From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750873AbdJCFPK (ORCPT ); Tue, 3 Oct 2017 01:15:10 -0400 Received: from bedivere.hansenpartnership.com ([66.63.167.143]:56050 "EHLO bedivere.hansenpartnership.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750720AbdJCFPJ (ORCPT ); Tue, 3 Oct 2017 01:15:09 -0400 Message-ID: <1507007707.3082.16.camel@HansenPartnership.com> Subject: Re: regression in 4.14-rc2 caused by apparmor: add base infastructure for socket mediation From: James Bottomley To: John Johansen , Seth Arnold Cc: linux-kernel Date: Mon, 02 Oct 2017 22:15:07 -0700 In-Reply-To: References: <1507003338.3174.4.camel@HansenPartnership.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 2017-10-02 at 21:11 -0700, John Johansen wrote: > On 10/02/2017 09:02 PM, James Bottomley wrote: > > > > The specific problem is that dnsmasq refuses to start on openSUSE > > Leap 42.2.  The specific cause is that and attempt to open a > > PF_LOCAL socket gets EACCES.  This means that networking doesn't > > function on a system with a 4.14-rc2 system. > > > > Reverting commit 651e28c5537abb39076d3949fb7618536f1d242e > > (apparmor: add base infastructure for socket mediation) causes the > > system to function again. > > > > This is not a kernel regression, Regression means something that worked in a previous version of the kernel which is broken now. This problem falls within that definition. > it is because  opensuse dnsmasque is starting with policy that > doesn't allow access to PF_LOCAL socket Because there was no co-ordination between their version of the patch and yours.  If you're sending in patches that you know might break systems because they need a co-ordinated rollout of something in userspace then it would be nice if you could co-ordinate it ... Doing it in the merge window and not in -rc2 would also be helpful because I have more expectation of a userspace mismatch from stuff in the merge window. > Christian Boltz the opensuse apparmor maintainer has been working > on a policy update for opensuse see bug > > https://bugzilla.opensuse.org/show_bug.cgi?id=1061195 Well, that looks really encouraging: The line about "To give you an impression what "lots of" means - I had to adjust 40 profiles on my laptop".  The upshot being apart from a bandaid, openSUSE still has no co-ordinated fix for this. James