Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [apparmor]

AppArmor is a Mandatory Access Control (MAC) mechanism which can be used to confine processes on Linux systems. Use AppArmor tag in questions about AppArmor in general, AppArmor profiles or AppArmor related problems.

0
votes
0answers
23 views

System wide default-deny (process whitelisting) via AppArmor

I wanted a quick check to see if my understanding of AppArmor is correct. AppArmor by default confines only those applications that have profiles defined. Any other application that tries to run ...
1
vote
1answer
32 views

Where apparmor stores information about profiles in enforce/complain mode?

Where does AppArmor store information about which profiles should be loaded on system start in enforce or complain mode? What happens when I do aa-enforce /etc/apparmor.d/usr.bin.firefox? My problem ...
0
votes
1answer
18 views

Re-installation of AppArmor misses some files

I have Ubuntu 16.04 and lately I reinstalled AppArmor: sudo rm -rf /etc/apparmor* sudo apt-get install apparmor --reinstall sudo service apparmor restart When I am trying to parse a profile with ...
0
votes
1answer
116 views

How to install AppArmor on alpine

I have a container with alpine image (docker:dind) and I want to install ApparMor inside it to see how it works before I put it on the host. I found ApparMor package in alpine repostiroy but I don'...
0
votes
1answer
38 views

How does AppArmor match profiles to processes?

What are all the ways AppArmor profiles can be matched to processes? One seems to be path based (e.g. the /sbin/dhclient profile is applied when /sbin/dhclient is executed) but is this due to /sbin/...
0
votes
0answers
13 views

AppArmor prevent program from reading dirs/files I haven't explicitly allowed?

I don't want programs to be able to read my whole home directory. For example, I'd like to have firefox's read ability restricted to: owner @{HOME}/Downloads/ r, owner @{HOME}/Downloads/** rwk, owner ...
0
votes
1answer
67 views

AppArmor “Multiple definitions for hat sanitized_helper” Error Running Firefox Profile in Enforce Mode

I've made myself an AA profile and am trying to run in enforce mode: aa-enforce /usr/bin/firefox is giving me ERROR: Multiple definitions for hat sanitized_helper in profile (null) exist,bailing ...
1
vote
1answer
229 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
0
votes
0answers
106 views

apparmor=“DENIED” operation=“change_onexec” info=“label not found” error=-2 profile=“unconfined” name=“snap.slack.slack” pid=11613 comm=“snap-confine”

I'm trying to Install Slack for Linux and run it on my Kali-Linux, however while trying run it, I get following in my /var/log/syslog while trying to run Slack app. Sep 19 16:37:58 suey kernel: [ ...
0
votes
1answer
3k views

How to allow specific Proxmox LXC containers to mount NFS shares on the network?

This question is very similar to How to fix ”mount.nfs: access denied …“ when trying to mount a NFS share exported by a Proxmox 5 machine?. On a Proxmox LXC container I'm trying to mount a NFS share ...
3
votes
1answer
191 views

How to teach AppArmor about toplevel symlinks

I have my "root" partition split into two: a normal one that contains most files and a second one used for those areas that can "grow". Concretely, this means, I have symlinks like: /var/log -> ...
2
votes
0answers
105 views

apt-get says apparmor is installed, but the Docker kernel compatibility check says it's not

I'm in the process of installing Docker for the first time. In the official documentation, at this point, it says I should download and run a script (check-config.sh) to test whether my system has ...
0
votes
0answers
111 views

Is it possible to use a Whitelist approach for some files with App Armor?

I'm pretty new to using AppArmor and am unaware of all it's features. I was wondering if it is possible to apply Whitelisting behavior to some files with App Armor? I think whitelisting and ...
3
votes
1answer
1k views

How to configure AppArmor so that KVM can start guest that has a backing file chain

I'm playing around with using Qemu external snapshots for KVM (because they are so fast!) on Ubuntu 16.04 and have the following setup: All files for the VM are within a single directory (named after ...
0
votes
0answers
104 views

(AppArmor) Does allowing a confined program to execute another binary unconfined ruin security?

I have recently tried to get to know SELinux and AppArmor and then decided to use AppArmor for its simplicity. I started writing some profiles using aa-genprof and aa-logprof but big programs like ...
0
votes
1answer
556 views

docker socket: permission denied

I have home server with proxmox 5 installed and some services in docker containers. All was fine till yestarday. I rebooted the server and all services in all containers cannot bind socket because of ...
0
votes
1answer
928 views

KVM: Can not destroy VM (Permission denied) - AppArmor blocking Libvirt

Every time I run virsh destroy ${KVM} as root I get the following error (virsh shutdown ${KVM} is showing absolutely no reaction, nothing happens): error: Failed to destroy domain ${KVM} error: ...
2
votes
1answer
373 views

apparmor wildcard profile with globbing

I am running Ubuntu 16.04 with apparmor 2.10.95-0ubuntu2.7. I often need to comment on software of dubious quality. I want to employ apparmor to guard my system from harm. I created an apparmor ...
2
votes
1answer
773 views

How to deny application's access to network by AppArmor?

Environment: OS: Debian GNU/Linux 9.3 (stretch) Kernel parameter: security=apparmor Here is my test profile (created by aa-genprof): /etc/apparmor.d/usr.bin.telnet.netkit #include <tunables/...
0
votes
2answers
796 views

Is AppArmor actively used by Linux Mint 18?

Under my new Linux Mint 18.3 (64 bit) installation on my notebook, the command $ sudo apparmor_status returns the following: apparmor module is loaded. apparmor filesystem is not mounted. Is ...
2
votes
1answer
576 views

Cannot start syslog-ng when apparmor is running

I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin: service apparmor start * Starting AppArmor ... * Loading AppArmor profiles ......
4
votes
1answer
5k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
1
vote
0answers
240 views

SLES 12 - vsftpd with AppArmor in enforce mode, “lftp” error for “ls” command: `ls' at 0 [500 OOPS: setrlimit]

In a virtual machine (VM) with SLES 12 (SUSE Linux Enterprise Server 12), after enforcing ("enforce mode") the AppArmor profile for "vsftpd" to confine it (via the "aa-enforce vsftpd" command), I'm ...
1
vote
1answer
539 views

Enabling AppArmor in Linux

I've compiled a kernel (linux-libre-xtreme) with this configuration, it has most LSMs enabled: YAMA, SMACK, AppArmor, TOMOYO and SELinux. However, when I start the apparmor service with OpenRC I get: ...
-2
votes
1answer
95 views

Is there a MAC for Linux that can stop a process on policy violations?

Is there a MAC that can SIGSTOP a process on policy violations so I can resume it with an updated policy to retry the syscall? This would be very handy in case of running interactive untrusted ...
1
vote
1answer
488 views

What does “ptrace (trace) peer=” mean in AppArmor profile?

I've been writing some AppArmor profiles and with each new profile I encounter more advanced rules that I haven't seen before. In this case I'm creating profile for PulseAudio. I also had a profile ...
0
votes
2answers
451 views

apparmor denies to mount /run for lxc-start

I am trying to set up a privileged container on Ubuntu where apparmor denies to mount /run /run/lock and /sys/fs/cgroup while running lxc-start. Violations [ 1621.278919] audit: type=1400 audit(...
2
votes
0answers
121 views

What is machine-id?

Just read the machine-id manpage, still not clear on how it's used by applications. QuiteRSS and Firefox among others seem to use it. Is it generally safe to blacklist (using apparmor) certain ...
1
vote
0answers
181 views

what is “kernel–user space API”?

I am studing about apparmor. And to be more specific, for the "hats" inside the policy. In here [Apparmor Profile Language] says for "hats" that, it calls change_hat API. Can you explain the ...
2
votes
1answer
1k views

AppArmor Firefox profile allows read and write to anywhere in HOME unless explicit deny used

I am using the default AppArmor Firefox profile, which is supposed to only allow downloads to be saved to ~/Downloads. However, I can still download to any location within my home directory. I checked ...
2
votes
0answers
186 views

how to solve apparmor “profile transition not found”

I get repeated apparmor messages like the following in my syslog (profile is in complain mode): Aug 29 02:07:13 titan kernel: [19497.559718] audit: type=1400 audit(1472454433.147:1131): apparmor="...
1
vote
0answers
352 views

After enabling apparmor Lightdm does not login automatically

I am trying to enable apparmor for Linux system (Debian 8). After Enabling i notice that my lightdm does not start. If i enable complain mode in apparmor for lightdm. it works . Posting logs for both ...
3
votes
0answers
384 views

Apparmor: does complain mode enable capability dac_override?

I'm trying to adjust an AppArmor profile after I found some guidance that it should be disabled for my use-case (not too happy running an IPSec daemon naked). So I've tried to put it in complain mode ...
2
votes
1answer
276 views

AppArmor is causing Firefox segfaults

I realise this is probably a bad question but I'm stuck. After a lot of googling I'm struggling to fix the problem. I've been trying to get AppArmor to work on Debian. I've been following the ...
2
votes
1answer
669 views

apparmor - cannot load library

I'm trying to get apparmor set up on my system and am having troubles getting past the permission denied error: ping: error while loading shared libraries: libcap.so.2: cannot stat shared object: ...
1
vote
1answer
313 views

apparmor: mysql permissions--with no recent changes

UPDATE: I now know my issue was database corruption, but discerning it was somewhat tricky--apparmor appeared to be the cause for longer than it should've. I didn't note when first posting that even ...
3
votes
1answer
220 views

Can AppArmor restrict access to a specific interface?

A deceptively simple question; Can Apparmor on Ubuntu (any release) restrict network access for a specific application to a specific network interface? If it can; an example/tutorial/etc link would ...
2
votes
2answers
2k views

what is apparmor “profile_replace” log message

Can anyone explain this line in the log.smbd? Searching the internet for apparmor details gets so many hits I cannot find the information. This occurs when smbd is started. kernel: [908896.070790] ...
1
vote
1answer
772 views

BIND9 denying queries from IPs outsite localnet (External IPs) - Ubuntu 14.04

BIND9 denying queries from IPs outsite localnet (External IPs) on Ubuntu. options { listen-on port 53 { any; }; directory "/var/bind"; allow-query ...
0
votes
0answers
158 views

Is apparmor preventing the running of my application?

I have an application that runs on Ubuntu and used to run on Tails. But now with Tails 1.5 it does not run anymore on Tails. My application package is basically a directory containing the application,...
3
votes
3answers
507 views

AppArmor: Are multiple profiles per application (Firefox, Thunderbird) possible? Syntax?

Is there a way to create an AppArmor profile for each Firefox profile, when running multiple profiles off a single installation of Firefox? Or more generally for any application supporting multiple ...
7
votes
1answer
17k views

Permission denied writing to mysql log

I am just testing out a new Ubuntu (Vivid 15.04) install on Vagrant, and getting problems with mysql and logging to a custom location. In /var/log/syslog I get /usr/bin/mysqld_safe: cannot create /...
1
vote
1answer
46 views

Using apprarmor/grsec to gain capabilities for file

I know that using apparmor, one can reduce process capabilities(7). But is it possible to gain them? For example: ping requires CAP_NET_RAW. It's binary has no suid set and doesn't have any file ...
1
vote
2answers
168 views

How to protect against data leak?

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them. However our boss is concerned that someone (upon ...
14
votes
4answers
2k views

Simplest possible secure sandboxing (limited resources needed)

I'm working on a project that implements distributed simulations: arbitrary code is executed on multiple nodes and the results are later collected and aggregated. Each node is an instance of an ...
5
votes
0answers
2k views

AppArmor Profile: Deny internet access

I want to deny the internet permission for some applications. Therefore, I tried first to deny the internet permission for ping, but it doesn't work. Here is the profile of /etc/apparmor.d/bin.ping /...
2
votes
0answers
41 views

AppArmor: make it ask me for decision to allow/disallow

I'm having fun writing AppArmor profile for firefox. I like to open downloaded files directly from firefox (by double-click on it), it is really convenient. But then firefox should have permissions ...
11
votes
2answers
5k views

AppArmor profiles in Docker/LXC

I have a Docker container (LXC) which runs MySQL. Since the idea behind Docker is generally "one running process per container," if I define AppArmor profiles targeting the MySQL binary, will they be ...
10
votes
2answers
16k views

Why am I getting apparmor error messages in the syslog about NTP and LDAP?

On my newly installed Ubuntu 12.04 machine, with ntp and slapd installed, the following messages appear in /var/log/syslog at regular intervals: Feb 23 18:54:07 my-host kernel: [ 24.610703] type=...
4
votes
2answers
620 views

Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?

In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?". User @IwillnotexistIdonotexist ...