Skip to main content

Questions tagged [apparmor]

AppArmor is a Mandatory Access Control (MAC) mechanism which can be used to confine processes on Linux systems. Use AppArmor tag in questions about AppArmor in general, AppArmor profiles or AppArmor related problems.

Filter by
Sorted by
Tagged with
1 vote
0 answers
70 views

AppArmor deny all files except specific

I want a AppArmor profile which denies a binary access to all files except .so-files/libraries and specific directories which it need access to. #include <tunables/global> /home/test/rust-api/...
O'Niel's user avatar
  • 159
0 votes
0 answers
55 views

Where is AppArmor's Log File?

I'm trying to scan the application Firefox with AppArmor sandbox, however I don't know where the location of the log file is. I use Kali Linux, and there are so many directories with log files. I also ...
Hack3rX's user avatar
0 votes
0 answers
113 views

AppArmor rule that allows access to any file in home directory via a particular symbolic link

The following AppArmor profile allows the program myprog to read the user's configuration file found at ~/.myprogrc. abi <abi/3.0>, include <tunables/global> profile myprog /usr/bin/...
Flux's user avatar
  • 2,978
0 votes
2 answers
337 views

AppArmor Error preventing removing AA, Repairing AA or install new apps with Apt

AppArmor is causing problems with my system. I have AppArmor disabled now because it was preventing me from booting. I am unable to install new apt apps. When I try anyway I get... E: dpkg was ...
Rick Knight's user avatar
0 votes
1 answer
75 views

How to allow an application in AppArmor?

I am using redshift, which has support for custom shell scripts in hooks when certain events happen. However, these hooks are not executed because of AppArmor: [11541.395814] audit: type=1400 audit(...
Philipp Ludwig's user avatar
1 vote
0 answers
306 views

AppArmor issues with Libvirt

I have a fresh Ubuntu Server 22.04.3 and Debian 12.1.0 installed and updated. Along with Cockpit and Cockpit virtual machines on both tests machines. I am getting the following errors and warning when ...
Johannes's user avatar
0 votes
0 answers
249 views

capabilities in AppArmor profile vs extended attributes

I'm trying understand AppArmor capabilities at the moment. I found an example which had me make a copy of /bin/ping and generate AppArmor profile for it. First I made a copy of /bin/ping and set it's ...
xycainoff's user avatar
0 votes
0 answers
395 views

Audit Logging Discrepancy: Journald vs Rsyslog

After installing Debian 12 and rsyslog 8.2302 (for TLS remote syslog), I noticed that apparmor logs (or any audit logs) were not being sent remotely. After reviewing the local system, journald DOES ...
user avatar
0 votes
2 answers
119 views

No module named apparmor. Why?

Context : I installed (manually) the apparmor-utils and apparmor-profiles and apparmor-utils, since when trying apt-get install apparmor-utils apparmor-profiles can't find the packages. aa-status ...
Obscuree's user avatar
1 vote
1 answer
281 views

unprivileged_userns_apparmor_policy - what does it do?

I am developing some AppArmor profiles, and came across the kernel flag unprivileged_userns_apparmor_policy, but I cannot find any documentation about it. Does anyone know what it does? I wonder if ...
schmeg's user avatar
  • 21
0 votes
0 answers
841 views

AppArmor Permission denied loading profile

I am trying to start a docker-compose file on my VPS running Ubuntu 20.04, but I have problems with AppArmor. I have the following errors: systemctl status apparmor ● apparmor.service - Load AppArmor ...
LifeAdmin's user avatar
0 votes
0 answers
1k views

LXC - using generated apparmor profiles, but apparmor status shows unconfined

I have been using unprivileged lxc containers (running as root but with user namespaces) using the following config to make use of apparmor: lxc.apparmor.profile = generated lxc.apparmor.allow_nesting ...
4oo4's user avatar
  • 153
1 vote
0 answers
88 views

In profiles reported by aa-status, what do double (//) or triple (///) slashes do?

Apparmor's aa-status command reports the status of apparmor, but what do the double and triple slashes mean or do in the list of profiles reported? For example, what is the double slash (//) in /usr/...
Elliptical view's user avatar
0 votes
1 answer
2k views

failed starting vm with libvirt/qemu permission denied

this is my first time i'm asking a question so if i can do something better please tell me. I'm not very good in Linux things, so far i could follow along guides and the problems i had where easy ...
entenbürzel's user avatar
0 votes
0 answers
972 views

Apparmor seems to break Samba after every reboot

I am running a Pi with a lot of services and recognised that my smbd.service (Version 4.13.13-Debian) was down with the errormessage: Aug 23 18:33:43 RPi64 systemd[879]: smbd.service: Failed to ...
bomben's user avatar
  • 509
0 votes
1 answer
2k views

Docker on Debian Failing to Bind to Port 80

I am running Docker on Debian 11. I deploy an Nginx container and it fails to bind to port 80 even though port 80 is not in use by any other process. I even tried running Docker as root. Here's the ...
Krishna Chaitanya's user avatar
2 votes
1 answer
1k views

Bind9 dynamic zone updates are denied by apparmor in Debian11

I installed bind9 with chroot on Debian11, described by this tutorial: https://wiki.debian.org/Bind9#Debian_Jessie_and_later It works fine, but as soon as I turn on dynamic zone updates, it will fail ...
Darwick's user avatar
  • 125
1 vote
1 answer
773 views

Debian 11 - apparmor blocks application after removing it

I set up a fresh debian 11 installation and installed tor to fiddle around with hidden services. Since its only a test machine I decided to uninstall apparmor since I dont need any security on that ...
rockZ's user avatar
  • 769
1 vote
0 answers
374 views

AppArmor not blocking curl/ping networking when IP address used

I'm playing with network permissions in AppArmor, and I'm trying to confine this script: #!/bin/bash curl $SOME_IP_ADDRESS If I do curl $MY_FULL_DOMAIN, AppArmor does prevent it, as it seems unable ...
dcc310's user avatar
  • 111
1 vote
0 answers
495 views

Load AppArmor profile inside Docker container

I would like to load another AppArmor profile inside a Docker container. The docker container itself uses the docker-default profile. The other profile is supposed to enforce the docker-default ...
user's user avatar
  • 71
1 vote
1 answer
714 views

Postfix thinks its on a read only filesystem?

I want to run some analytics on my mail.log (postfix 3.2.13 on Ubuntu 20.04 LTS) including updating a db of undeliverable emails, so I wrote script, excluded mail.log from the generic /var/log ...
symcbean's user avatar
  • 5,821
1 vote
1 answer
639 views

How do I enable mounting filesystems in docker containers using apparmor

I have a ubuntu 20.04 server running docker. Recently the default apparmor profile seems to have started enforcing a restriction on mount points in docker containers. So the containers write directly ...
Matt's user avatar
  • 21
1 vote
0 answers
2k views

samba network share fails to mount at boot time

On a box with Ubuntu 20.04, I struggle to mount a network share at boot time. Manually mounting the same share with sudo mount /media/SHARE works without any issues, and the same /etc/fstab entries ...
user52366's user avatar
  • 211
2 votes
1 answer
788 views

Make a binary to always run in a cgroup

I want to make sure a binary located at certain path is always run as part of a certain cgroup. Everything I found so far involves running the binary through some special command (e.g. with systemd-...
Hi-Angel's user avatar
  • 5,172
4 votes
3 answers
3k views

lxc-start tells me apparmor_parser not available even though apparmor is installed and running

System:Debian Testing (Bullseye) I am trying to get an LXC container up and running as per here, however, when I get to lxc-start -n my-container -d I get the following: $ lxc-start -n test1 -d lxc-...
Enter Display Name Here's user avatar
1 vote
1 answer
388 views

How to find which processes are started/utilized when USB drive inserted

I want to restrict the processes involved in handling removable storage via AppArmor on a Debian system. Which processes are used by Debian when a removable storage device (USB) is inserted? Which ...
john doe's user avatar
  • 856
3 votes
1 answer
554 views

Block/allow specific subprocesses being launched by a process

I block all Internet traffic for my kids' Linux accounts using iptables. Sometimes I want to allow them to use one program or another. In such cases I enable them to run that program as another(...
user1876484's user avatar
1 vote
1 answer
796 views

Allow file read only through application

I have a file with a secret and a generator application that reads it and generates something similar to a license. There are users on that Linux machine who are allow to use that application. Because ...
hudac's user avatar
  • 779
1 vote
1 answer
92 views

Linux Security Modules - SELinux/AppArmor

can someone explain to me why SELinux is officially broken under Ubuntu while AppArmor works fine? AppArmor is build on the "Linux Security Modules" framework and so is SELinux. As a result, ...
Questa's user avatar
  • 11
1 vote
1 answer
507 views

AppArmor equivalent to Firejail --net=none

firejail --net=none creates a sandbox looking like a computer without any network interfaces. Is it possible to achieve the same result with AppArmor? It looks like, AppArmor's deny network just ...
Trudy's user avatar
  • 924
1 vote
1 answer
169 views

Permissions problem when using ruby based snap 'mdl'

Because I don't understand Ruby, but want to use the ruby based program mdl (markdownlint), I have installed it using snap. While I can run the program, if I try and set up a customizations in a ~/....
mikemtnbikes's user avatar
-1 votes
1 answer
79 views

Modify OS Security Module Configuration on SELinux vs AppArmor

Just some pretext, I am fairly new to this and I'm still learning how SELinux works. I am trying to Modify OS security module configurations, but the instructions given to me were for Ubuntu and ...
yellomellofello's user avatar
3 votes
1 answer
470 views

Are LSM tools such as AppArmor and SELinux considered IDS/IPS? [closed]

I know this is kind of an odd question. An IDS/IPS basically autonomously recognizes and optionally prevents intrusions. And while SELinux and AppArmor seem to be trying to do the same, they are never ...
Nephilim's user avatar
2 votes
2 answers
498 views

kdenlive not able to open/save due to apparmor

I've been struggling with this for a few days. Ubuntu 18.04.4 LTS appamor 2.12-4ubuntu5.1 https://www.linuxquestions.org/questions/linux-desktop-74/kdenlive-snap-can%27t-save-or-load-because-of-...
anyhingwilldo's user avatar
2 votes
1 answer
2k views

Why does `sudo cat /proc/self/attr/current` return "Invalid argument"?

I have read that the current AppArmor profile should be listed in the /proc/self/attr/current file, and that if it's empty the current profile is "unconfined". But why does cat return "Invalid ...
Shuzheng's user avatar
  • 4,591
3 votes
0 answers
402 views

AppArmor blocking firefox on Linux Mint 18.3

Using aa-genprof, I've attempted to generate a profile for Firefox, but AppArmor keeps blocking access to a connect capability when Firefox attempts to start, which throws an error : Failed to ...
john doe's user avatar
  • 856
2 votes
1 answer
650 views

How is the best way to debug an AppArmor syntax error?

Recently I upgraded Debian, from Stretch (v9x) to Buster (v10.2). Now in Thunderbird (package v68.3.0) when I click a link in an email, my browser (FireFox, v71.0, downloaded, i.e. not packaged) won't ...
Elliptical view's user avatar
3 votes
1 answer
2k views

snapd fails on openSUSE Leap 15.1

I've installed and enabled snappy on my openSUSE Leap 15.1 system according to this documentation: https://snapcraft.io/docs/installing-snap-on-opensuse When adding the repository, I used the one for ...
el.com's user avatar
  • 41
1 vote
0 answers
471 views

How to to access /sys/bus/usb/devices/ from qemu with AppArmor enabled? ("Cannot Open File" and "Cannot read serial from...")

I'm trying to access an USB device with AQEMU. For this I have added an USB port in the media options. But when starting the virtual machine I'm getting these errors: AQEMU Warning [..] >>> ...
mYnDstrEAm's user avatar
  • 4,388
1 vote
0 answers
29 views

Crtl-C does not kill AppArmour and namespace sandboxed process

Given this AppArmour profile (intended to avoid manipulation of git repositories): /RISC_OS { signal, ptrace, unix, network, / mrixwlk, /** mrixwlk, deny /**/.git** wl, deny /**/refs/...
Timothy Baldwin's user avatar
1 vote
0 answers
833 views

Sudenly, firefox is not opening at Parrot OS

I was using few times Parrot OS live booted from RAM or USB as well. Firefox is the web browser built in and my favourite by the way, so I used it. Unfortunatelly is not working properly anymore. I ...
RandomName8's user avatar
2 votes
1 answer
2k views

Why is apparmor logging ALLOWED cases for LibreOffice?

I'm using Devuan Beowulf (~= Debian Buster). I'm seeing quite a few /var/log/messages messages involving apparmor, e.g.: Oct 29 12:05:20 my_host_name kernel: [232254.998790] audit: type=1400 audit(...
einpoklum's user avatar
  • 9,643
1 vote
0 answers
501 views

Strange permission issue [media server]

I've been using my Linux machine (Ubuntu - 19.04 based) as a media server which has worked flawlessly so far - but suddenly I've been getting permission issues. I'm running the media server (...
dkd6's user avatar
  • 77
2 votes
0 answers
307 views

Docker containers and AppArmor profiles

The default AppArmor profile for Docker containers is an "unattached profile". It doesn't name the program being confined. According to the docs, an unattached profile need to be attached to a program....
A. Sallai's user avatar
  • 141
0 votes
0 answers
42 views

lxc-create undefined symbol: file_to_buf

I just migrate my stretch installation to a Buster install. I was previously running a LXC 3.x compiled by me and i have uninstall it to take the buster version. i can create container, start and ...
Scandinave's user avatar
2 votes
2 answers
2k views

How to load apparmor profile for a service that runs in systemd's user space

I have been trying to load apparmor profile for a service that runs in systemd's user instance. I have two service files sample.service, for the process and another sample-profile-loader.service which ...
delver's user avatar
  • 21
1 vote
1 answer
81 views

Is iteratively adding more AppArmor rules bad?

As far as I know, AppArmor cannot grant privileges to a program that otherwise doesn't have it (i.e. it can only further restrict). Given that, would it be okay to "allow all" for all programs at ...
Bora M. Alper's user avatar
4 votes
1 answer
5k views

Firefox Apparmor Profile

I'm running Ubuntu Mate 19.04. I want to enable apparmor for Firefox. I found an existing profile in /etc/apparmor.d/usr.bin.firefox, which I enabled by deleting /etc/apparmor.d/disable/usr.bin....
xAptive's user avatar
  • 61
1 vote
2 answers
1k views

I've accidentily deleted /etc/apparmor/, what should I do to restore it?

I accidentally deleted the /etc/apparmor/ folder on my debian 4.19.28-2 box by having the wrong folder selected in a gui file browser. My questions are: Should I be worried? #apparmor_status ...
1n5aN1aC's user avatar
1 vote
1 answer
415 views

Where apparmor stores information about profiles in enforce/complain mode?

Where does AppArmor store information about which profiles should be loaded on system start in enforce or complain mode? What happens when I do aa-enforce /etc/apparmor.d/usr.bin.firefox? My problem ...
user224348's user avatar