For inconvenient reasons going beyond the scope of this question, I have to run tcpdump from within a Python script. I currently just call subprocess.Popen(['tcpdump', ...) and everything works just fine. However, when I use tools like pyInstaller to package the script into an executable, and run it (as root), I get the following error:

tcpdump: error while loading shared libraries: libcrypto.so.0.9.8: "failed to map segment from shared object: Permission denied" 

As I found out, this is AppArmor whining. Now, I can easily replace my call to tcpdump with the following:

subprocess.call(['aa-complain', '/usr/sbin/tcpdump'])
pcap = subprocess.Popen(['tcpdump', ...)
subprocess.call(['aa-enforce', '/usr/sbin/tcpdump'])

Now it prints two info lines (about changing into complain/enforce mode), and runs tcpdump without further complaints.

The people who will run this script will run it as root when they want to do packet captures, so I don't see how this is a security problem. At the same time, the above seems hackish to me. So to the AppArmor experts among you: is this the canonical way to deal with it?

PS. I'm also thankful for links to a good, quick introduction to AppArmor in general, since this is the first time I'm encountering this.


Well this should be a start, if you haven't already browsed it: https://help.ubuntu.com/community/AppArmor

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.