Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [apparmor]

AppArmor is a Mandatory Access Control (MAC) mechanism which can be used to confine processes on Linux systems. Use AppArmor tag in questions about AppArmor in general, AppArmor profiles or AppArmor related problems.

0
votes
0answers
5 views

AppArmor prevent program from reading dirs/files I haven't explicitly allowed?

I don't want programs to be able to read my whole home directory. For example, I'd like to have firefox's read ability restricted to: owner @{HOME}/Downloads/ r, owner @{HOME}/Downloads/** rwk, owner ...
0
votes
0answers
11 views

AppArmor “Multiple definitions for hat sanitized_helper” Error Running Firefox Profile in Enforce Mode

I've made myself an AA profile and am trying to run in enforce mode: aa-enforce /usr/bin/firefox is giving me ERROR: Multiple definitions for hat sanitized_helper in profile (null) exist,bailing ...
1
vote
1answer
84 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
0
votes
0answers
40 views

apparmor=“DENIED” operation=“change_onexec” info=“label not found” error=-2 profile=“unconfined” name=“snap.slack.slack” pid=11613 comm=“snap-confine”

I'm trying to Install Slack for Linux and run it on my Kali-Linux, however while trying run it, I get following in my /var/log/syslog while trying to run Slack app. Sep 19 16:37:58 suey kernel: [ ...
0
votes
0answers
26 views

Testing apparmor profiles

How can I get a list of all files a confined program is allowed to access or how can I test if I really can't access a specific file? Apparmor profiles include wildcards, things like @home or @proc ...
0
votes
1answer
998 views

How to allow specific Proxmox LXC containers to mount NFS shares on the network?

This question is very similar to How to fix ”mount.nfs: access denied …“ when trying to mount a NFS share exported by a Proxmox 5 machine?. On a Proxmox LXC container I'm trying to mount a NFS share ...
2
votes
1answer
89 views

How to teach AppArmor about toplevel symlinks

I have my "root" partition split into two: a normal one that contains most files and a second one used for those areas that can "grow". Concretely, this means, I have symlinks like: /var/log -> ...
2
votes
0answers
86 views

apt-get says apparmor is installed, but the Docker kernel compatibility check says it's not

I'm in the process of installing Docker for the first time. In the official documentation, at this point, it says I should download and run a script (check-config.sh) to test whether my system has ...
0
votes
0answers
79 views

Is it possible to use a Whitelist approach for some files with App Armor?

I'm pretty new to using AppArmor and am unaware of all it's features. I was wondering if it is possible to apply Whitelisting behavior to some files with App Armor? I think whitelisting and ...
2
votes
1answer
675 views

How to configure AppArmor so that KVM can start guest that has a backing file chain

I'm playing around with using Qemu external snapshots for KVM (because they are so fast!) on Ubuntu 16.04 and have the following setup: All files for the VM are within a single directory (named after ...
0
votes
0answers
63 views

(AppArmor) Does allowing a confined program to execute another binary unconfined ruin security?

I have recently tried to get to know SELinux and AppArmor and then decided to use AppArmor for its simplicity. I started writing some profiles using aa-genprof and aa-logprof but big programs like ...
0
votes
1answer
422 views

docker socket: permission denied

I have home server with proxmox 5 installed and some services in docker containers. All was fine till yestarday. I rebooted the server and all services in all containers cannot bind socket because of ...
0
votes
1answer
831 views

KVM: Can not destroy VM (Permission denied) - AppArmor blocking Libvirt

Every time I run virsh destroy ${KVM} as root I get the following error (virsh shutdown ${KVM} is showing absolutely no reaction, nothing happens): error: Failed to destroy domain ${KVM} error: ...
2
votes
1answer
263 views

apparmor wildcard profile with globbing

I am running Ubuntu 16.04 with apparmor 2.10.95-0ubuntu2.7. I often need to comment on software of dubious quality. I want to employ apparmor to guard my system from harm. I created an apparmor ...
1
vote
1answer
412 views

How to deny application's access to network by AppArmor?

Environment: OS: Debian GNU/Linux 9.3 (stretch) Kernel parameter: security=apparmor Here is my test profile (created by aa-genprof): /etc/apparmor.d/usr.bin.telnet.netkit #include <tunables/...
0
votes
2answers
463 views

Is AppArmor actively used by Linux Mint 18?

Under my new Linux Mint 18.3 (64 bit) installation on my notebook, the command $ sudo apparmor_status returns the following: apparmor module is loaded. apparmor filesystem is not mounted. Is ...
2
votes
1answer
468 views

Cannot start syslog-ng when apparmor is running

I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin: service apparmor start * Starting AppArmor ... * Loading AppArmor profiles ......
2
votes
1answer
3k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
0
votes
0answers
47 views

libvirt destroy lxc permission denied

I'm testing LXC over Libvirt. The container started, but can't destroyed. [root@alfabook alfa]# virsh -c lxc:/// start test-ubuntu Domain test-ubuntu started [root@alfabook alfa]# virsh -c lxc:/// ...
0
votes
0answers
61 views

Ubuntu 17.04 Apparmor local web development

How do I get apparmor to change hats when apache2 owner www-data calls for http://example.com/subdirectory/some.svg? I have no problems with example.com. I believe it is due to: <Directory "/var/...
0
votes
0answers
161 views

Apparmor, open link in Browser, Thunderbird, Debian9

i have a problem with opening links in Vivaldi (1.13.1008.34 (Stable channel) (64-bit)) via Thunderbird (52.4.0 (64-bit)). $uname -a Linux sun 4.13.0-1-amd64 #1 SMP Debian 4.13.13-1 (2017-11-16) ...
1
vote
0answers
199 views

SLES 12 - vsftpd with AppArmor in enforce mode, “lftp” error for “ls” command: `ls' at 0 [500 OOPS: setrlimit]

In a virtual machine (VM) with SLES 12 (SUSE Linux Enterprise Server 12), after enforcing ("enforce mode") the AppArmor profile for "vsftpd" to confine it (via the "aa-enforce vsftpd" command), I'm ...
1
vote
1answer
340 views

Enabling AppArmor in Linux

I've compiled a kernel (linux-libre-xtreme) with this configuration, it has most LSMs enabled: YAMA, SMACK, AppArmor, TOMOYO and SELinux. However, when I start the apparmor service with OpenRC I get: ...
-2
votes
1answer
94 views

Is there a MAC for Linux that can stop a process on policy violations?

Is there a MAC that can SIGSTOP a process on policy violations so I can resume it with an updated policy to retry the syscall? This would be very handy in case of running interactive untrusted ...
1
vote
1answer
341 views

What does “ptrace (trace) peer=” mean in AppArmor profile?

I've been writing some AppArmor profiles and with each new profile I encounter more advanced rules that I haven't seen before. In this case I'm creating profile for PulseAudio. I also had a profile ...
0
votes
2answers
353 views

apparmor denies to mount /run for lxc-start

I am trying to set up a privileged container on Ubuntu where apparmor denies to mount /run /run/lock and /sys/fs/cgroup while running lxc-start. Violations [ 1621.278919] audit: type=1400 audit(...
2
votes
0answers
106 views

What is machine-id?

Just read the machine-id manpage, still not clear on how it's used by applications. QuiteRSS and Firefox among others seem to use it. Is it generally safe to blacklist (using apparmor) certain ...
1
vote
0answers
137 views

what is “kernel–user space API”?

I am studing about apparmor. And to be more specific, for the "hats" inside the policy. In here [Apparmor Profile Language] says for "hats" that, it calls change_hat API. Can you explain the ...
2
votes
1answer
913 views

AppArmor Firefox profile allows read and write to anywhere in HOME unless explicit deny used

I am using the default AppArmor Firefox profile, which is supposed to only allow downloads to be saved to ~/Downloads. However, I can still download to any location within my home directory. I checked ...
1
vote
0answers
146 views

how to solve apparmor “profile transition not found”

I get repeated apparmor messages like the following in my syslog (profile is in complain mode): Aug 29 02:07:13 titan kernel: [19497.559718] audit: type=1400 audit(1472454433.147:1131): apparmor="...
1
vote
0answers
308 views

After enabling apparmor Lightdm does not login automatically

I am trying to enable apparmor for Linux system (Debian 8). After Enabling i notice that my lightdm does not start. If i enable complain mode in apparmor for lightdm. it works . Posting logs for both ...
2
votes
0answers
321 views

Apparmor: does complain mode enable capability dac_override?

I'm trying to adjust an AppArmor profile after I found some guidance that it should be disabled for my use-case (not too happy running an IPSec daemon naked). So I've tried to put it in complain mode ...
2
votes
1answer
256 views

AppArmor is causing Firefox segfaults

I realise this is probably a bad question but I'm stuck. After a lot of googling I'm struggling to fix the problem. I've been trying to get AppArmor to work on Debian. I've been following the ...
2
votes
1answer
598 views

apparmor - cannot load library

I'm trying to get apparmor set up on my system and am having troubles getting past the permission denied error: ping: error while loading shared libraries: libcap.so.2: cannot stat shared object: ...
1
vote
1answer
290 views

apparmor: mysql permissions--with no recent changes

UPDATE: I now know my issue was database corruption, but discerning it was somewhat tricky--apparmor appeared to be the cause for longer than it should've. I didn't note when first posting that even ...
3
votes
1answer
175 views

Can AppArmor restrict access to a specific interface?

A deceptively simple question; Can Apparmor on Ubuntu (any release) restrict network access for a specific application to a specific network interface? If it can; an example/tutorial/etc link would ...
2
votes
2answers
2k views

what is apparmor “profile_replace” log message

Can anyone explain this line in the log.smbd? Searching the internet for apparmor details gets so many hits I cannot find the information. This occurs when smbd is started. kernel: [908896.070790] ...
1
vote
1answer
684 views

BIND9 denying queries from IPs outsite localnet (External IPs) - Ubuntu 14.04

BIND9 denying queries from IPs outsite localnet (External IPs) on Ubuntu. options { listen-on port 53 { any; }; directory "/var/bind"; allow-query ...
0
votes
0answers
113 views

Is apparmor preventing the running of my application?

I have an application that runs on Ubuntu and used to run on Tails. But now with Tails 1.5 it does not run anymore on Tails. My application package is basically a directory containing the application,...
3
votes
3answers
448 views

AppArmor: Are multiple profiles per application (Firefox, Thunderbird) possible? Syntax?

Is there a way to create an AppArmor profile for each Firefox profile, when running multiple profiles off a single installation of Firefox? Or more generally for any application supporting multiple ...
7
votes
1answer
15k views

Permission denied writing to mysql log

I am just testing out a new Ubuntu (Vivid 15.04) install on Vagrant, and getting problems with mysql and logging to a custom location. In /var/log/syslog I get /usr/bin/mysqld_safe: cannot create /...
1
vote
1answer
43 views

Using apprarmor/grsec to gain capabilities for file

I know that using apparmor, one can reduce process capabilities(7). But is it possible to gain them? For example: ping requires CAP_NET_RAW. It's binary has no suid set and doesn't have any file ...
1
vote
2answers
157 views

How to protect against data leak?

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them. However our boss is concerned that someone (upon ...
13
votes
4answers
2k views

Simplest possible secure sandboxing (limited resources needed)

I'm working on a project that implements distributed simulations: arbitrary code is executed on multiple nodes and the results are later collected and aggregated. Each node is an instance of an ...
5
votes
0answers
1k views

AppArmor Profile: Deny internet access

I want to deny the internet permission for some applications. Therefore, I tried first to deny the internet permission for ping, but it doesn't work. Here is the profile of /etc/apparmor.d/bin.ping /...
2
votes
0answers
37 views

AppArmor: make it ask me for decision to allow/disallow

I'm having fun writing AppArmor profile for firefox. I like to open downloaded files directly from firefox (by double-click on it), it is really convenient. But then firefox should have permissions ...
11
votes
2answers
5k views

AppArmor profiles in Docker/LXC

I have a Docker container (LXC) which runs MySQL. Since the idea behind Docker is generally "one running process per container," if I define AppArmor profiles targeting the MySQL binary, will they be ...
9
votes
1answer
14k views

Why am I getting apparmor error messages in the syslog about NTP and LDAP?

On my newly installed Ubuntu 12.04 machine, with ntp and slapd installed, the following messages appear in /var/log/syslog at regular intervals: Feb 23 18:54:07 my-host kernel: [ 24.610703] type=...
4
votes
2answers
569 views

Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?

In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?". User @IwillnotexistIdonotexist ...
7
votes
2answers
3k views

Restrict particular applications from accessing certain files

Normally the private files stored in the home directory of a user can be accessed by applications running with the effective UID of the user. How can I restrict a particular application from accessing ...