debcrafters-packages team mailing list archive

[Sebastien Bacher <2127491@xxxxxxxxxxxxxxxxxx>]

** Tags added: dcr-incoming

-- 
You received this bug notification because you are a member of
Debcrafters packages, which is subscribed to tnftp in Ubuntu.
https://bugs.launchpad.net/bugs/2127491

Title:
  AppArmor policy prevents reading from $HOME/.netrc

Status in AppArmor Profiles:
  New
Status in apparmor package in Ubuntu:
  New
Status in tnftp package in Ubuntu:
  New
Status in apparmor source package in Plucky:
  New
Status in tnftp source package in Plucky:
  New
Status in apparmor source package in Questing:
  New
Status in tnftp source package in Questing:
  New
Status in apparmor source package in Resolute:
  New
Status in tnftp source package in Resolute:
  New

Bug description:
  Version of Ubuntu: 25.04
  Version of tnftp: 20230507-2build3

  What is expected to happen:
  FTP credentials are put in the file $HOME/.netrc with permissions 600, and are read by tnftp to log in to the remote server.

  What happens:
  On starting tnftp it attempts to open the file $HOME/.netrc which fails with the following error message:
  ftp: Can't read `.netrc': Permission denied

  Origin of the bug:
  I tracked it down to the default AppArmor policy in /etc/apparmor.d/abstractions/private-files and specifically the block:
    # don't allow reading/updating of run control files
    deny @{HOME}/.*rc mrk,

  Proposed bug fix:
  Add the following line to the tnftp AppArmor policy:
    priority=100 allow owner @{HOME}/.netrc r,

  The priority=100 is necessary because `deny` executes after `allow`.

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor-profiles/+bug/2127491/+subscriptions