoclue from providing location info to apps and services that use geoclue.

Oh that's possible but for me it's denying geoclue from accessing my LTE modem for GPS data, I don't have a test to check if it can provide other data.

The attached patch is enough to get the service working but doesn't accomodate for the GPS usecase, I expect there is more than the one denial Julian listed.

I would suggest updating the profile as we can but not putting it in enforce mode for mantic.

FWIW, I disabled the AppArmor profile and clients still don't connect or rather geoclue times out, don't know what's going on but probably separate bug. Even deleted my modem devices and masked modemmanger, thinking it may be talking to that and hanging there

This bug was fixed in the package geoclue-2.0 - 2.7.0-3ubuntu3

---------------
geoclue-2.0 (2.7.0-3ubuntu3) mantic; urgency=medium

  * debian/geoclue-2.0.install, debian/local/usr.libexec.geoclue,
    debian/geoclue-2.0.maintscript:
    - remove the apparmor profile which was added by Debian this cycle,
      the dbus mediation is preventing it from working properly, the issue
      isn't visible in Debian since the dbus service there doesn't include
      the same features than in Ubuntu. It's a bit late in the cycle
      to ensure there will no regression so we prefer to not include it now
      (LP: #2030951)

 -- Sebastien Bacher <email address hidden> Tue, 26 Sep 2023 18:03:27 +0200