For inconvenient reasons going beyond the scope of this question, I have to run
tcpdump from within a Python script. I currently just call
subprocess.Popen(['tcpdump', ...) and everything works just fine. However, when I use tools like pyInstaller to package the script into an executable, and run it (as root), I get the following error:
tcpdump: error while loading shared libraries: libcrypto.so.0.9.8: "failed to map segment from shared object: Permission denied"
As I found out, this is AppArmor whining. Now, I can easily replace my call to tcpdump with the following:
subprocess.call(['aa-complain', '/usr/sbin/tcpdump']) pcap = subprocess.Popen(['tcpdump', ...) subprocess.call(['aa-enforce', '/usr/sbin/tcpdump'])
Now it prints two info lines (about changing into complain/enforce mode), and runs tcpdump without further complaints.
The people who will run this script will run it as root when they want to do packet captures, so I don't see how this is a security problem. At the same time, the above seems hackish to me. So to the AppArmor experts among you: is this the canonical way to deal with it?
PS. I'm also thankful for links to a good, quick introduction to AppArmor in general, since this is the first time I'm encountering this.