[karmic] aa_change_profile() no longer works

This is still a problem with up to date karmic, however the error message is different. Using the above test case I get:

$ sudo ./a.out
could not change profile: Permission denied

$ cat /proc/version_signature
Ubuntu 2.6.31-5.24-generic

apparmor: 2.3.1+1403-0ubuntu9

I just noticed that if the parent profile is in complain mode and the child profile is in enforce mode, it doesn't error out with permission denied, but also does honor the enforcing profiles rules.

Eg:
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <time.h>
#include <limits.h>
#include <stdarg.h>
#include <sys/apparmor.h>

int main(int argc, char *argv[]) {
    char *profile_name = "foo";
    int fd;

    if (aa_change_profile(profile_name) != 0) {
        perror("could not change profile");
        exit(1);
    }

    if ((fd = open("/tmp/foo", O_CREAT|O_TRUNC, 0644)) == -1) {
        printf("confined\n");
        exit(0);
    }
    printf("unconfined\n");
    close(fd);

    exit(1);
}

$ cd /tmp
$ gcc -lapparmor ./foo.c

$ cat /etc/apparmor.d/tmp.a.out
#include <tunables/global>

/tmp/a.out flags=(complain) {
  #include <abstractions/base>
  /** rwmkl,

  change_profile -> foo,
}

profile foo {
  /** rwmkl,
  audit deny /tmp/foo rw,
}

$ ./a.out
unconfined
[1]
$ ls -l /tmp/foo
-rw-r--r-- 1 jamie jamie 0 2009-08-05 16:56 /tmp/foo

Using the following profile:
$ cat /etc/apparmor.d/tmp.a.out
#include <tunables/global>

/tmp/a.out {
  #include <abstractions/base>
  /** rwmkl,

  change_profile -> foo,
}

profile foo {
  /** rwmkl,
  audit deny /tmp/foo rw,
}

$ /tmp/a.out
could not change profile: Permission denied
[1]

John,

Tested the kernel package you gave me today on chinstrap, and aa_change_profile() is working perfectly. Thanks!

John,

Tested the updated kernel packages today (linux-image-2.6.31-9-generic_2.6.31-9.29_*.deb on chinstrap) and aa_change_profile() is again, working perfectly. Thanks!

This bug was fixed in the package linux - 2.6.31-10.30

---------------
linux (2.6.31-10.30) karmic; urgency=low

  [ Amit Kucheria ]

  * [Config] Enable CONFIG_USB_DEVICEFS
    - LP: #417748
  * [Config] Populate the config-update template a bit more

  [ Andy Whitcroft ]

  * rebase to v2.6.31-rc9
  * [Config] update configs following rebase to v2.6.31-rc9
  * [Config] update ports configs following rebase to v2.6.31-rc9

  [ Colin Ian King ]

  * SAUCE: wireless: hostap, fix oops due to early probing interrupt
    - LP: #254837

  [ Jerone Young ]

  * [Upstream] ACPI: Add Thinkpad T400 & Thinkpad T500 to OSI(Linux)
    white-list
    - LP: #281732
  * [Upstream] ACPI: Add Thinkpad X200, X200s, X200t to OSI(Linux)
    white-list
    - LP: #281732
  * [Upstream] ACPI: Add Thinkpad X300 & Thinkpad X301 to OSI(Linux)
    white-list
    - LP: #281732
  * [Upstream] ACPI: Add Thinkpad R400 & Thinkpad R500 to OSI(Linux)
    white-list
    - LP: #281732
  * [Upstream] ACPI: Add Thinkpad W500, W700, & W700ds to OSI(Linux)
    white-list
    - LP: #281732

  [ John Johansen ]

  * SAUCE: AppArmor: Fix profile attachment for regexp based profile names
    - LP: #419308
  * SAUCE: AppArmor: Return the correct error codes on profile
    addition/removal
    - LP: #408473
  * SAUCE: AppArmor: Fix OOPS in profile listing, and display full list
    - LP: #408454
  * SAUCE: AppArmor: Fix mapping of pux to new internal permission format
    - LP: #419222
  * SAUCE: AppArmor: Fix change_profile failure
    - LP: #401931
  * SAUCE: AppArmor: Tell git to ignore generated include files
    - LP: #419505

  [ Stefan Bader ]

  * [Upstream] acpi: video: Loosen strictness of video bus detection code
    - LP: #333386
  * SAUCE: Remove ov511 driver from ubuntu subdirectory

  [ Tim Gardner ]

  * [Config] Exclude char-modules from non-x86 udeb creation
  * SAUCE: Notify the ACPI call chain of AC events
  * [Config] CONFIG_SATA_VIA=m
    - LP: #403385
  * [Config] Build in all phylib support modules.
  * [Config] Don't fail when sub-flavour files are missing
    - LP: #423426
  * [Config] Set CONFIG_LSM_MMAP_MIN_ADDR=0
    - LP: #423513

  [ Upstream ]

  * Rebased against v2.6.31-rc9

 -- Andy Whitcroft <email address hidden> Mon, 07 Sep 2009 11:33:45 +0100