The tag has no wiki summary.

learn more… | top users | synonyms

4
votes
0answers
28 views

Simplest possible secure sandboxing (limited resources needed)

I'm working on a project that implements distributed simulations: arbitrary code is executed on multiple nodes and the results are later collected and aggregated. Each node is an instance of an ...
0
votes
0answers
214 views

unable to run bash as new user on an ubuntu docker container

i have a docker container and i am trying to enable sshd and log in with a new user rag. it appears that as user 'rag' i am not able to execute /bin/bash. i am not sure why. i cannot figure out ...
2
votes
0answers
64 views

AppArmor Profile: Deny internet access

I want to deny the internet permission for some applications. Therefore, I tried first to deny the internet permission for ping, but it doesn't work. Here is the profile of /etc/apparmor.d/bin.ping ...
1
vote
0answers
17 views

AppArmor: make it ask me for decision to allow/disallow

I'm having fun writing AppArmor profile for firefox. I like to open downloaded files directly from firefox (by double-click on it), it is really convenient. But then firefox should have permissions ...
5
votes
2answers
1k views

AppArmor profiles in Docker/LXC

I have a Docker container (LXC) which runs MySQL. Since the idea behind Docker is generally "one running process per container," if I define AppArmor profiles targeting the MySQL binary, will they be ...
4
votes
1answer
1k views

Why am I getting apparmor error messages in the syslog about NTP and LDAP?

On my newly installed Ubuntu 12.04 machine, with ntp and slapd installed, the following messages appear in /var/log/syslog at regular intervals: Feb 23 18:54:07 my-host kernel: [ 24.610703] ...
3
votes
0answers
98 views

Apparmor cp -al [closed]

I am attempting to setup a Apparmor profile for rsnapshot. When I run in complain mode I get no errors. When I enable to the profile, I still get no apparmor errors, but rsnapshot itself is broke. ...
3
votes
2answers
170 views

Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?

In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?". User @IwillnotexistIdonotexist ...
6
votes
2answers
439 views

Restrict particular applications from accessing certain files

Normally the private files stored in the home directory of a user can be accessed by applications running with the effective UID of the user. How can I restrict a particular application from accessing ...
2
votes
1answer
57 views

AppArmor and bind-mounts

Can someone outline the semantics of AppArmor with respect to bind-mounted folders? As I understand after reading the documentation (1, 2, 3, 4) - yes, I am using Ubuntu 12.04 with the 3.8 kernel - ...
2
votes
1answer
199 views

Restrict applications to access certain hardware (webcam, microphone…)

If I tell applications like VLC or Audacity to record from my webcam or microphone, they just wake the hardware if sleeping and do their work without my interference. Although this is a good thing, ...
5
votes
2answers
416 views

Does AppArmor decrease the system performance?

Does AppArmor decrease the system performance? I have a slow system (900 MHz CPU) which has AppArmor because it was installed by default I would like to know if it become faster if I remove it, ...
2
votes
0answers
73 views

LXC apparmor profile limits executing scripts in /run/*

LXC is blocking a trusted container from running scripts in /run/*, how do I configure LXC to allow scripts to run here?
1
vote
1answer
136 views

apparmor and Firefox

I am currently re-setting up the apparmor profile for Firefox 19.0.2 on Ubuntu 12.04 and I am slightly confused. I must of had Firefox 7.01 last time I used this and if I do apparmor_status then ...
7
votes
9answers
927 views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
2
votes
0answers
73 views

Unable to use aa-genprof without compatibility patch

I run 3.6.10 kernel, It seems like apparmor compatibility patch were dropped in latest kernel, so aa-genprof won't work anymore, any suggestions? Looks like aa-status or other aa- commands were ...
0
votes
1answer
86 views

Fix this apparmor rule?

I don't really know how to add this rule to the profile, since the name was "wired", it's not some absolute path on my system, kernel: type=1400 audit(1353749970.556:556): apparmor="ALLOWED" ...
6
votes
1answer
2k views

Evince fails to start because it cannot read .Xauthority

I'm logged in remotely over SSH with X forwarding to a machine running Ubuntu 10.04 (lucid). Most X11 applications (e.g. xterm, gnome-terminal) work fine. But Evince does not start. It seems unable to ...
11
votes
3answers
351 views

Prompt user on Linux security denial

Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card ...
4
votes
1answer
1k views

How can I run tcpdump from a Python script without AppArmor complaining?

For inconvenient reasons going beyond the scope of this question, I have to run tcpdump from within a Python script. I currently just call subprocess.Popen(['tcpdump', ...) and everything works just ...
1
vote
2answers
2k views

VirtualBox guest hangs when: Starting Apparmor profiles

I have a Fedora 14. I installed the Ubuntu 11.04 i386 mini.iso in Virtualbox. After install when I reboot it it just hangs with this message: /dev/mapper/vg-root: tiszta, 52354/5103616 fájl, ...