Apparmor denial for the first time any source submits on Focal

[kushaldas]

Description

For a fresh install of SecureDrop on Focal, we can see grsec denial message when a source submits for the first time.

Steps to Reproduce

• Install SecureDrop on Focal
• tail -f /var/log/syslog
• Submit a message as a source

Expected Behavior

• No errors should show up in the log

Actual Behavior

Feb 17 07:58:49 app kernel: [14594.626357] audit: type=1400 audit(1613548729.520:20): apparmor="DENIED" operation="chmod" profile="/usr/sbin/apache2" name="/var/lib/securedrop/keys/private-keys-v1.d/" pid=2910 comm="gpg-agent" requested_mask="w" denied_mask="w" fsuid=33 ouid=33

Comments

Suggestions to fix, any other relevant information.

[conorsch]

Can confirm, on Qubes Focal staging VMs:

Feb 17 16:02:19 app-staging kernel: [ 9935.264729] audit: type=1400 audit(1613577739.119:20): apparmor="DENIED" operation="chmod" profile="/usr/sbin/apache2" name="/var/lib/securedrop/keys/private-keys-v1.d/" pid=9572 comm="gpg-agent" requested_mask="w" denied_mask="w" fsuid=33 ouid=33