Skip to content

Commit 0b0ce3c

Browse files
bukkabukka
committed
Add back the AppArmorm stuff that is probabl necessary
1 parent 1c35acd commit 0b0ce3c

File tree

1 file changed

+199
-5
lines changed

1 file changed

+199
-5
lines changed

‎ext/standard/tests/dns/bind-start.sh

Lines changed: 199 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ NAMED_CONF="$SCRIPT_DIR/named.conf"
1010
PID_FILE="$ZONES_DIR/named.pid"
1111
LOG_FILE="$SCRIPT_DIR/named.log"
1212

13+
# Debug: show current user and permissions
14+
echo "Debug: Current user: $(whoami)"
15+
echo "Debug: Current UID: $(id -u)"
16+
echo "Debug: Script dir: $SCRIPT_DIR"
17+
echo "Debug: Zones dir: $ZONES_DIR"
18+
1319
# Default mode: background
1420
FOREGROUND=false
1521
if [[ "${1:-}" == "-f" ]]; then
@@ -81,6 +87,22 @@ sed -e "s|@ZONES_DIR@|$ZONES_DIR|g" \
8187
-e "s|@LISTEN_ADDRESS@|$LISTEN_ADDRESS|g" \
8288
"$NAMED_CONF_TEMPLATE" > "$NAMED_CONF"
8389

90+
# Ensure the generated config file is readable
91+
chmod 644 "$NAMED_CONF"
92+
93+
# Debug: Check if the file is actually readable
94+
echo "Debug: Testing config file readability:"
95+
if [[ -r "$NAMED_CONF" ]]; then
96+
echo "Debug: Config file is readable"
97+
else
98+
echo "Debug: Config file is NOT readable"
99+
ls -la "$NAMED_CONF"
100+
exit 1
101+
fi
102+
103+
# Ensure the generated config file is readable
104+
chmod 644 "$NAMED_CONF"
105+
84106
# Determine the best user to run BIND as (do this early)
85107
echo "Debug: Determining user for BIND..."
86108

@@ -100,6 +122,74 @@ else
100122
echo "Debug: Will run BIND as current user: $BIND_USER"
101123
fi
102124

125+
# Handle AppArmor if present
126+
if [[ -f /etc/apparmor.d/usr.sbin.named ]]; then
127+
echo "Debug: AppArmor profile detected, disabling it..."
128+
129+
# Install apparmor-utils if not present
130+
if ! command -v aa-disable >/dev/null 2>&1; then
131+
echo "Debug: Installing apparmor-utils..."
132+
apt-get update -qq
133+
apt-get install -y apparmor-utils
134+
fi
135+
136+
# Disable the profile
137+
aa-disable /usr/sbin/named 2>/dev/null || echo "Failed to disable AppArmor profile"
138+
139+
echo "Debug: AppArmor status:"
140+
aa-status 2>/dev/null | grep named || echo "No named profile found (good!)"
141+
else
142+
echo "Debug: No AppArmor profile found for named"
143+
fi
144+
145+
# Enhanced AppArmor handling
146+
if [[ -f /etc/apparmor.d/usr.sbin.named ]]; then
147+
echo "Debug: AppArmor profile detected, attempting comprehensive bypass..."
148+
149+
# Install apparmor-utils if not present
150+
if ! command -v aa-complain >/dev/null 2>&1; then
151+
echo "Debug: Installing apparmor-utils..."
152+
apt-get update -qq
153+
apt-get install -y apparmor-utils
154+
fi
155+
156+
# Check initial status
157+
echo "Debug: Initial AppArmor status for named:"
158+
aa-status 2>/dev/null | grep named || echo "No named profile in initial aa-status"
159+
160+
# Try complain mode first
161+
echo "Debug: Setting to complain mode..."
162+
aa-complain /usr/sbin/named 2>/dev/null || echo "Failed to set AppArmor to complain mode"
163+
164+
# Check what mode it's actually in
165+
echo "Debug: AppArmor profile mode after complain:"
166+
cat /sys/kernel/security/apparmor/profiles 2>/dev/null | grep named || echo "No named in profiles"
167+
168+
# Try to completely disable it
169+
echo "Debug: Attempting to disable AppArmor profile completely..."
170+
aa-disable /usr/sbin/named 2>/dev/null || echo "Failed to disable AppArmor profile"
171+
172+
# Alternative disable method
173+
echo "Debug: Trying alternative disable method..."
174+
ln -sf /etc/apparmor.d/usr.sbin.named /etc/apparmor.d/disable/ 2>/dev/null || echo "Symlink method failed"
175+
176+
# Unload from kernel
177+
if command -v apparmor_parser >/dev/null 2>&1; then
178+
echo "Debug: Unloading profile from kernel..."
179+
apparmor_parser -R /etc/apparmor.d/usr.sbin.named 2>/dev/null || echo "Failed to unload profile"
180+
fi
181+
182+
# Final status check
183+
echo "Debug: Final AppArmor status:"
184+
aa-status 2>/dev/null | grep named || echo "No named profile found (good!)"
185+
186+
elif [ -d /etc/apparmor.d/ ]; then
187+
echo "Debug: AppArmor directory exists but no named profile found:"
188+
ls /etc/apparmor.d/ | grep -i named || echo "No named-related profiles"
189+
else
190+
echo "Debug: No AppArmor directory found"
191+
fi
192+
103193
echo "Debug: Generated named.conf contents:"
104194
cat "$NAMED_CONF"
105195

@@ -142,11 +232,103 @@ else
142232
echo "Debug: Setting up permissions for user: $BIND_USER..."
143233

144234
# Ensure files are readable by the chosen user
145-
if [[ "$BIND_USER" != "$(whoami)" ]]; then
146-
# If we're running as a different user, ensure group/other permissions
147-
chmod 644 "$NAMED_CONF" "$ZONES_DIR"/*.zone
148-
chmod 755 "$SCRIPT_DIR" "$ZONES_DIR"
235+
chmod 644 "$NAMED_CONF" "$ZONES_DIR"/*.zone
236+
chmod 755 "$SCRIPT_DIR" "$ZONES_DIR"
237+
238+
echo "Debug: File permissions after setup:"
239+
ls -la "$NAMED_CONF" "$ZONES_DIR"/*.zone
240+
241+
echo "Debug: Directory permissions:"
242+
ls -ld "$SCRIPT_DIR" "$ZONES_DIR"
243+
244+
# Test if the chosen user can actually read the config file
245+
echo "Debug: Testing $BIND_USER access to config file:"
246+
if [[ "$BIND_USER" == "$(whoami)" ]]; then
247+
# Same user, test directly
248+
if test -r "$NAMED_CONF"; then
249+
echo "Debug: $BIND_USER CAN read config file"
250+
else
251+
echo "Debug: $BIND_USER CANNOT read config file"
252+
fi
253+
else
254+
# Different user, test with sudo
255+
if sudo -u "$BIND_USER" test -r "$NAMED_CONF" 2>/dev/null; then
256+
echo "Debug: $BIND_USER CAN read config file"
257+
else
258+
echo "Debug: $BIND_USER CANNOT read config file"
259+
echo "Debug: Checking what $BIND_USER sees:"
260+
sudo -u "$BIND_USER" ls -la "$NAMED_CONF" 2>&1 || echo "$BIND_USER cannot stat the file"
261+
fi
262+
fi
263+
264+
echo "Debug: File permissions after setup:"
265+
ls -la "$NAMED_CONF" "$ZONES_DIR"/*.zone
266+
267+
echo "Debug: Directory permissions:"
268+
ls -ld "$SCRIPT_DIR" "$ZONES_DIR"
269+
270+
# Test if the chosen user can actually read the config file
271+
echo "Debug: Testing $BIND_USER access to config file:"
272+
if [[ "$BIND_USER" == "$(whoami)" ]]; then
273+
# Same user, test directly
274+
if test -r "$NAMED_CONF"; then
275+
echo "Debug: $BIND_USER CAN read config file"
276+
else
277+
echo "Debug: $BIND_USER CANNOT read config file"
278+
fi
279+
else
280+
# Different user, test with sudo
281+
if sudo -u "$BIND_USER" test -r "$NAMED_CONF" 2>/dev/null; then
282+
echo "Debug: $BIND_USER CAN read config file"
283+
else
284+
echo "Debug: $BIND_USER CANNOT read config file"
285+
echo "Debug: Checking what $BIND_USER sees:"
286+
sudo -u "$BIND_USER" ls -la "$NAMED_CONF" 2>&1 || echo "$BIND_USER cannot stat the file"
287+
fi
288+
fi
289+
290+
# Check IPv4/IPv6 configuration with fallbacks
291+
echo "Debug: Network configuration check:"
292+
echo "Debug: localhost resolution:"
293+
getent hosts localhost 2>/dev/null || echo "localhost not found in hosts"
294+
295+
echo "Debug: 127.0.0.1 resolution:"
296+
getent hosts 127.0.0.1 2>/dev/null || echo "127.0.0.1 not found"
297+
298+
echo "Debug: Available IP addresses:"
299+
if command -v ip >/dev/null 2>&1; then
300+
ip addr show lo 2>/dev/null || echo "Failed to show loopback interface with ip"
301+
else
302+
ifconfig lo 2>/dev/null || echo "Failed to show loopback interface with ifconfig"
303+
fi
304+
305+
echo "Debug: Can we reach 127.0.0.1?"
306+
ping -c 1 127.0.0.1 >/dev/null 2>&1 && echo "127.0.0.1 is reachable" || echo "127.0.0.1 is NOT reachable"
307+
308+
echo "Debug: Can we reach ::1?"
309+
if command -v ping6 >/dev/null 2>&1; then
310+
ping6 -c 1 ::1 >/dev/null 2>&1 && echo "::1 is reachable" || echo "::1 is NOT reachable"
311+
else
312+
ping -6 -c 1 ::1 >/dev/null 2>&1 && echo "::1 is reachable (via ping -6)" || echo "::1 is NOT reachable"
313+
fi
314+
315+
# Check what's listening on port 53
316+
echo "Debug: Processes listening on port 53:"
317+
if command -v ss >/dev/null 2>&1; then
318+
ss -tulpn 2>/dev/null | grep ':53' || echo "Debug: No processes found on port 53 (ss)"
319+
else
320+
netstat -tulpn 2>/dev/null | grep ':53' || echo "Debug: No processes found on port 53 (netstat)"
149321
fi
322+
323+
echo "Debug: systemd-resolved status:"
324+
systemctl is-active systemd-resolved 2>/dev/null || echo "systemd-resolved not active"
325+
326+
# Monitor AppArmor denials in background
327+
echo "Debug: Starting AppArmor denial monitoring..."
328+
(timeout 15 tail -f /var/log/syslog 2>/dev/null | grep "apparmor.*DENIED" | head -10 &) || echo "Could not start syslog monitoring"
329+
330+
# Use the determined user
331+
echo "Debug: Using determined user: $BIND_USER"
150332

151333
# Run named and capture both stdout and stderr separately
152334
echo "Debug: Starting named as user: $BIND_USER..."
@@ -158,6 +340,14 @@ else
158340
echo "Debug: Log file contents:"
159341
cat "$LOG_FILE" 2>/dev/null || echo "No log file found"
160342

343+
# Show any AppArmor denials
344+
echo "Debug: Checking for AppArmor denials:"
345+
grep "apparmor.*DENIED.*named" /var/log/syslog 2>/dev/null | tail -10 || echo "No AppArmor denials found in syslog"
346+
347+
# Show general AppArmor messages
348+
echo "Debug: Recent AppArmor messages for named:"
349+
grep "apparmor.*named" /var/log/syslog 2>/dev/null | tail -10 || echo "No AppArmor messages found"
350+
161351
# Try to run named with more verbose output
162352
echo "Debug: Trying to run named in foreground for better error output:"
163353
timeout 5 named -c "$NAMED_CONF" -p 53 -u "$BIND_USER" -g -d 1 || echo "Foreground attempt timed out or failed"
@@ -197,5 +387,9 @@ else
197387
echo "No log file found at $LOG_FILE"
198388
fi
199389

390+
# Final AppArmor check
391+
echo "Debug: Final AppArmor denial check:"
392+
grep "apparmor.*DENIED.*named" /var/log/syslog 2>/dev/null | tail -5 || echo "No final AppArmor denials found"
393+
200394
exit 1
201-
fi
395+
fi

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy