{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/396","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/396/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/396/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/396/events","html_url":"https://github.com/netblue30/firejail/issues/396","id":144927104,"number":396,"title":"AppArmor'd evince fails to open X display with firejail --net=none","user":{"login":"boite","id":989892,"avatar_url":"https://avatars.githubusercontent.com/u/989892?v=3","gravatar_id":"","url":"https://api.github.com/users/boite","html_url":"https://github.com/boite","followers_url":"https://api.github.com/users/boite/followers","following_url":"https://api.github.com/users/boite/following{/other_user}","gists_url":"https://api.github.com/users/boite/gists{/gist_id}","starred_url":"https://api.github.com/users/boite/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boite/subscriptions","organizations_url":"https://api.github.com/users/boite/orgs","repos_url":"https://api.github.com/users/boite/repos","events_url":"https://api.github.com/users/boite/events{/privacy}","received_events_url":"https://api.github.com/users/boite/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/netblue30/firejail/labels/information","name":"information","color":"f7c6c7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-03-31T15:01:29Z","updated_at":"2016-03-31T21:12:33Z","closed_at":null,"body":"Evince works fine with firejail, except when I try to restrict network access with:-\r\n\r\n    $ firejail --net=none evince ~/Downloads/Document.PDF\r\n    Reading profile /etc/firejail/evince.profile\r\n    Reading profile /etc/firejail/disable-mgmt.inc\r\n    Reading profile /etc/firejail/disable-secret.inc\r\n    Reading profile /etc/firejail/disable-common.inc\r\n    Reading profile /etc/firejail/disable-devel.inc\r\n    Parent pid 8315, child pid 8317\r\n\r\n    Child process initialized\r\n\r\n    ** (evince:2): WARNING **: Could not open X display\r\n    Cannot parse arguments: Cannot open display:\r\n\r\n    parent is shutting down, bye...\r\n\r\nThe kernel reports a pair of AppArmor denials:-\r\n\r\n    kernel: [14157.702352] type=1400 audit(1459434825.496:75): apparmor=\"DENIED\" operation=\"connect\" info=\"Failed name lookup - disconnected path\" error=-13 profile=\"/usr/bin/evince\" name=\"tmp/.X11-unix/X0\" pid=8320 comm=\"evince\" requested_mask=\"rw\" denied_mask=\"rw\" fsuid=1000 ouid=0\r\n    kernel: [14157.703145] type=1400 audit(1459434825.500:76): apparmor=\"DENIED\" operation=\"connect\" info=\"Failed name lookup - disconnected path\" error=-13 profile=\"/usr/bin/evince\" name=\"tmp/.X11-unix/X0\" pid=8320 comm=\"evince\" requested_mask=\"rw\" denied_mask=\"rw\" fsuid=1000 ouid=0\r\n\r\nThis is on Trisquel 7 (based on Ubuntu 14.04 LTS).\r\n\r\n    $ uname -mrv\r\n    3.13.0-83-generic #127+7.0trisquel2 SMP Mon Mar 14 18:19:05 UTC 2016 x86_64\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/204131431","html_url":"https://github.com/netblue30/firejail/issues/396#issuecomment-204131431","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/396","id":204131431,"user":{"login":"boite","id":989892,"avatar_url":"https://avatars.githubusercontent.com/u/989892?v=3","gravatar_id":"","url":"https://api.github.com/users/boite","html_url":"https://github.com/boite","followers_url":"https://api.github.com/users/boite/followers","following_url":"https://api.github.com/users/boite/following{/other_user}","gists_url":"https://api.github.com/users/boite/gists{/gist_id}","starred_url":"https://api.github.com/users/boite/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boite/subscriptions","organizations_url":"https://api.github.com/users/boite/orgs","repos_url":"https://api.github.com/users/boite/repos","events_url":"https://api.github.com/users/boite/events{/privacy}","received_events_url":"https://api.github.com/users/boite/received_events","type":"User","site_admin":false},"created_at":"2016-03-31T21:12:33Z","updated_at":"2016-03-31T21:12:33Z","body":"Thanks for the hint.  Evince still isn't allowed to start in complain mode and the apparmor messages still contained the \"Failed name lookup\" info and error -13 :-\r\n\r\n    apparmor=\"ALLOWED\" operation=\"connect\" info=\"Failed name lookup - disconnected path\" error=-13 profile=\"/usr/bin/evince\" name=\"tmp/.X11-unix/X0\" pid=9040 comm=\"evince\" requested_mask=\"rw\" denied_mask=\"rw\" fsuid=1000 ouid=0\r\n    apparmor=\"ALLOWED\" operation=\"connect\" info=\"Failed name lookup - disconnected path\" error=-13 profile=\"/usr/bin/evince\" name=\"tmp/.X11-unix/X0\" pid=9040 comm=\"evince\" requested_mask=\"rw\" denied_mask=\"rw\" fsuid=1000 ouid=0\r\n\r\nThere's a related issue [1373070][] in Ubuntu which gives some clue to the problem: disconnected paths. A recent comment from that issue mentions that:-\r\n> The proper fix for this is delegating access to the object that would not normally be accessible, however delegation is not available in the current releases of apparmor and the HACK of attach disconnected is being used to work around this.\r\n\r\nThe hack is to use the apparmor `attach_disconnected` flag and looks like this (for the evince profile):-\r\n\r\n      #include <tunables/global>\r\n      \r\n    - /usr/bin/evince {\r\n    + /usr/bin/evince flags=(attach_disconnected) {\r\n      #include <abstractions/audio>\r\n      #include <abstractions/bash>\r\n\r\nEvince, in enforce mode and with this flag, doesn't start, but the apparmor messages no longer contain the info and error data:-\r\n\r\n    apparmor=\"DENIED\" operation=\"connect\" profile=\"/usr/bin/evince\" name=\"/tmp/.X11-unix/X0\" pid=10819 comm=\"evince\" requested_mask=\"r\" denied_mask=\"r\" fsuid=1000 ouid=0\r\n    apparmor=\"DENIED\" operation=\"connect\" profile=\"/usr/bin/evince\" name=\"/tmp/.X11-unix/X0\" pid=10819 comm=\"evince\" requested_mask=\"r\" denied_mask=\"r\" fsuid=1000 ouid=0\r\n\r\nEvince does start, in complain mode and with the flag:-\r\n\r\n    Reading profile /etc/firejail/evince.profile\r\n    Reading profile /etc/firejail/disable-mgmt.inc\r\n    Reading profile /etc/firejail/disable-secret.inc\r\n    Reading profile /etc/firejail/disable-common.inc\r\n    Reading profile /etc/firejail/disable-devel.inc\r\n\r\n    ** (evince:2): WARNING **: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-5O0xyAUEEV: Connection refused\r\n\r\n    ** (evince:2): CRITICAL **: ev_bookmarks_get_bookmarks: assertion 'EV_IS_BOOKMARKS (bookmarks)' failed\r\n    Syntax Warning: Invalid Font Weight\r\n    ... [snipped many \"Syntax Warning: Invalid Font Weight\"] ...\r\n    Parent pid 10939, child pid 10941\r\n\r\nThat output is almost the same as produced without `--net=none` and with the standard apparmor profile, except for the extra CRITCAL message about bookmarks. The apparmor messages:-\r\n\r\n    apparmor=\"ALLOWED\" operation=\"connect\" profile=\"/usr/bin/evince\" name=\"/tmp/.X11-unix/X0\" pid=10944 comm=\"evince\" requested_mask=\"r\" denied_mask=\"r\" fsuid=1000 ouid=0\r\n    apparmor=\"ALLOWED\" operation=\"connect\" profile=\"/usr/bin/evince\" name=\"/tmp/.X11-unix/X0\" pid=10944 comm=\"evince\" requested_mask=\"r\" denied_mask=\"r\" fsuid=1000 ouid=0\r\n\r\nSo it seems that:-\r\n\r\n- the apparmor `attach_disconnected` flag affects the `requested_mask` by not requesting permission to write and it prevents the \"Failed name lookup - disconnected path\" error, probably because the path being connected to is given a leading slash\r\n- `firejail --net=none` triggers a connect operation which apparmor denies\r\n\r\n[1373070]: <https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1373070>"}}