close Warning: Can't synchronize with repository "keplertools" (/srv/svn/keplertools does not appear to be a Subversion repository.). Look in the Trac log for more information.

Changes between Initial Version and Version 1 of Ticket #4166


Ignore:
Timestamp:
Oct 19, 2021, 6:47:15 PM (5 years ago)
Author:
Rüdiger Kupper
Comment:

Korrektur: eldungen sind über nicht erlaubten Mount, nicht Fork.

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #4166 – Description

    initial v1  
    1 1. Auf dem proxmoxls2-Rechner finden sich Meldungen im Kernel-Log, die darauf hinweisen, dass unser Collabora-Server (läuft dort im lxc-Container) Kindprozesse forken möchte, das aber nicht darf:
     11. Auf dem proxmoxls2-Rechner finden sich Meldungen im Kernel-Log, die darauf hinweisen, dass unser Collabora-Server (läuft dort im lxc-Container) Kind-Verzeichnisse mounten möchte, das aber nicht darf:
    22
    33{{{
    4 [Okt19 09:07] audit: type=1400 audit(1634627291.284:1679): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="l>
    5 [Okt19 09:23] audit: type=1400 audit(1634628261.137:1680): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="l>
    6 [Okt19 10:50] audit: type=1400 audit(1634633428.096:1681): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="l>
    7 [ +53,574161] audit: type=1400 audit(1634633481.673:1682): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="l>
    8 [Okt19 10:51] audit: type=1400 audit(1634633544.957:1683): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="l>
    9 [Okt19 11:53] audit: type=1400 audit(1634637240.122:1684): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="l>
    10 [Okt19 11:58] audit: type=1400 audit(1634637521.527:1685): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="l>
    11 [ +23,811341] audit: type=1400 audit(1634637545.335:1686): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="l>
    12 [Okt19 12:12] audit: type=1400 audit(1634638352.635:1687): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="l>
    13 [Okt19 12:20] audit: type=1400 audit(1634638827.397:1688): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="l>
    14 [Okt19 14:13] audit: type=1400 audit(1634645638.932:1689): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="l>
     4[6017583.898338] audit: type=1400 audit(1634627291.284:1679): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-105_</var/lib/lxc>" name="/opt/lool/child-roots/ysyxtq0meKL5EfHq/" pid=12568 comm="loolmount" flags="ro, nosuid, nodev, remount, noatime, rbind, silent"
     5[6018553.746462] audit: type=1400 audit(1634628261.137:1680): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-105_</var/lib/lxc>" name="/opt/lool/child-roots/KlTz7Nbd0QeRTjsi/" pid=21235 comm="loolmount" flags="ro, nosuid, nodev, remount, noatime, rbind, silent"
     6[6023720.682690] audit: type=1400 audit(1634633428.096:1681): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-105_</var/lib/lxc>" name="/opt/lool/child-roots/HCewB85HDa2iXopf/" pid=10036 comm="loolmount" flags="ro, nosuid, nodev, remount, noatime, rbind, silent"
     7[6023774.256851] audit: type=1400 audit(1634633481.673:1682): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-105_</var/lib/lxc>" name="/opt/lool/child-roots/haA6p2uRIahVHCyK/" pid=12544 comm="loolmount" flags="ro, nosuid, nodev, remount, noatime, rbind, silent"
     8[6023837.540163] audit: type=1400 audit(1634633544.957:1683): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-105_</var/lib/lxc>" name="/opt/lool/child-roots/WiJnlw6XWcbEblD3/" pid=15404 comm="loolmount" flags="ro, nosuid, nodev, remount, noatime, rbind, silent"
     9[6027532.686542] audit: type=1400 audit(1634637240.122:1684): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-105_</var/lib/lxc>" name="/opt/lool/child-roots/xp5oBGD2PwramUHw/" pid=7509 comm="loolmount" flags="ro, nosuid, nodev, remount, noatime, rbind, silent"
     10[6027814.093227] audit: type=1400 audit(1634637521.527:1685): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-105_</var/lib/lxc>" name="/opt/lool/child-roots/EQdOy6t1mVB7l8zH/" pid=20718 comm="loolmount" flags="ro, nosuid, nodev, remount, noatime, rbind, silent"
     11[6027837.904568] audit: type=1400 audit(1634637545.335:1686): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-105_</var/lib/lxc>" name="/opt/lool/child-roots/MLTpvZn9BtPGjfMJ/" pid=21745 comm="loolmount" flags="ro, nosuid, nodev, remount, noatime, rbind, silent"
     12[6028645.193124] audit: type=1400 audit(1634638352.635:1687): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-105_</var/lib/lxc>" name="/opt/lool/child-roots/rVcsDmFp3fx6UOOy/" pid=23343 comm="loolmount" flags="ro, nosuid, nodev, remount, noatime, rbind, silent"
     13[6029119.958264] audit: type=1400 audit(1634638827.397:1688): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-105_</var/lib/lxc>" name="/opt/lool/child-roots/yjSi07pQHCx2g5Gb/" pid=10761 comm="loolmount" flags="ro, nosuid, nodev, remount, noatime, rbind, silent"
     14[6035931.461182] audit: type=1400 audit(1634645638.932:1689): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-105_</var/lib/lxc>" name="/opt/lool/child-roots/n3w3aXvKTJnZ9OvQ/" pid=3270 comm="loolmount" flags="ro, nosuid, nodev, remount, noatime, rbind, silent"
    1515}}}
    16 
    17 Apparmor ist der Sicherheits-Mechanismus, den lxc-Container benutzen, um Programme auf ihre "Sandbox" zu beschränken. Dabei ist zunächst erst einmal fast alles verboten, außer, es gibt vom Hersteller eine apparmor-Regel, die es explizit erlaubt. Offenbar gibt es keine apparmor-Regel, die Collabora das forken erlaubt :-/.
    1816
    1917Das könnte der Grund sein, dass sich Office-Dokumente manchmal nicht in der Cloud öffnen lassen.