Ubuntu
upstart-app-launch package

upstart-app-launch does not set (at least) TMPDIR correctly

Bug #1260079 reported by Adnane Belmadiaf
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ubuntu Application Launcher
Fix Released
Critical
Ted Gould
upstart-app-launch (Ubuntu)
Fix Released
Critical
Unassigned

Bug Description

My app "Rad.io" (available on the store) can't parse playlists anymore, i believe because it's using temp file to store them (using QTemporaryFile), i am also seeing errors like :

libust[3229/3231]: Error: Error opening shm /lttng-ust-wait-5 (in get_wait_shm() at lttng-ust-comm.c:715)

and

(qmlscene:3229): dconf-CRITICAL **: unable to create file '/run/user/32011/dconf/user': Permission non accordée. dconf will not work properly.

from the dmesg :
[ 504.841843] type=1400 audit(1386716356.945:169): apparmor="DENIED" operation="mknod" parent=1525 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.7" name="/run/user/32011/confined/com.ubuntu.developer.daker.rad-io.TJ3229" pid=3229 comm="qmlscene" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011
[ 504.909720] type=1400 audit(1386716357.015:170): apparmor="DENIED" operation="open" parent=1525 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.7" name="/run/user/32011/dconf/user" pid=3229 comm="qmlscene" requested_mask="rwc" denied_mask="rwc" fsuid=32011 ouid=32011

App output http://paste.ubuntu.com/6553674/

and here is the cpp code i use for the plugin https://bazaar.launchpad.net/~rad.io-devs/rad.io/trunk/view/head:/plugin/player.cpp
QML : https://bazaar.launchpad.net/~rad.io-devs/rad.io/trunk/view/head:/rad.io.qml

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: apparmor-easyprof-ubuntu 1.0.42
Uname: Linux 3.4.0-3-mako armv7l
ApportVersion: 2.12.7-0ubuntu2
Architecture: armhf
Date: Wed Dec 11 21:18:34 2013
InstallationDate: Installed on 2013-12-11 (0 days ago)
InstallationMedia: Ubuntu Trusty Tahr (development branch) - armhf (20131211)
PackageArchitecture: all
ProcEnviron:
 TERM=linux
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 SHELL=/bin/bash
SourcePackage: apparmor-easyprof-ubuntu
UpgradeStatus: No upgrade log present (probably fresh install)

Related branches

lp://staging/~ted/ubuntu-app-launch/lp1260079
Charles Kerr (community): Approve
PS Jenkins bot (community): Approve (continuous-integration)
Diff: 37 lines (+5/-1)
1 file modified
click-exec.c (+5/-1)
lp://staging/ubuntu/trusty-proposed/upstart-app-launch
Revision history for this message
Adnane Belmadiaf (daker) wrote :
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

The dconf denial should be harmless, unless you adjsted your app to use gsettings (you shouldn't, gsettings isn't currently supported in the SDK).

/run/user/32011/confined/com.ubuntu.developer.daker.rad-io.TJ3229 is not the correct path though. It seems like something isn't evaluating TMPDIR correctly. TMPDIR should be set to /run/user/32011/confined/com.ubuntu.developer.daker.rad-io. Can you give the value of TMPDIR when your app is running?

Revision history for this message
Adnane Belmadiaf (daker) wrote :

 tmpdir: "/run/user/32011/confined/"

dmesg

[ 2877.213276] type=1400 audit(1386805318.957:212): apparmor="DENIED" operation="open" parent=1608 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.8" name="/run/shm/lttng-ust-wait-5" pid=6829 comm="exec-line-exec" requested_mask="r" denied_mask="r" fsuid=32011 ouid=32011
[ 2877.213520] type=1400 audit(1386805318.957:213): apparmor="DENIED" operation="open" parent=1608 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.8" name="/run/shm/lttng-ust-wait-5" pid=6829 comm="exec-line-exec" requested_mask="r" denied_mask="r" fsuid=32011 ouid=32011
[ 2877.820784] type=1400 audit(1386805319.568:214): apparmor="DENIED" operation="mkdir" parent=1608 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.8" name=2F686F6D652F706861626C65742F2E6C6F63616C2F73686172652F51742050726F6A6563742F pid=6827 comm="qmlscene" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011
[ 2877.832290] type=1400 audit(1386805319.578:215): apparmor="DENIED" operation="mkdir" parent=1608 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.8" name=2F686F6D652F706861626C65742F2E6C6F63616C2F73686172652F51742050726F6A6563742F pid=6827 comm="qmlscene" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011

[ 3258.436013] type=1400 audit(1386805700.184:245): apparmor="DENIED" operation="mknod" parent=1608 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.8" name="/run/user/32011/confined/com.ubuntu.developer.daker.rad-io.kn6827" pid=6827 comm="qmlscene" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011
[ 3258.723759] type=1400 audit(1386805700.464:246): apparmor="DENIED" operation="mknod" parent=1608 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.8" name="/run/user/32011/confined/com.ubuntu.developer.daker.rad-io.Ti6827" pid=6827 comm="qmlscene" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011
[ 3259.286616] type=1400 audit(1386805701.035:247): apparmor="DENIED" operation="open" parent=1608 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.8" name="/sys/devices/virtual/timed_output/vibrator/enable" pid=6827 comm="qmlscene" requested_mask="wc" denied_mask="wc" fsuid=32011 ouid=1000

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

On image 60, when I launch the app I see (this is also what is seen in comment #3):
Dec 12 20:25:51 ubuntu-phablet kernel: [ 449.802198] type=1400 audit(1386879951.569:119): apparmor="DENIED" operation="mkdir" parent=1394 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.7" name=2F686F6D652F706861626C65742F2E6C6F63616C2F73686172652F51742050726F6A6563742F pid=2857 comm="qmlscene" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011

name=2F686F6D652F706861626C65742F2E6C6F63616C2F73686172652F51742050726F6A6563742F decodes to:
$ aa-decode 2F686F6D652F706861626C65742F2E6C6F63616C2F73686172652F51742050726F6A6563742F
Decoded: /home/phablet/.local/share/Qt Project/

rad.io.qml correctly has this in MainView:
applicationName: "com.ubuntu.developer.daker.rad-io"

as for the other apparmor denials:
 * /run/shm/lttng-ust-wait-5 - I'm not seeing this on grouper with surface flinger. I believe it is harmless though.
 * /sys/devices/virtual/timed_output/vibrator/enable - this is fixed in apparmor-easyprof-ubuntu 1.0.43 and should not affect the usability of the app
 * /run/user/32011/confined/com.ubuntu.developer.daker.rad-io.Ti6827 - I was able to confirm that TMPDIR is not being set correctly. If a start with aa-exec-click, it correctly set TMPDIR to '/run/user/32011/confined/com.ubuntu.developer.daker.rad-io', but when launching under upstart-app-launch, it is being set to '/run/user/32011/confined/'. I saw another time that upstart-app-launch set it is '/run/user/32011/confined//home/phablet/.local/share'

I am going to assign to upstart-app-launch for now. Since it isn't setting TMPDIR correctly, it might not be setting other variables correctly.

My testing:
1. Create /opt/click.ubuntu.com/com.ubuntu.developer.daker.rad-io/current/foo with:
#!/bin/sh
echo "TMPDIR=$TMPDIR"
echo "APP_ID=$APP_ID"

2. chmod 755 /opt/click.ubuntu.com/com.ubuntu.developer.daker.rad-io/current/foo

3. adjust /home/phablet/.cache/upstart-app-launch/desktop/com.ubuntu.developer.daker.rad-io_rad.io_0.7.desktop to have:
Exec=/opt/click.ubuntu.com/com.ubuntu.developer.daker.rad-io/current/foo

4. run upstart-app-launch:
$ start application APP_ID=com.ubuntu.developer.daker.rad-io_rad.io_0.7 ; sleep 5 ; tail /home/phablet/.cache/upstart/application-click-com.ubuntu.developer.daker.rad-io_rad.io_0.7.log
application start/running, process 3733
libust[3765/3768]: Error: Error opening shm /lttng-ust-wait-5-32011 (in get_wait_shm() at lttng-ust-comm.c:715)
libust[3765/3767]: Error: Error opening shm /lttng-ust-wait-5 (in get_wait_shm() at lttng-ust-comm.c:715)
libust[3765/3768]: Error: Error opening shm /lttng-ust-wait-5-32011 (in get_wait_shm() at lttng-ust-comm.c:715)
TMPDIR=/run/user/32011/confined//home/phablet/.local/share
APP_ID=com.ubuntu.developer.daker.rad-io_rad.io_0.7

5. run aa-exec-click:
$ aa-exec-click -p com.ubuntu.developer.daker.rad-io_rad.io_0.7 -- /opt/click.ubuntu.com/com.ubuntu.developer.daker.rad-io/current/foo
TMPDIR=/run/user/32011/confined/com.ubuntu.developer.daker.rad-io
APP_ID=com.ubuntu.developer.daker.rad-io_rad.io_0.7

affects: apparmor-easyprof-ubuntu (Ubuntu) → upstart-app-launch (Ubuntu)
summary: - Can't store temp files anymore
+ upstart-app-launch does not set TMPDIR correctly
Revision history for this message
Jamie Strandboge (jdstrand) wrote : Re: upstart-app-launch does not set TMPDIR correctly

Confirmed this is still a problem on image 62. Running upstart-app-launch the first few times gave:
TMPDIR=/run/user/32011/confined/

then it started giving:
TMPDIR=/run/user/32011/confined//home/phablet/.local/share

(both are wrong, it should be TMPDIR=/run/user/32011/confined/com.ubuntu.developer.daker.rad-io)

Changed in upstart-app-launch (Ubuntu):
importance: Undecided → Critical
summary: - upstart-app-launch does not set TMPDIR correctly
+ upstart-app-launch does not set (at least) TMPDIR correctly
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Actually, I do see the /run/shm/lttng-ust* apparmor denials. It was just not in the first run. Here is what I see on 62:
Dec 12 21:04:58 ubuntu-phablet kernel: [ 101.536491] type=1400 audit(1386882298.525:77): apparmor="DENIED" operation="open" parent=1376 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.7" name="/run/shm/lttng-ust-wait-5-32011" pid=2092 comm="exec-line-exec" requested_mask="r" denied_mask="r" fsuid=32011 ouid=32011
Dec 12 21:04:58 ubuntu-phablet kernel: [ 101.536724] type=1400 audit(1386882298.525:78): apparmor="DENIED" operation="open" parent=1376 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.7" name="/run/shm/lttng-ust-wait-5-32011" pid=2092 comm="exec-line-exec" requested_mask="r" denied_mask="r" fsuid=32011 ouid=32011
Dec 12 21:04:58 ubuntu-phablet kernel: [ 101.537013] type=1400 audit(1386882298.525:79): apparmor="DENIED" operation="open" parent=1376 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.7" name="/run/shm/lttng-ust-wait-5" pid=2091 comm="exec-line-exec" requested_mask="r" denied_mask="r" fsuid=32011 ouid=32011
Dec 12 21:04:58 ubuntu-phablet kernel: [ 101.537190] type=1400 audit(1386882298.525:80): apparmor="DENIED" operation="open" parent=1376 profile="com.ubuntu.developer.daker.rad-io_rad.io_0.7" name="/run/shm/lttng-ust-wait-5" pid=2091 comm="exec-line-exec" requested_mask="r" denied_mask="r" fsuid=32011 ouid=32011

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Adding the following to /var/lib/apparmor/profiles/click_com.ubuntu.developer.daker.rad-io_rad.io_0.7:
/run/shm/lttng-ust-wait-[0-9]* r,

and running:
$ sudo apparmor_parser -r /var/lib/apparmor/profiles/click_com.ubuntu.developer.daker.rad-io_rad.io_0.7 makes the denials go away, but upstart-app-launch is still not setting TMPDIR correctly.

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Btw, why do apps now need /run/shm/lttng-ust-wait-[0-9]*? This seems like a potential information leak between apps. What is lttng-ust used for?

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Ted explained what /run/shm/lttng-ust-wait-[0-9]* is for. It is for tracing and apps should not have access to them. bug #1260491 will address the denials.

Ted Gould (ted)
Changed in upstart-app-launch:
status: New → In Progress
importance: Undecided → Critical
assignee: nobody → Ted Gould (ted)
Revision history for this message
PS Jenkins bot (ps-jenkins) wrote :

Fix committed into lp:upstart-app-launch at revision 97, scheduled for release in upstart-app-launch, milestone Unknown

Changed in upstart-app-launch:
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package upstart-app-launch - 0.3+14.04.20131218-0ubuntu1

---------------
upstart-app-launch (0.3+14.04.20131218-0ubuntu1) trusty; urgency=low

  [ Ken VanDine ]
  * Multi-Arch: same libraries must not depend on run-time application,.
    since this breaks cross-compilation. Furthermore, circular
    dependencies are never needed: upstart-app-launch depends on
    libupstart-app-launch2, which depends on upstart-app-launch. It's
    the same reasoning why we do not make libgtk-3.0 depend on epiphany
    webbrowser, even though gtk has functions to open URL in a
    webbrowser. And in a multi-arch world libgtk-3.0 would never know
    which architecture your web-browser is, it could be any. Libraries
    should only ever depend on other linked shared libraries.

  [ Ted Gould ]
  * Make sure that 'package' sticks around until we setup the
    environment. (LP: #1260079)
  * Improve readability of the coverage report.

  [ Didier Roche ]
  * revert the archictecture specific list: britney doesn't use those

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 100
 -- Ubuntu daily release <email address hidden> Wed, 18 Dec 2013 19:40:19 +0000

Changed in upstart-app-launch (Ubuntu):
status: New → Fix Released
Ted Gould (ted)
Changed in upstart-app-launch:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.