Failed name lookup - disconnected path error for long path names

Bug Description

== Precise SRU Justification ==

This bug causes access failures when apparmor is mediating files with long pathnames. This problem is easy to trip when a confined application tries to access data encrypted with ecryptfs, but can occur on any filesystem.

== Fix ==

Commit cffee16e8b997ab947de661e8820e486b0830c94 from security/next queue for 3.5 kernel fixes the issue

== Impact ==

Users/application/daemons can not access the affected files while confined, which can result in application failures, users unable to access data, and confusion as the error message reported by the shell is "Cannot open: Stale NFS file handle", whether or not NFS is in use.

== Test Case ==

Run tests in from the updated apparmor regression test suite in qrt.

or manually
create a confined shell
mount encryptfs, with file name obfuscation enabled
from an unconfined shell created a 4 deep directory structure within the ecryptfs mount
create a file in the deepest directory
attempt to access the file from the confined shell

AppArmor denies access to files with a path length > 255 characters with the error message "Failed name lookup - disconnected path".

Example log entry:
Mar 15 11:43:45 felix-desktop kernel: [ 6051.608954] type=1400 audit(1331808225.843:4896): apparmor="DENIED" operation="mknod" info="Failed name lookup - disconnected path" error=-116 parent=24422 profile="/usr/bin/lintian" name="temp-lintian-lab-xpvh_Pjhrm/pool/v/virtualbox/virtualbox_4.1.10-dfsg-1_source/virtualbox_4.1.10-dfsg.orig.tar.bz2.tmp-extract.5399h/virtualbox-4.1.10-dfsg/src/VBox/Devices/EFI/Firmware2/VBoxPkg/Library/VBoxOemHookStatusCodeLib/VBoxOemHookStatusCodeLib.c" pid=24433 comm="tar" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000

It seems to omit the mount point in the path name (/tmp/).

The path_max parameter is much larger:

% sudo cat /sys/module/apparmor/parameters/path_max
8192

% uname -a
Linux felix-desktop 3.2.0-18-generic #29-Ubuntu SMP Fri Mar 9 21:36:08 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

% dpkg -l | grep apparmor
ii apparmor 2.7.100-0ubuntu1 User-space parser utility for AppArmor
ii apparmor-notify 2.7.100-0ubuntu1 AppArmor notification system
ii apparmor-utils 2.7.100-0ubuntu1 Utilities for controlling AppArmor
ii dh-apparmor 2.7.100-0ubuntu1 AppArmor debhelper routines
ii libapparmor-perl 2.7.100-0ubuntu1 AppArmor library Perl bindings
ii libapparmor1 2.7.100-0ubuntu1 changehat AppArmor library

I can't reproduce this with anything other than tar.

tar prints these error messages: (note that I don't have any NFS file systems)
tar: virtualbox-4.1.10-dfsg/src/VBox/Devices/EFI/Firmware2/VBoxPkg/Library/VBoxOemHookStatusCodeLib/VBoxOemHookStatusCodeLib.c: Cannot open: Stale NFS file handle

However it works fine when I extract the archive with tar being unconfined.

Also it only seems to fail when extracting to non-root filesystems.

Since kernel 3.2.0-21-generic the error message is:
info="Failed name lookup" error=-13

I have placed a test kernel with a fix at
http://people.canonical.com/~jj/linux-image-3.2.0-23-generic_3.2.0-23.36~aa_amd64.deb

The test kernel works fine, thanks!

This bug was fixed in the package linux - 3.4.0-3.8

---------------
linux (3.4.0-3.8) quantal; urgency=low

[ Andy Whitcroft ]

* [Config] include include/generated/compile.h
- LP: #942569
* [Config] fix up postinst to ensure we know which error is which
- LP: #1002388

[ Herton Ronaldo Krzesinski ]

* SAUCE: async_populate_rootfs: fix build warnings
- LP: #1003417

[ John Johansen ]

* Revert "SAUCE: AppArmor: Add the ability to mediate mount"
* SAUCE: apparmor: Add the ability to mediate mount
* SAUCE: AppArmor: basic networking rules
* SAUCE: apparmor: fix profile lookup for unconfined
- LP: #978038, #987371
* SAUCE: apparmor: fix long path failure due to disconnected path
- LP: #955892

[ Mario Limonciello ]

* SAUCE: dell-laptop: rfkill blacklist Dell XPS 13z, 15
- LP: #901410

[ Stefan Bader ]

* (config) Built-in xen-acpi-processor

[ Tim Gardner ]

* [Config] CONFIG_NET_DSA=m
- LP: #1004148
* [Config] Ensure CONFIG_XEN_ACPI_PROCESSOR=y for amd64
-- Leann Ogasawara <email address hidden> 2012年5月25日 11:38:33 -0700

This bug is awaiting verification that the kernel for precise in -proposed solves the problem (3.2.0-25.40). Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-precise' to 'verification-done-precise'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

I can confirm that the name lookup errors are gone and AppArmor correctly grants access to files with long path names.

This bug was fixed in the package linux - 3.2.0-25.40

---------------
linux (3.2.0-25.40) precise-proposed; urgency=low

[Luis Henriques]

* Release Tracking Bug
- LP: #1003534

[ Andy Whitcroft ]

* [Config] control.stub is an intermediate product not a dependancy
- LP: #992414
* [Config] include include/generated/compile.h
- LP: #942569

[ Dave Martin ]

* SAUCE: rtc: pl031: Enable module alias autogeneration for AMBA drivers
- LP: #1000831

[ Herton Ronaldo Krzesinski ]

* Revert "SAUCE: ite-cir: postpone ISR registration"
- LP: #1002484
* SAUCE: async_populate_rootfs: fix build warnings
- LP: #1003417

[ Ike Panhc ]

* [Config] add highbank flavour
- LP: #1000831

[ John Johansen ]

* SAUCE: apparmor: fix long path failure due to disconnected path
- LP: #955892
* SAUCE: apparmor: fix profile lookup for unconfined
- LP: #978038, #987371

[ Mark Langsdorf ]

* SAUCE: arm highbank: add support for pl320-ipc driver
- LP: #1000831

[ Rob Herring ]

* SAUCE: input: add a key driver for highbank
- LP: #1000831
* SAUCE: ARM: highbank: Add smc calls to enable/disable the L2
- LP: #1000831
* SAUCE: force DMA buffers to non-bufferable on highbank
- LP: #1000831
* SAUCE: net: calxedaxgmac: fix net timeout recovery
- LP: #1000831

[ Tim Gardner ]

* [Config] perarch and indep tools builds need separate build directories
* [Config] CONFIG_XEN_ACPI_PROCESSOR=y
- LP: #898112

[ Upstream Kernel Changes ]

* Revert "autofs: work around unhappy compat problem on x86-64"
- LP: #1002482
* Input: wacom - cleanup feature report for bamboos
- LP: #568064
* Input: wacom - remove unused bamboo HID parsing
- LP: #568064
* Input: wacom - add some comments to wacom_parse_hid
- LP: #568064
* Input: wacom - relax Bamboo stylus ID check
- LP: #568064
* Input: wacom - read 3rd gen Bamboo Touch HID data
- LP: #568064
* Input: wacom - 3rd gen Bamboo P&Touch packet support
- LP: #568064
* Input: wacom - ignore unwanted bamboo packets
- LP: #568064
* HID: wacom: Move parsing to a separate function
- LP: #568064
* HID: wacom: Initial driver for Wacom Intuos4 Wireless (Bluetooth)
- LP: #568064
* Input: wacom - add support for Cintiq 24HD
- LP: #568064
* Input: wacom - add LED support for Cintiq 24HD
- LP: #568064
* Input: wacom - add missing LEDS_CLASS to Kconfig
- LP: #568064
* Input: wacom - fix 3rd-gen Bamboo MT when 4+ fingers are in use
- LP: #568064
* power_supply: allow a power supply to explicitly point to powered
device
- LP: #568064
* power_supply: add "powers" links to self-powered HID devices
- LP: #568064
* HID: wiimote: fix invalid power_supply_powers call
- LP: #568064
* HID: wacom: Fix invalid power_supply_powers calls
- LP: #568064
* ARM: 7178/1: fault.c: Port OOM changes into do_page_fault
- LP: #951043
* ARM: 7368/1: fault.c: correct how the tsk->[maj|min]_flt gets
incremented
- LP: #951043
* hugepages: fix use after free bug in "quota" handling
- LP: #990368
- CVE-2012-2133
* provide disable_cpufreq() functio...

Status changed to 'Confirmed' because the bug affects multiple users.

John, does this require a userspace change also, or can we mark the "apparmor" tasks as invalid?

Marking the apparmor portion as invalid as the bug is entirely in the apparmor kernel module, which is tracked under linux

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Well, you can use Long Path Tool for such issues, it works good.