RocketChat / RocketChat/Rocket.Chat

apparmor config is incorrect in snap

Open
#18,086 24 comments 8 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

The following errors persistently appear in the system log.

audit[1046]: AVC apparmor="DENIED" operation="open" profile="snap.rocketchat-server.rocketchat-mongo" name="/proc/1046/net/netstat" pid=1046 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
audit[1046]: AVC apparmor="DENIED" operation="open" profile="snap.rocketchat-server.rocketchat-mongo" name="/proc/1046/net/snmp" pid=1046 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Steps to reproduce:
  1. Install rocket chat using the snap.
  2. Allow the server to run for any length of time.
  3. Inspect system log by running command journalctl -f.
Expected behavior:

No errors in system log.

Actual behavior:

Many errors in system log that are continually generated - See description for errors that appear persistently.

Server Setup Information:
  • Version of Rocket.Chat Server: 2.4.11
  • Operating System: Ubuntu 18.04 LTS (AWS)
  • Deployment Method: snap
  • Number of Running Instances: 1
  • DB Replicaset Oplog: ???
  • NodeJS Version: Not installed.
  • MongoDB Version: ???
Client Setup Information
  • Desktop App or Browser Version: N/A
  • Operating System: N/A
Additional context

The workaround fix is documented here - please include this in the next snap update
https://github.com/RocketChat/Rocket.Chat/issues/14562#issuecomment-498321790

Relevant logs:

See description.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the AppArmor denial messages and the workaround documented in issue 14562's linked comment. Inspect the snap's AppArmor configuration and verify the change by running the snap, following journalctl, and confirming that the repeated /proc netstat and snmp denials no longer appear.

Written by the indexing model from the issue text.

Assessment

Domain
operating-systems, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.