rua

[beroal]

This project partially breaks rua, a program to install packages from the Arch User Repository (AUR). Rua complains that it's unable to execute pager “less” when I try to view upstream changes (“D”). The log:

apparmor="DENIED" operation="file_inherit" class="file" info="Failed name lookup - disconnected path" error=-13 profile="true" name="dev/tty3"  comm="true" requested_mask="wr" denied_mask="wr" fsuid=1002 ouid=1002 FSUID="subroot" OUID="subroot"
apparmor="DENIED" operation="open" class="file" info="Failed name lookup - disconnected path" error=-13 profile="true" name="apparmor/.null"  comm="true" requested_mask="wr" denied_mask="wr" fsuid=1002 ouid=0 FSUID="subroot" OUID="root"
apparmor="DENIED" operation="exec" class="file" info="no new privs" error=-1 profile="git" name="/usr/bin/less"  comm="git" requested_mask="x" denied_mask="x" fsuid=1002 ouid=0 target="child-pager" FSUID="subroot" OUID="root"

It's because rua uses BubbleWrap. One solution I tested is to run all programs that rua executes under BubbleWrap in a profile containing all permissions. Is there a better alternative?

[roddhjav]

I have similar profile for dev program that should not conflict with other profiles (eg: mkosi). The solution would be to write a profile for rua. It might not be that hard knowing that there is already the bwrap abstraction, and a profile for makepkg.

[beroal]

The solution would be to write a profile for rua.

I did that. Rua runs many programs under BubbleWrap. Since they are executed with NoNewPrivs, I can't use existing profiles for them. Writing new profiles would be time consuming. Is it okay to run them under a common profile that has all permissions? BubbleWrap is supposed to isolate them.

[roddhjav]

Yes, they are part of the bwrap sandbox. It is the sandbox that should ensure there is no escape to the system. Therefore, from a security point of view it is fine. It could be interesting to add a defence in depth with a strict profile for rua, however, as you said, it may require a bit of time.