Questions tagged [apparmor]

AppArmor is a Mandatory Access Control (MAC) mechanism which can be used to confine processes on Linux systems. Use AppArmor tag in questions about AppArmor in general, AppArmor profiles or AppArmor related problems.

Filter by
Sorted by
Tagged with
3
votes
1answer
33 views
+50

AppArmor blocking firefox on Linux Mint 18.3

Using aa-genprof, ive attempted to generate a profile for firefox, but apparmor keeps blocking access to a connect capability when firefox attempts to start, which throws an error : Failed to ...
0
votes
0answers
8 views

Editing AppArmor newly created profile

I've created an AppArmor profile for vim cat /etc/apparmor.d/usr.bin.vim.basic #include <tunables/global> /usr/bin/vim.basic { #include <abstractions/base> #include <abstractions/...
0
votes
0answers
11 views

Sandboxing in parrot os

I want to know how parrot os has implemented sandboxing of apps so efficiently..I would like to use similar setup in ubuntu for only firefox..Is there a way by which i can use the same profile of ...
1
vote
0answers
15 views

How is the best way to debug an AppArmor syntax error?

Recently I upgraded Debian, from Stretch (v9x) to Buster (v10.2). Now in Thunderbird (package v68.3.0) when I click a link in an email, my browser (FireFox, v71.0, downloaded, i.e. not packaged) ...
1
vote
1answer
52 views

snapd fails on openSUSE Leap 15.1

I've installed and enabled snappy on my openSUSE Leap 15.1 system according to this documentation: https://snapcraft.io/docs/installing-snap-on-opensuse When adding the repository, I used the one for ...
0
votes
0answers
92 views

evdev touching the wrong device

I am trying to configure evdev to pass a mouse through to a virt-manager VM. Why is ubuntu touching the /dev/input/event device instead of the defined one? ls on the device shows this: ls -l /dev/...
1
vote
0answers
40 views

How to to access /sys/bus/usb/devices/ from qemu with AppArmor enabled? (“Cannot Open File” and “Cannot read serial from…”)

I'm trying to access an USB device with AQEMU. For this I have added an USB port in the media options. But when starting the virtual machine I'm getting these errors: AQEMU Warning [..] >>> ...
1
vote
0answers
18 views

Crtl-C does not kill AppArmour and namespace sandboxed process

Given this AppArmour profile (intended to avoid manipulation of git repositories): /RISC_OS { signal, ptrace, unix, network, / mrixwlk, /** mrixwlk, deny /**/.git** wl, deny /**/refs/...
1
vote
0answers
73 views

Sudenly, firefox is not opening at Parrot OS

I was using few times Parrot OS live booted from RAM or USB as well. Firefox is the web browser built in and my favourite by the way, so I used it. Unfortunatelly is not working properly anymore. I ...
1
vote
1answer
73 views

Why is apparmor logging ALLOWED cases for LibreOffice?

I'm using Devuan Beowulf (~= Debian Buster). I'm seeing quite a few /var/log/messages messages involving apparmor, e.g.: Oct 29 12:05:20 my_host_name kernel: [232254.998790] audit: type=1400 audit(...
0
votes
0answers
21 views

Restrict directory access to single process using apparmour

I'm going to create program creating directory and granting privileges to this directory to program request of creating this directory. Each directory, created by my program, will be putted in one ...
1
vote
0answers
84 views

Strange permission issue [media server]

I've been using my Linux machine (Ubuntu - 19.04 based) as a media server which has worked flawlessly so far - but suddenly I've been getting permission issues. I'm running the media server (...
0
votes
0answers
452 views

Apparmor fails to start (ubuntu 18.04)

Always gives this error when I try to start it or at boot. No apparent reason... ~$ systemctl status apparmor.service ● apparmor.service - AppArmor initialization Loaded: loaded (/lib/systemd/...
1
vote
0answers
48 views

Docker containers and AppArmor profiles

The default AppArmor profile for Docker containers is an "unattached profile". It doesn't name the program being confined. According to the docs, an unattached profile need to be attached to a program....
0
votes
0answers
24 views

lxc-create undefined symbol: file_to_buf

I just migrate my stretch installation to a Buster install. I was previously running a LXC 3.x compiled by me and i have uninstall it to take the buster version. i can create container, start and ...
0
votes
2answers
142 views

How to load apparmor profile for a service that runs in systemd's user space

I have been trying to load apparmor profile for a service that runs in systemd's user instance. I have two service files sample.service, for the process and another sample-profile-loader.service which ...
1
vote
1answer
25 views

Is iteratively adding more AppArmor rules bad?

As far as I know, AppArmor cannot grant privileges to a program that otherwise doesn't have it (i.e. it can only further restrict). Given that, would it be okay to "allow all" for all programs at ...
0
votes
0answers
15 views

AppArmor custom network access for all apps [duplicate]

I would like to create an AppArmor profile that has the following: Inbound network access is only available to a specific app: SSH Outbound network access is only available to a specific app: squid ...
0
votes
0answers
43 views

AppArmor changes behavior of LibreOffice without anything in logs

I have created profile for /usr/bin/lowriter which tries to allow everything that might be needed. I have added things until there is nothing written to system log (I'm using dmesg -w to see it) when ...
0
votes
0answers
383 views

Firefox Apparmor Profile

I'm running Ubuntu Mate 19.04. I want to enable apparmor for Firefox. I found an existing profile in /etc/apparmor.d/usr.bin.firefox, which I enabled by deleting /etc/apparmor.d/disable/usr.bin....
1
vote
2answers
59 views

I've accidentily deleted /etc/apparmor/, what should I do to restore it?

I accidentally deleted the /etc/apparmor/ folder on my debian 4.19.28-2 box by having the wrong folder selected in a gui file browser. My questions are: Should I be worried? #apparmor_status ...
0
votes
0answers
15 views

AppArmor's genprof not scanning events

I am trying to follow the example of this article. So I have created this script root@pkara-pc01:~# ls -lh example.sh -rwxr-xr-x 1 root root 130 Apr 19 16:40 example.sh root@pkara-pc01:~# cat ...
0
votes
0answers
157 views

System wide default-deny (process whitelisting) via AppArmor

I wanted a quick check to see if my understanding of AppArmor is correct. AppArmor by default confines only those applications that have profiles defined. Any other application that tries to run ...
1
vote
1answer
75 views

Where apparmor stores information about profiles in enforce/complain mode?

Where does AppArmor store information about which profiles should be loaded on system start in enforce or complain mode? What happens when I do aa-enforce /etc/apparmor.d/usr.bin.firefox? My problem ...
0
votes
1answer
471 views

Re-installation of AppArmor misses some files

I have Ubuntu 16.04 and lately I reinstalled AppArmor: sudo rm -rf /etc/apparmor* sudo apt-get install apparmor --reinstall sudo service apparmor restart When I am trying to parse a profile with ...
1
vote
2answers
466 views

How to install AppArmor on alpine

I have a container with alpine image (docker:dind) and I want to install ApparMor inside it to see how it works before I put it on the host. I found ApparMor package in alpine repostiroy but I don'...
0
votes
1answer
88 views

How does AppArmor match profiles to processes?

What are all the ways AppArmor profiles can be matched to processes? One seems to be path based (e.g. the /sbin/dhclient profile is applied when /sbin/dhclient is executed) but is this due to /sbin/...
0
votes
1answer
187 views

AppArmor “Multiple definitions for hat sanitized_helper” Error Running Firefox Profile in Enforce Mode

I've made myself an AA profile and am trying to run in enforce mode: aa-enforce /usr/bin/firefox is giving me ERROR: Multiple definitions for hat sanitized_helper in profile (null) exist,bailing ...
1
vote
1answer
451 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
0
votes
1answer
6k views

How to allow specific Proxmox LXC containers to mount NFS shares on the network?

This question is very similar to How to fix ”mount.nfs: access denied …“ when trying to mount a NFS share exported by a Proxmox 5 machine?. On a Proxmox LXC container I'm trying to mount a NFS share ...
4
votes
2answers
362 views

How to teach AppArmor about toplevel symlinks

I have my "root" partition split into two: a normal one that contains most files and a second one used for those areas that can "grow". Concretely, this means, I have symlinks like: /var/log -> ...
1
vote
0answers
212 views

apt-get says apparmor is installed, but the Docker kernel compatibility check says it's not

I'm in the process of installing Docker for the first time. In the official documentation, at this point, it says I should download and run a script (check-config.sh) to test whether my system has ...
4
votes
2answers
3k views

How to configure AppArmor so that KVM can start guest that has a backing file chain

I'm playing around with using Qemu external snapshots for KVM (because they are so fast!) on Ubuntu 16.04 and have the following setup: All files for the VM are within a single directory (named after ...
0
votes
0answers
152 views

(AppArmor) Does allowing a confined program to execute another binary unconfined ruin security?

I have recently tried to get to know SELinux and AppArmor and then decided to use AppArmor for its simplicity. I started writing some profiles using aa-genprof and aa-logprof but big programs like ...
1
vote
1answer
923 views

docker socket: permission denied

I have home server with proxmox 5 installed and some services in docker containers. All was fine till yestarday. I rebooted the server and all services in all containers cannot bind socket because of ...
0
votes
1answer
1k views

KVM: Can not destroy VM (Permission denied) - AppArmor blocking Libvirt

Every time I run virsh destroy ${KVM} as root I get the following error (virsh shutdown ${KVM} is showing absolutely no reaction, nothing happens): error: Failed to destroy domain ${KVM} error: ...
2
votes
1answer
540 views

apparmor wildcard profile with globbing

I am running Ubuntu 16.04 with apparmor 2.10.95-0ubuntu2.7. I often need to comment on software of dubious quality. I want to employ apparmor to guard my system from harm. I created an apparmor ...
3
votes
1answer
2k views

How to deny application's access to network by AppArmor?

Environment: OS: Debian GNU/Linux 9.3 (stretch) Kernel parameter: security=apparmor Here is my test profile (created by aa-genprof): /etc/apparmor.d/usr.bin.telnet.netkit #include <tunables/...
1
vote
2answers
1k views

Is AppArmor actively used by Linux Mint 18?

Under my new Linux Mint 18.3 (64 bit) installation on my notebook, the command $ sudo apparmor_status returns the following: apparmor module is loaded. apparmor filesystem is not mounted. Is ...
2
votes
1answer
799 views

Cannot start syslog-ng when apparmor is running

I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin: service apparmor start * Starting AppArmor ... * Loading AppArmor profiles ......
8
votes
1answer
10k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
1
vote
0answers
313 views

SLES 12 - vsftpd with AppArmor in enforce mode, “lftp” error for “ls” command: `ls' at 0 [500 OOPS: setrlimit]

In a virtual machine (VM) with SLES 12 (SUSE Linux Enterprise Server 12), after enforcing ("enforce mode") the AppArmor profile for "vsftpd" to confine it (via the "aa-enforce vsftpd" command), I'm ...
1
vote
1answer
1k views

Enabling AppArmor in Linux

I've compiled a kernel (linux-libre-xtreme) with this configuration, it has most LSMs enabled: YAMA, SMACK, AppArmor, TOMOYO and SELinux. However, when I start the apparmor service with OpenRC I get: ...
-2
votes
1answer
97 views

Is there a MAC for Linux that can stop a process on policy violations?

Is there a MAC that can SIGSTOP a process on policy violations so I can resume it with an updated policy to retry the syscall? This would be very handy in case of running interactive untrusted ...
1
vote
1answer
767 views

What does “ptrace (trace) peer=” mean in AppArmor profile?

I've been writing some AppArmor profiles and with each new profile I encounter more advanced rules that I haven't seen before. In this case I'm creating profile for PulseAudio. I also had a profile ...
0
votes
2answers
545 views

apparmor denies to mount /run for lxc-start

I am trying to set up a privileged container on Ubuntu where apparmor denies to mount /run /run/lock and /sys/fs/cgroup while running lxc-start. Violations [ 1621.278919] audit: type=1400 audit(...
2
votes
0answers
133 views

What is machine-id?

Just read the machine-id manpage, still not clear on how it's used by applications. QuiteRSS and Firefox among others seem to use it. Is it generally safe to blacklist (using apparmor) certain ...
1
vote
0answers
217 views

what is “kernel–user space API”?

I am studing about apparmor. And to be more specific, for the "hats" inside the policy. In here [Apparmor Profile Language] says for "hats" that, it calls change_hat API. Can you explain the ...
2
votes
1answer
1k views

AppArmor Firefox profile allows read and write to anywhere in HOME unless explicit deny used

I am using the default AppArmor Firefox profile, which is supposed to only allow downloads to be saved to ~/Downloads. However, I can still download to any location within my home directory. I checked ...
3
votes
0answers
271 views

how to solve apparmor “profile transition not found”

I get repeated apparmor messages like the following in my syslog (profile is in complain mode): Aug 29 02:07:13 titan kernel: [19497.559718] audit: type=1400 audit(1472454433.147:1131): apparmor="...