Questions tagged [apparmor]
AppArmor is a Mandatory Access Control (MAC) mechanism which can be used to confine processes on Linux systems. Use AppArmor tag in questions about AppArmor in general, AppArmor profiles or AppArmor related problems.
104
questions
0
votes
1
answer
12
views
How to allow an application in AppArmor?
I am using redshift, which has support for custom shell scripts in hooks when certain events happen. However, these hooks are not executed because of AppArmor:
[11541.395814] audit: type=1400 audit(...
- 395
0
votes
0
answers
52
views
AppArmor issues with Libvirt
I have a fresh Ubuntu Server 22.04.3 and Debian 12.1.0 installed and updated. Along with Cockpit and Cockpit virtual machines on both tests machines.
I am getting the following errors and warning when ...
- 1
0
votes
0
answers
36
views
capabilities in AppArmor profile vs extended attributes
I'm trying understand AppArmor capabilities at the moment. I found an example which had me make a copy of /bin/ping and generate AppArmor profile for it.
First I made a copy of /bin/ping and set it's ...
- 23
0
votes
0
answers
57
views
Audit Logging Discrepancy: Journald vs Rsyslog
After installing Debian 12 and rsyslog 8.2302 (for TLS remote syslog), I noticed that apparmor logs (or any audit logs) were not being sent remotely.
After reviewing the local system, journald DOES ...
user432564
0
votes
2
answers
69
views
No module named apparmor. Why?
Context : I installed (manually) the apparmor-utils and apparmor-profiles and apparmor-utils, since when trying
apt-get install apparmor-utils apparmor-profiles
can't find the packages.
aa-status
...
- 13
1
vote
0
answers
128
views
unprivileged_userns_apparmor_policy - what does it do?
I am developing some AppArmor profiles, and came across the kernel flag unprivileged_userns_apparmor_policy, but I cannot find any documentation about it. Does anyone know what it does? I wonder if ...
- 21
0
votes
0
answers
500
views
AppArmor Permission denied loading profile
I am trying to start a docker-compose file on my VPS running Ubuntu 20.04, but I have problems with AppArmor. I have the following errors:
systemctl status apparmor
● apparmor.service - Load AppArmor ...
0
votes
0
answers
19
views
prevent .exe apparmor_parser
i want to prevent of opening any wine app instead of ONE
i created file /etc/apparmor.d/usr.bin.wine
#include <tunables/global>
/usr/bin/wine {
#include <abstractions/base>
#include &...
- 80
0
votes
0
answers
580
views
LXC - using generated apparmor profiles, but apparmor status shows unconfined
I have been using unprivileged lxc containers (running as root but with user namespaces) using the following config to make use of apparmor:
lxc.apparmor.profile = generated
lxc.apparmor.allow_nesting ...
- 153
1
vote
0
answers
55
views
In profiles reported by aa-status, what do double (//) or triple (///) slashes do?
Apparmor's aa-status command reports the status of apparmor, but what do the double and triple slashes mean or do in the list of profiles reported?
For example, what is the double slash (//) in /usr/...
- 3,569
0
votes
1
answer
1k
views
failed starting vm with libvirt/qemu permission denied
this is my first time i'm asking a question so if i can do something better please tell me.
I'm not very good in Linux things, so far i could follow along guides and the problems i had where easy ...
0
votes
0
answers
520
views
Apparmor seems to break Samba after every reboot
I am running a Pi with a lot of services and recognised that my smbd.service (Version 4.13.13-Debian) was down with the errormessage:
Aug 23 18:33:43 RPi64 systemd[879]: smbd.service: Failed to ...
- 427
0
votes
1
answer
1k
views
Docker on Debian Failing to Bind to Port 80
I am running Docker on Debian 11. I deploy an Nginx container and it fails to bind to port 80 even though port 80 is not in use by any other process. I even tried running Docker as root.
Here's the ...
1
vote
1
answer
605
views
Bind9 dynamic zone updates are denied by apparmor in Debian11
I installed bind9 with chroot on Debian11, described by this tutorial: https://wiki.debian.org/Bind9#Debian_Jessie_and_later
It works fine, but as soon as I turn on dynamic zone updates, it will fail ...
- 113
1
vote
1
answer
559
views
Debian 11 - apparmor blocks application after removing it
I set up a fresh debian 11 installation and installed tor to fiddle around with hidden services. Since its only a test machine I decided to uninstall apparmor since I dont need any security on that ...
- 689
1
vote
0
answers
271
views
AppArmor not blocking curl/ping networking when IP address used
I'm playing with network permissions in AppArmor, and I'm trying to confine this script:
#!/bin/bash
curl $SOME_IP_ADDRESS
If I do curl $MY_FULL_DOMAIN, AppArmor does prevent it, as it seems unable ...
- 111
1
vote
0
answers
289
views
Load AppArmor profile inside Docker container
I would like to load another AppArmor profile inside a Docker container. The docker container itself uses the docker-default profile. The other profile is supposed to enforce the docker-default ...
- 71
1
vote
1
answer
403
views
Postfix thinks its on a read only filesystem?
I want to run some analytics on my mail.log (postfix 3.2.13 on Ubuntu 20.04 LTS) including updating a db of undeliverable emails, so I wrote script, excluded mail.log from the generic /var/log ...
- 5,110
1
vote
1
answer
451
views
How do I enable mounting filesystems in docker containers using apparmor
I have a ubuntu 20.04 server running docker. Recently the default apparmor profile seems to have started enforcing a restriction on mount points in docker containers. So the containers write directly ...
- 21
1
vote
0
answers
1k
views
samba network share fails to mount at boot time
On a box with Ubuntu 20.04, I struggle to mount a network share at boot time. Manually mounting the same share with sudo mount /media/SHARE works without any issues, and the same /etc/fstab entries ...
- 201
2
votes
1
answer
514
views
Make a binary to always run in a cgroup
I want to make sure a binary located at certain path is always run as part of a certain cgroup. Everything I found so far involves running the binary through some special command (e.g. with systemd-...
- 4,898
3
votes
3
answers
3k
views
lxc-start tells me apparmor_parser not available even though apparmor is installed and running
System:Debian Testing (Bullseye)
I am trying to get an LXC container up and running as per here, however, when I get to lxc-start -n my-container -d I get the following:
$ lxc-start -n test1 -d
lxc-...
1
vote
1
answer
254
views
How to find which processes are started/utilized when USB drive inserted
I want to restrict the processes involved in handling removable storage via AppArmor on a Debian system.
Which processes are used by Debian when a removable storage device (USB) is inserted? Which ...
- 756
2
votes
1
answer
419
views
Block/allow specific subprocesses being launched by a process
I block all Internet traffic for my kids' Linux accounts using iptables. Sometimes I want to allow them to use one program or another. In such cases I enable them to run that program as another(...
- 315
1
vote
1
answer
544
views
Allow file read only through application
I have a file with a secret and a generator application that reads it and generates something similar to a license.
There are users on that Linux machine who are allow to use that application.
Because ...
- 709
1
vote
1
answer
78
views
Linux Security Modules - SELinux/AppArmor
can someone explain to me why SELinux is officially broken under Ubuntu while AppArmor works fine? AppArmor is build on the "Linux Security Modules" framework and so is SELinux. As a result, ...
- 11
1
vote
1
answer
428
views
AppArmor equivalent to Firejail --net=none
firejail --net=none creates a sandbox looking like a computer without any network interfaces.
Is it possible to achieve the same result with AppArmor? It looks like, AppArmor's deny network just ...
- 794
1
vote
1
answer
138
views
Permissions problem when using ruby based snap 'mdl'
Because I don't understand Ruby, but want to use the ruby based program mdl (markdownlint), I have installed it using snap.
While I can run the program, if I try and set up a customizations in a ~/....
- 199
-1
votes
1
answer
71
views
Modify OS Security Module Configuration on SELinux vs AppArmor
Just some pretext, I am fairly new to this and I'm still learning how SELinux works.
I am trying to Modify OS security module configurations, but the instructions given to me were for Ubuntu and ...
3
votes
1
answer
401
views
Are LSM tools such as AppArmor and SELinux considered IDS/IPS? [closed]
I know this is kind of an odd question. An IDS/IPS basically autonomously recognizes and optionally prevents intrusions.
And while SELinux and AppArmor seem to be trying to do the same, they are never ...
- 49
2
votes
2
answers
421
views
kdenlive not able to open/save due to apparmor
I've been struggling with this for a few days.
Ubuntu 18.04.4 LTS
appamor 2.12-4ubuntu5.1
https://www.linuxquestions.org/questions/linux-desktop-74/kdenlive-snap-can%27t-save-or-load-because-of-...
2
votes
1
answer
2k
views
Why does `sudo cat /proc/self/attr/current` return "Invalid argument"?
I have read that the current AppArmor profile should be listed in the /proc/self/attr/current file, and that if it's empty the current profile is "unconfined".
But why does cat return "Invalid ...
- 4,073
3
votes
0
answers
343
views
AppArmor blocking firefox on Linux Mint 18.3
Using aa-genprof, I've attempted to generate a profile for Firefox, but AppArmor keeps blocking access to a connect capability when Firefox attempts to start, which throws an error :
Failed to ...
- 756
2
votes
1
answer
440
views
How is the best way to debug an AppArmor syntax error?
Recently I upgraded Debian, from Stretch (v9x) to Buster (v10.2).
Now in Thunderbird (package v68.3.0) when I click a link in an email, my browser (FireFox, v71.0, downloaded, i.e. not packaged) won't ...
- 3,569
3
votes
1
answer
2k
views
snapd fails on openSUSE Leap 15.1
I've installed and enabled snappy on my openSUSE Leap 15.1 system according to this documentation: https://snapcraft.io/docs/installing-snap-on-opensuse
When adding the repository, I used the one for ...
- 41
1
vote
0
answers
421
views
How to to access /sys/bus/usb/devices/ from qemu with AppArmor enabled? ("Cannot Open File" and "Cannot read serial from...")
I'm trying to access an USB device with AQEMU. For this I have added an USB port in the media options. But when starting the virtual machine I'm getting these errors:
AQEMU Warning [..] >>>
...
- 4,078
1
vote
0
answers
28
views
Crtl-C does not kill AppArmour and namespace sandboxed process
Given this AppArmour profile (intended to avoid manipulation of git repositories):
/RISC_OS {
signal,
ptrace,
unix,
network,
/ mrixwlk,
/** mrixwlk,
deny /**/.git** wl,
deny /**/refs/...
- 422
1
vote
0
answers
751
views
Sudenly, firefox is not opening at Parrot OS
I was using few times Parrot OS live booted from RAM or USB as well. Firefox is the web browser built in and my favourite by the way, so I used it.
Unfortunatelly is not working properly anymore. I ...
- 21
2
votes
1
answer
2k
views
Why is apparmor logging ALLOWED cases for LibreOffice?
I'm using Devuan Beowulf (~= Debian Buster). I'm seeing quite a few /var/log/messages messages involving apparmor, e.g.:
Oct 29 12:05:20 my_host_name kernel: [232254.998790] audit: type=1400 audit(...
- 8,852
1
vote
0
answers
458
views
Strange permission issue [media server]
I've been using my Linux machine (Ubuntu - 19.04 based) as a media server which has worked flawlessly so far - but suddenly I've been getting permission issues.
I'm running the media server (...
- 77
1
vote
0
answers
197
views
Docker containers and AppArmor profiles
The default AppArmor profile for Docker containers is an "unattached profile". It doesn't name the program being confined.
According to the docs, an unattached profile need to be attached to a program....
- 131
0
votes
0
answers
41
views
lxc-create undefined symbol: file_to_buf
I just migrate my stretch installation to a Buster install. I was previously running a LXC 3.x compiled by me and i have uninstall it to take the buster version.
i can create container, start and ...
- 131
2
votes
2
answers
2k
views
How to load apparmor profile for a service that runs in systemd's user space
I have been trying to load apparmor profile for a service that runs in systemd's user instance. I have two service files sample.service, for the process and another sample-profile-loader.service which ...
- 21
1
vote
1
answer
69
views
Is iteratively adding more AppArmor rules bad?
As far as I know, AppArmor cannot grant privileges to a program that otherwise doesn't have it (i.e. it can only further restrict). Given that, would it be okay to "allow all" for all programs at ...
- 310
4
votes
1
answer
4k
views
Firefox Apparmor Profile
I'm running Ubuntu Mate 19.04. I want to enable apparmor for Firefox. I found an existing profile in /etc/apparmor.d/usr.bin.firefox, which I enabled by deleting /etc/apparmor.d/disable/usr.bin....
- 61
1
vote
2
answers
989
views
I've accidentily deleted /etc/apparmor/, what should I do to restore it?
I accidentally deleted the /etc/apparmor/ folder on my debian 4.19.28-2 box by having the wrong folder selected in a gui file browser.
My questions are:
Should I be worried?
#apparmor_status
...
- 13
1
vote
1
answer
313
views
Where apparmor stores information about profiles in enforce/complain mode?
Where does AppArmor store information about which profiles should be loaded on system start in enforce or complain mode? What happens when I do aa-enforce /etc/apparmor.d/usr.bin.firefox?
My problem ...
- 406
0
votes
1
answer
3k
views
Re-installation of AppArmor misses some files
I have Ubuntu 16.04 and lately I reinstalled AppArmor:
sudo rm -rf /etc/apparmor*
sudo apt-get install apparmor --reinstall
sudo service apparmor restart
When I am trying to parse a profile with ...
- 363
2
votes
3
answers
3k
views
How to install AppArmor on alpine
I have a container with alpine image (docker:dind) and I want to install ApparMor inside it to see how it works before I put it on the host.
I found ApparMor package in alpine repostiroy but I don'...
- 363
0
votes
1
answer
605
views
How does AppArmor match profiles to processes?
What are all the ways AppArmor profiles can be matched to processes? One seems to be path based (e.g. the /sbin/dhclient profile is applied when /sbin/dhclient is executed) but is this due to /sbin/...
- 327