I want to deny the internet permission for some applications. Therefore, I tried first to deny the internet permission for ping, but it doesn't work.

Here is the profile of /etc/apparmor.d/bin.ping

/{usr/,}bin/ping {
  #include <abstractions/base>
    # block ipv4 acces
    deny network inet,
    # ipv6 
    deny network inet6,
    # raw socket
    deny network raw,

But the pinging still happens after restarting apparmor with

/etc/init.d/boot.apparmor restart
 ping google.de
PING google.de ( 56(84) bytes of data.
64 bytes from cache.google.com ( icmp_seq=1 ttl=57 time=11.8 ms
64 bytes from cache.google.com ( icmp_seq=2 ttl=57 time=15.3 ms

EDIT: I forgot to mentioned that I'm running OpenSuse 13.1

  • 1
    I would suggest you to close this question since this issue was resolved on an OpenSUSE AppArmor forum - forums.opensuse.org/showthread.php/… .Isn't that you asking? ;) – user34720 Dec 24 '15 at 11:31

You must either delete the #include <abstractions/base> line, or add a #include <tunables/global> line to the top of the file, before the profile is defined. This is because abstractions/base uses variables defined in tunables/global.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.