From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751072AbdJCEL5 (ORCPT ); Tue, 3 Oct 2017 00:11:57 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:59269 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750767AbdJCEL4 (ORCPT ); Tue, 3 Oct 2017 00:11:56 -0400 Subject: Re: regression in 4.14-rc2 caused by apparmor: add base infastructure for socket mediation To: James Bottomley , Seth Arnold Cc: linux-kernel References: <1507003338.3174.4.camel@HansenPartnership.com> From: John Johansen Organization: Canonical Message-ID: Date: Mon, 2 Oct 2017 21:11:52 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <1507003338.3174.4.camel@HansenPartnership.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/02/2017 09:02 PM, James Bottomley wrote: > The specific problem is that dnsmasq refuses to start on openSUSE Leap > 42.2.  The specific cause is that and attempt to open a PF_LOCAL socket > gets EACCES.  This means that networking doesn't function on a system > with a 4.14-rc2 system. > > Reverting commit 651e28c5537abb39076d3949fb7618536f1d242e (apparmor: > add base infastructure for socket mediation) causes the system to > function again. > This is not a kernel regression, it is because opensuse dnsmasque is starting with policy that doesn't allow access to PF_LOCAL socket Christian Boltz the opensuse apparmor maintainer has been working on a policy update for opensuse see bug https://bugzilla.opensuse.org/show_bug.cgi?id=1061195