Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [apparmor]

AppArmor is a Mandatory Access Control (MAC) mechanism which can be used to confine processes on Linux systems. Use AppArmor tag in questions about AppArmor in general, AppArmor profiles or AppArmor related problems.

0
votes
0answers
17 views

Testing apparmor profiles

How can I get a list of all files a confined program is allowed to access or how can I test if I really can't access a specific file? Apparmor profiles include wildcards, things like @home or @proc ...
0
votes
1answer
420 views

How to allow specific Proxmox LXC containers to mount NFS shares on the network?

I've got a question very similar to Access denied when trying to mount NFS Share: On a Proxmox LXC container I'm trying to mount a NFS share located on a different physical machine on the network. In ...
2
votes
1answer
55 views

How to teach AppArmor about toplevel symlinks

I have my "root" partition split into two: a normal one that contains most files and a second one used for those areas that can "grow". Concretely, this means, I have symlinks like: /var/log -> ...
2
votes
0answers
71 views

apt-get says apparmor is installed, but the Docker kernel compatibility check says it's not

I'm in the process of installing Docker for the first time. In the official documentation, at this point, it says I should download and run a script (check-config.sh) to test whether my system has ...
0
votes
0answers
62 views

Is it possible to use a Whitelist approach for some files with App Armor?

I'm pretty new to using AppArmor and am unaware of all it's features. I was wondering if it is possible to apply Whitelisting behavior to some files with App Armor? I think whitelisting and ...
2
votes
1answer
477 views

How to configure AppArmor so that KVM can start guest that has a backing file chain

I'm playing around with using Qemu external snapshots for KVM (because they are so fast!) on Ubuntu 16.04 and have the following setup: All files for the VM are within a single directory (named after ...
0
votes
0answers
56 views

(AppArmor) Does allowing a confined program to execute another binary unconfined ruin security?

I have recently tried to get to know SELinux and AppArmor and then decided to use AppArmor for its simplicity. I started writing some profiles using aa-genprof and aa-logprof but big programs like ...
0
votes
1answer
374 views

docker socket: permission denied

I have home server with proxmox 5 installed and some services in docker containers. All was fine till yestarday. I rebooted the server and all services in all containers cannot bind socket because of ...
0
votes
1answer
759 views

KVM: Can not destroy VM (Permission denied) - AppArmor blocking Libvirt

Every time I run virsh destroy ${KVM} as root I get the following error (virsh shutdown ${KVM} is showing absolutely no reaction, nothing happens): error: Failed to destroy domain ${KVM} error: ...
2
votes
1answer
223 views

apparmor wildcard profile with globbing

I am running Ubuntu 16.04 with apparmor 2.10.95-0ubuntu2.7. I often need to comment on software of dubious quality. I want to employ apparmor to guard my system from harm. I created an apparmor ...
0
votes
1answer
303 views

How to deny application's access to network by AppArmor?

Environment: OS: Debian GNU/Linux 9.3 (stretch) Kernel parameter: security=apparmor Here is my test profile (created by aa-genprof): /etc/apparmor.d/usr.bin.telnet.netkit #include <tunables/...
0
votes
2answers
339 views

Is AppArmor actively used by Linux Mint 18?

Under my new Linux Mint 18.3 (64 bit) installation on my notebook, the command $ sudo apparmor_status returns the following: apparmor module is loaded. apparmor filesystem is not mounted. Is ...
2
votes
1answer
416 views

Cannot start syslog-ng when apparmor is running

I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin: service apparmor start * Starting AppArmor ... * Loading AppArmor profiles ......
2
votes
1answer
2k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
0
votes
0answers
44 views

libvirt destroy lxc permission denied

I'm testing LXC over Libvirt. The container started, but can't destroyed. [root@alfabook alfa]# virsh -c lxc:/// start test-ubuntu Domain test-ubuntu started [root@alfabook alfa]# virsh -c lxc:/// ...
0
votes
0answers
52 views

Ubuntu 17.04 Apparmor local web development

How do I get apparmor to change hats when apache2 owner www-data calls for http://example.com/subdirectory/some.svg? I have no problems with example.com. I believe it is due to: <Directory "/var/...
0
votes
0answers
143 views

Apparmor, open link in Browser, Thunderbird, Debian9

i have a problem with opening links in Vivaldi (1.13.1008.34 (Stable channel) (64-bit)) via Thunderbird (52.4.0 (64-bit)). $uname -a Linux sun 4.13.0-1-amd64 #1 SMP Debian 4.13.13-1 (2017-11-16) ...
1
vote
0answers
177 views

SLES 12 - vsftpd with AppArmor in enforce mode, “lftp” error for “ls” command: `ls' at 0 [500 OOPS: setrlimit]

In a virtual machine (VM) with SLES 12 (SUSE Linux Enterprise Server 12), after enforcing ("enforce mode") the AppArmor profile for "vsftpd" to confine it (via the "aa-enforce vsftpd" command), I'm ...
1
vote
1answer
262 views

Enabling AppArmor in Linux

I've compiled a kernel (linux-libre-xtreme) with this configuration, it has most LSMs enabled: YAMA, SMACK, AppArmor, TOMOYO and SELinux. However, when I start the apparmor service with OpenRC I get: ...
-2
votes
1answer
94 views

Is there a MAC for Linux that can stop a process on policy violations?

Is there a MAC that can SIGSTOP a process on policy violations so I can resume it with an updated policy to retry the syscall? This would be very handy in case of running interactive untrusted ...
1
vote
1answer
303 views

What does “ptrace (trace) peer=” mean in AppArmor profile?

I've been writing some AppArmor profiles and with each new profile I encounter more advanced rules that I haven't seen before. In this case I'm creating profile for PulseAudio. I also had a profile ...
0
votes
2answers
294 views

apparmor denies to mount /run for lxc-start

I am trying to set up a privileged container on Ubuntu where apparmor denies to mount /run /run/lock and /sys/fs/cgroup while running lxc-start. Violations [ 1621.278919] audit: type=1400 audit(...
1
vote
0answers
102 views

What is machine-id?

Just read the machine-id manpage, still not clear on how it's used by applications. QuiteRSS and Firefox among others seem to use it. Is it generally safe to blacklist (using apparmor) certain ...
1
vote
0answers
125 views

what is “kernel–user space API”?

I am studing about apparmor. And to be more specific, for the "hats" inside the policy. In here [Apparmor Profile Language] says for "hats" that, it calls change_hat API. Can you explain the ...
2
votes
1answer
811 views

AppArmor Firefox profile allows read and write to anywhere in HOME unless explicit deny used

I am using the default AppArmor Firefox profile, which is supposed to only allow downloads to be saved to ~/Downloads. However, I can still download to any location within my home directory. I checked ...
1
vote
0answers
128 views

how to solve apparmor “profile transition not found”

I get repeated apparmor messages like the following in my syslog (profile is in complain mode): Aug 29 02:07:13 titan kernel: [19497.559718] audit: type=1400 audit(1472454433.147:1131): apparmor="...
1
vote
0answers
287 views

After enabling apparmor Lightdm does not login automatically

I am trying to enable apparmor for Linux system (Debian 8). After Enabling i notice that my lightdm does not start. If i enable complain mode in apparmor for lightdm. it works . Posting logs for both ...
1
vote
0answers
286 views

Apparmor: does complain mode enable capability dac_override?

I'm trying to adjust an AppArmor profile after I found some guidance that it should be disabled for my use-case (not too happy running an IPSec daemon naked). So I've tried to put it in complain mode ...
2
votes
1answer
242 views

AppArmor is causing Firefox segfaults

I realise this is probably a bad question but I'm stuck. After a lot of googling I'm struggling to fix the problem. I've been trying to get AppArmor to work on Debian. I've been following the ...
2
votes
1answer
575 views

apparmor - cannot load library

I'm trying to get apparmor set up on my system and am having troubles getting past the permission denied error: ping: error while loading shared libraries: libcap.so.2: cannot stat shared object: ...
1
vote
1answer
279 views

apparmor: mysql permissions--with no recent changes

UPDATE: I now know my issue was database corruption, but discerning it was somewhat tricky--apparmor appeared to be the cause for longer than it should've. I didn't note when first posting that even ...
3
votes
1answer
149 views

Can AppArmor restrict access to a specific interface?

A deceptively simple question; Can Apparmor on Ubuntu (any release) restrict network access for a specific application to a specific network interface? If it can; an example/tutorial/etc link would ...
2
votes
1answer
2k views

what is apparmor “profile_replace” log message

Can anyone explain this line in the log.smbd? Searching the internet for apparmor details gets so many hits I cannot find the information. This occurs when smbd is started. kernel: [908896.070790] ...
1
vote
1answer
639 views

BIND9 denying queries from IPs outsite localnet (External IPs) - Ubuntu 14.04

BIND9 denying queries from IPs outsite localnet (External IPs) on Ubuntu. options { listen-on port 53 { any; }; directory "/var/bind"; allow-query ...
0
votes
0answers
104 views

Is apparmor preventing the running of my application?

I have an application that runs on Ubuntu and used to run on Tails. But now with Tails 1.5 it does not run anymore on Tails. My application package is basically a directory containing the application,...
3
votes
2answers
432 views

AppArmor: Are multiple profiles per application (Firefox, Thunderbird) possible? Syntax?

Is there a way to create an AppArmor profile for each Firefox profile, when running multiple profiles off a single installation of Firefox? Or more generally for any application supporting multiple ...
7
votes
1answer
15k views

Permission denied writing to mysql log

I am just testing out a new Ubuntu (Vivid 15.04) install on Vagrant, and getting problems with mysql and logging to a custom location. In /var/log/syslog I get /usr/bin/mysqld_safe: cannot create /...
1
vote
1answer
42 views

Using apprarmor/grsec to gain capabilities for file

I know that using apparmor, one can reduce process capabilities(7). But is it possible to gain them? For example: ping requires CAP_NET_RAW. It's binary has no suid set and doesn't have any file ...
1
vote
2answers
157 views

How to protect against data leak?

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them. However our boss is concerned that someone (upon ...
13
votes
4answers
2k views

Simplest possible secure sandboxing (limited resources needed)

I'm working on a project that implements distributed simulations: arbitrary code is executed on multiple nodes and the results are later collected and aggregated. Each node is an instance of an ...
5
votes
0answers
1k views

AppArmor Profile: Deny internet access

I want to deny the internet permission for some applications. Therefore, I tried first to deny the internet permission for ping, but it doesn't work. Here is the profile of /etc/apparmor.d/bin.ping /...
2
votes
0answers
37 views

AppArmor: make it ask me for decision to allow/disallow

I'm having fun writing AppArmor profile for firefox. I like to open downloaded files directly from firefox (by double-click on it), it is really convenient. But then firefox should have permissions ...
11
votes
2answers
5k views

AppArmor profiles in Docker/LXC

I have a Docker container (LXC) which runs MySQL. Since the idea behind Docker is generally "one running process per container," if I define AppArmor profiles targeting the MySQL binary, will they be ...
9
votes
1answer
14k views

Why am I getting apparmor error messages in the syslog about NTP and LDAP?

On my newly installed Ubuntu 12.04 machine, with ntp and slapd installed, the following messages appear in /var/log/syslog at regular intervals: Feb 23 18:54:07 my-host kernel: [ 24.610703] type=...
3
votes
2answers
548 views

Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?

In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?". User @IwillnotexistIdonotexist ...
7
votes
2answers
3k views

Restrict particular applications from accessing certain files

Normally the private files stored in the home directory of a user can be accessed by applications running with the effective UID of the user. How can I restrict a particular application from accessing ...
3
votes
1answer
336 views

AppArmor and bind-mounts

Can someone outline the semantics of AppArmor with respect to bind-mounted folders? As I understand after reading the documentation (1, 2, 3, 4) - yes, I am using Ubuntu 12.04 with the 3.8 kernel - ...
3
votes
1answer
719 views

Restrict applications to access certain hardware (webcam, microphone…)

If I tell applications like VLC or Audacity to record from my webcam or microphone, they just wake the hardware if sleeping and do their work without my interference. Although this is a good thing, I'...
7
votes
2answers
2k views

Does AppArmor decrease the system performance?

Does AppArmor decrease the system performance? I have a slow system (900 MHz CPU) which has AppArmor because it was installed by default I would like to know if it become faster if I remove it, ...
2
votes
0answers
110 views

LXC apparmor profile limits executing scripts in /run/*

LXC is blocking a trusted container from running scripts in /run/*, how do I configure LXC to allow scripts to run here?