RocketChat / RocketChat/Rocket.Chat
apparmor config is incorrect in snap
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
The following errors persistently appear in the system log.
audit[1046]: AVC apparmor="DENIED" operation="open" profile="snap.rocketchat-server.rocketchat-mongo" name="/proc/1046/net/netstat" pid=1046 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
audit[1046]: AVC apparmor="DENIED" operation="open" profile="snap.rocketchat-server.rocketchat-mongo" name="/proc/1046/net/snmp" pid=1046 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Steps to reproduce:
- Install rocket chat using the snap.
- Allow the server to run for any length of time.
- Inspect system log by running command
journalctl -f.
Expected behavior:
No errors in system log.
Actual behavior:
Many errors in system log that are continually generated - See description for errors that appear persistently.
Server Setup Information:
- Version of Rocket.Chat Server: 2.4.11
- Operating System: Ubuntu 18.04 LTS (AWS)
- Deployment Method: snap
- Number of Running Instances: 1
- DB Replicaset Oplog: ???
- NodeJS Version: Not installed.
- MongoDB Version: ???
Client Setup Information
- Desktop App or Browser Version: N/A
- Operating System: N/A
Additional context
The workaround fix is documented here - please include this in the next snap update
https://github.com/RocketChat/Rocket.Chat/issues/14562#issuecomment-498321790
Relevant logs:
See description.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the AppArmor denial messages and the workaround documented in issue 14562's linked comment. Inspect the snap's AppArmor configuration and verify the change by running the snap, following journalctl, and confirming that the repeated /proc netstat and snmp denials no longer appear.
Written by the indexing model from the issue text.
Assessment
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100