mod_auth_external vs. apparmor

[sualko]

What version of ejabberd are you using?

ejabberd 16.01

What operating system (version) are you using?

Ubuntu 16.04

How did you install ejabberd (source, package, distribution)?

distribution

What did not work as expected? Are there error messages in the log? What
was the unexpected behavior? What was the expected result?

I tried to use an external python script to authenticate my users. After 2 days of searching, testing, stracing and so on, I found out that ejabberd comes with an apparmor profile 👿. At least this should be documented somewhere...

[zinid]

We do not maintain Ubuntu's packages.

[debalance]

Just for the record, this IS documented in /usr/share/doc/ejabberd/NEWS.Debian.gz,
you can install and configure apt-listchanges accordingly if you want to be shown these automatically during upgrades.

Also, AppArmor pretty much jumps you in the face in dmesg, which is one of the first things I check when things are not working as they should.

[sualko]

People (non-high end linux freaks) get frustrated by such things. Please reconsider this.

[zinid]

By what things? We do not have enough human resources to maintain packages for linux distros.

[lemenkov]

Looks like a downstream (not upstream) bug. This should be addressed by Debian maintainer, not here.

[zinid]

@lemenkov the Debian maintainer replied in this thread already :)

[sualko]

I think a small notice in the documentation would not hurt and would help so many people, but this is your decision.

[debalance]

@sualko, what documentation are you talking about?

[sualko]

https://docs.ejabberd.im/admin/configuration/#external-script

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

[zeigerpuppy]

This looks like an issue for me too. I'm not sure how to solve it (maybe by adding permission for running xauth.py in the ejabberd apparmour profile?)
I agree it would be good to document it somewhere with a suggestion of how to fix.
On that note if anyone has fixed this, could you please also post the fix here (I will if I manage to sort it out!)

[zeigerpuppy]

a simple way to test this is to remove the apparmor profile.
In my case: apparmor_parser -R /etc/apparmor.d/usr.sbin.ejabberdctl

It looks like apparmor is not the problem for me but I thought I'd add this here to help others debug anyway...