Chris Baumbauer: Personal Musings

Blogs

Ordered list of blogs will go here with a widget

Small bug with the AppArmor config provided by the dhclient dpkg.

Posted: Dec 26, 2014 9:17 am


One of the things that has annoyed me with debian based distros lately is the spotty networking support with NetworkManager when switching between network profiles such as going from a wired location to a wireless location, or bouncing between encrypted and unencrypted access points. For those who aren't aware about NetworkManager, its a framework within Linux that provides a nice management interface around the Linux networking stack at the userland and kernel layer and provides a nice UI to make switching between network configurations sane.

What I observed recently while debugging another networking issue is that AppArmor, a Linux kernel based service that is designed to isolate and protect certain services from running amok, had a slight flaw in its configuration with how the NetworkManager interacted with the network service that manages DHCP connections. In particular, when the network stack would change, the NetworkManager would send a signal to the dhcpclient service managing the IP address on the card, but AppArmor would reject the signal, and thus force the dhcpclient to maintain the state of the previous network connection even though your computer has switched networks.

The fix that I have coded up is specific to Ubuntu 14.04 LTS, but appears to be present in Mint as well. The following modification to the entry for /usr/lib/NetworkManager/nm-dhcp-client.action in /etc/apparmor.d/sbin.dhclient seems to do the trick for me:

/usr/lib/NetworkManager/nm-dhcp-client.action {
    #include <abstractions/base>
    #include <abstractions/dbus>
    /usr/lib/NetworkManager/nm-dhcp-client.action mr,

    /var/lib/NetworkManager/*lease r,

    # This line should be added to send/receive all signals from NetworkManager 
    signal (receive, send) peer=/usr/lib/NetworkManager/nm-dhcp-client.action,
}

This is the first notification, and will more than likely file a bug with the maintainers at some point once I get some downtime.

Topics: dhclient, NetworkManager, AppArmor, Linux, Debian, dpkg, bug,


Return home