Questions tagged [apparmor]

AppArmor is a Mandatory Access Control (MAC) mechanism which can be used to confine processes on Linux systems. Use AppArmor tag in questions about AppArmor in general, AppArmor profiles or AppArmor related problems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

Debian 11 - apparmor blocks application after removing it

I set up a fresh debian 11 installation and installed tor to fiddle around with hidden services. Since its only a test machine I decided to uninstall apparmor since I dont need any security on that ...
user avatar
  • 629
1 vote
0 answers
62 views

AppArmor not blocking curl/ping networking when IP address used

I'm playing with network permissions in AppArmor, and I'm trying to confine this script: #!/bin/bash curl $SOME_IP_ADDRESS If I do curl $MY_FULL_DOMAIN, AppArmor does prevent it, as it seems unable ...
user avatar
  • 111
1 vote
0 answers
125 views

Load AppArmor profile inside Docker container

I would like to load another AppArmor profile inside a Docker container. The docker container itself uses the docker-default profile. The other profile is supposed to enforce the docker-default ...
user avatar
  • 71
1 vote
1 answer
94 views

Postfix thinks its on a read only filesystem?

I want to run some analytics on my mail.log (postfix 3.2.13 on Ubuntu 20.04 LTS) including updating a db of undeliverable emails, so I wrote script, excluded mail.log from the generic /var/log ...
user avatar
  • 4,285
0 votes
0 answers
51 views

Apparmor_opt, enhanced_base_opt not present in SUSE Linux Enterprise Server 15 service pack 2

I had an OpenSUSE Leap15.2 OS. I used autoYaST for auto-installation. This is the patterns section of the autoYaST file. <patterns config:type="list"> <pattern>apparmor</...
user avatar
  • 121
1 vote
1 answer
199 views

How do I enable mounting filesystems in docker containers using apparmor

I have a ubuntu 20.04 server running docker. Recently the default apparmor profile seems to have started enforcing a restriction on mount points in docker containers. So the containers write directly ...
user avatar
  • 21
1 vote
0 answers
503 views

samba network share fails to mount at boot time

On a box with Ubuntu 20.04, I struggle to mount a network share at boot time. Manually mounting the same share with sudo mount /media/SHARE works without any issues, and the same /etc/fstab entries ...
user avatar
  • 201
1 vote
1 answer
212 views

Make a binary to always run in a cgroup

I want to make sure a binary located at certain path is always run as part of a certain cgroup. Everything I found so far involves running the binary through some special command (e.g. with systemd-...
user avatar
  • 3,948
1 vote
2 answers
1k views

lxc-start tells me apparmor_parser not available even though apparmor is installed and running

System:Debian Testing (Bullseye) I am trying to get an LXC container up and running as per here, however, when I get to lxc-start -n my-container -d I get the following: $ lxc-start -n test1 -d lxc-...
user avatar
1 vote
1 answer
43 views

How to find which processes are started/utilized when USB drive inserted

I want to restrict the processes involved in handling removable storage via AppArmor on a Debian system. Which processes are used by Debian when a removable storage device (USB) is inserted? Which ...
user avatar
  • 486
1 vote
1 answer
188 views

Block/allow specific subprocesses being launched by a process

I block all Internet traffic for my kids' Linux accounts using iptables. Sometimes I want to allow them to use one program or another. In such cases I enable them to run that program as another(...
user avatar
1 vote
1 answer
133 views

Allow file read only through application

I have a file with a secret and a generator application that reads it and generates something similar to a license. There are users on that Linux machine who are allow to use that application. Because ...
user avatar
  • 661
1 vote
1 answer
53 views

Linux Security Modules - SELinux/AppArmor

can someone explain to me why SELinux is officially broken under Ubuntu while AppArmor works fine? AppArmor is build on the "Linux Security Modules" framework and so is SELinux. As a result, ...
user avatar
  • 11
1 vote
1 answer
260 views

AppArmor equivalent to Firejail --net=none

firejail --net=none creates a sandbox looking like a computer without any network interfaces. Is it possible to achieve the same result with AppArmor? It looks like, AppArmor's deny network just ...
user avatar
  • 586
1 vote
1 answer
94 views

Permissions problem when using ruby based snap 'mdl'

Because I don't understand Ruby, but want to use the ruby based program mdl (markdownlint), I have installed it using snap. While I can run the program, if I try and set up a customizations in a ~/....
user avatar
-1 votes
1 answer
55 views

Modify OS Security Module Configuration on SELinux vs AppArmor

Just some pretext, I am fairly new to this and I'm still learning how SELinux works. I am trying to Modify OS security module configurations, but the instructions given to me were for Ubuntu and ...
user avatar
3 votes
1 answer
288 views

Are LSM tools such as AppArmor and SELinux considered IDS/IPS? [closed]

I know this is kind of an odd question. An IDS/IPS basically autonomously recognizes and optionally prevents intrusions. And while SELinux and AppArmor seem to be trying to do the same, they are never ...
user avatar
2 votes
2 answers
319 views

kdenlive not able to open/save due to apparmor

I've been struggling with this for a few days. Ubuntu 18.04.4 LTS appamor 2.12-4ubuntu5.1 https://www.linuxquestions.org/questions/linux-desktop-74/kdenlive-snap-can%27t-save-or-load-because-of-...
user avatar
2 votes
1 answer
1k views

Why does `sudo cat /proc/self/attr/current` return "Invalid argument"?

I have read that the current AppArmor profile should be listed in the /proc/self/attr/current file, and that if it's empty the current profile is "unconfined". But why does cat return "Invalid ...
user avatar
  • 3,357
3 votes
0 answers
252 views

AppArmor blocking firefox on Linux Mint 18.3

Using aa-genprof, I've attempted to generate a profile for Firefox, but AppArmor keeps blocking access to a connect capability when Firefox attempts to start, which throws an error : Failed to ...
user avatar
  • 486
1 vote
0 answers
278 views

How is the best way to debug an AppArmor syntax error?

Recently I upgraded Debian, from Stretch (v9x) to Buster (v10.2). Now in Thunderbird (package v68.3.0) when I click a link in an email, my browser (FireFox, v71.0, downloaded, i.e. not packaged) won't ...
user avatar
3 votes
1 answer
2k views

snapd fails on openSUSE Leap 15.1

I've installed and enabled snappy on my openSUSE Leap 15.1 system according to this documentation: https://snapcraft.io/docs/installing-snap-on-opensuse When adding the repository, I used the one for ...
user avatar
  • 41
1 vote
0 answers
267 views

How to to access /sys/bus/usb/devices/ from qemu with AppArmor enabled? ("Cannot Open File" and "Cannot read serial from...")

I'm trying to access an USB device with AQEMU. For this I have added an USB port in the media options. But when starting the virtual machine I'm getting these errors: AQEMU Warning [..] >>> ...
user avatar
  • 3,500
1 vote
0 answers
24 views

Crtl-C does not kill AppArmour and namespace sandboxed process

Given this AppArmour profile (intended to avoid manipulation of git repositories): /RISC_OS { signal, ptrace, unix, network, / mrixwlk, /** mrixwlk, deny /**/.git** wl, deny /**/refs/...
user avatar
1 vote
0 answers
545 views

Sudenly, firefox is not opening at Parrot OS

I was using few times Parrot OS live booted from RAM or USB as well. Firefox is the web browser built in and my favourite by the way, so I used it. Unfortunatelly is not working properly anymore. I ...
user avatar
2 votes
1 answer
2k views

Why is apparmor logging ALLOWED cases for LibreOffice?

I'm using Devuan Beowulf (~= Debian Buster). I'm seeing quite a few /var/log/messages messages involving apparmor, e.g.: Oct 29 12:05:20 my_host_name kernel: [232254.998790] audit: type=1400 audit(...
user avatar
  • 7,311
1 vote
0 answers
390 views

Strange permission issue [media server]

I've been using my Linux machine (Ubuntu - 19.04 based) as a media server which has worked flawlessly so far - but suddenly I've been getting permission issues. I'm running the media server (...
user avatar
  • 45
1 vote
0 answers
108 views

Docker containers and AppArmor profiles

The default AppArmor profile for Docker containers is an "unattached profile". It doesn't name the program being confined. According to the docs, an unattached profile need to be attached to a program....
user avatar
  • 131
0 votes
0 answers
39 views

lxc-create undefined symbol: file_to_buf

I just migrate my stretch installation to a Buster install. I was previously running a LXC 3.x compiled by me and i have uninstall it to take the buster version. i can create container, start and ...
user avatar
1 vote
2 answers
1k views

How to load apparmor profile for a service that runs in systemd's user space

I have been trying to load apparmor profile for a service that runs in systemd's user instance. I have two service files sample.service, for the process and another sample-profile-loader.service which ...
user avatar
  • 11
1 vote
1 answer
43 views

Is iteratively adding more AppArmor rules bad?

As far as I know, AppArmor cannot grant privileges to a program that otherwise doesn't have it (i.e. it can only further restrict). Given that, would it be okay to "allow all" for all programs at ...
user avatar
3 votes
1 answer
3k views

Firefox Apparmor Profile

I'm running Ubuntu Mate 19.04. I want to enable apparmor for Firefox. I found an existing profile in /etc/apparmor.d/usr.bin.firefox, which I enabled by deleting /etc/apparmor.d/disable/usr.bin....
user avatar
  • 51
1 vote
2 answers
596 views

I've accidentily deleted /etc/apparmor/, what should I do to restore it?

I accidentally deleted the /etc/apparmor/ folder on my debian 4.19.28-2 box by having the wrong folder selected in a gui file browser. My questions are: Should I be worried? #apparmor_status ...
user avatar
1 vote
1 answer
159 views

Where apparmor stores information about profiles in enforce/complain mode?

Where does AppArmor store information about which profiles should be loaded on system start in enforce or complain mode? What happens when I do aa-enforce /etc/apparmor.d/usr.bin.firefox? My problem ...
user avatar
0 votes
1 answer
2k views

Re-installation of AppArmor misses some files

I have Ubuntu 16.04 and lately I reinstalled AppArmor: sudo rm -rf /etc/apparmor* sudo apt-get install apparmor --reinstall sudo service apparmor restart When I am trying to parse a profile with ...
user avatar
  • 301
2 votes
3 answers
2k views

How to install AppArmor on alpine

I have a container with alpine image (docker:dind) and I want to install ApparMor inside it to see how it works before I put it on the host. I found ApparMor package in alpine repostiroy but I don'...
user avatar
  • 301
0 votes
1 answer
299 views

How does AppArmor match profiles to processes?

What are all the ways AppArmor profiles can be matched to processes? One seems to be path based (e.g. the /sbin/dhclient profile is applied when /sbin/dhclient is executed) but is this due to /sbin/...
user avatar
  • 297
0 votes
1 answer
443 views

AppArmor "Multiple definitions for hat sanitized_helper" Error Running Firefox Profile in Enforce Mode

I've made myself an AA profile and am trying to run in enforce mode: aa-enforce /usr/bin/firefox is giving me ERROR: Multiple definitions for hat sanitized_helper in profile (null) exist,bailing ...
user avatar
1 vote
1 answer
918 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
user avatar
  • 2,205
2 votes
1 answer
15k views

How to allow specific Proxmox LXC containers to mount NFS shares on the network?

This question is very similar to How to fix ”mount.nfs: access denied …“ when trying to mount a NFS share exported by a Proxmox 5 machine?. On a Proxmox LXC container I'm trying to mount a NFS share ...
user avatar
  • 347
4 votes
2 answers
1k views

How to teach AppArmor about toplevel symlinks

I have my "root" partition split into two: a normal one that contains most files and a second one used for those areas that can "grow". Concretely, this means, I have symlinks like: /var/log -> ...
user avatar
  • 173
1 vote
0 answers
829 views

apt-get says apparmor is installed, but the Docker kernel compatibility check says it's not

I'm in the process of installing Docker for the first time. In the official documentation, at this point, it says I should download and run a script (check-config.sh) to test whether my system has ...
user avatar
4 votes
2 answers
10k views

How to configure AppArmor so that KVM can start guest that has a backing file chain

I'm playing around with using Qemu external snapshots for KVM (because they are so fast!) on Ubuntu 16.04 and have the following setup: All files for the VM are within a single directory (named after ...
user avatar
  • 1,967
0 votes
0 answers
426 views

(AppArmor) Does allowing a confined program to execute another binary unconfined ruin security?

I have recently tried to get to know SELinux and AppArmor and then decided to use AppArmor for its simplicity. I started writing some profiles using aa-genprof and aa-logprof but big programs like ...
user avatar
1 vote
1 answer
2k views

docker socket: permission denied

I have home server with proxmox 5 installed and some services in docker containers. All was fine till yestarday. I rebooted the server and all services in all containers cannot bind socket because of ...
user avatar
0 votes
1 answer
2k views

KVM: Can not destroy VM (Permission denied) - AppArmor blocking Libvirt

Every time I run virsh destroy ${KVM} as root I get the following error (virsh shutdown ${KVM} is showing absolutely no reaction, nothing happens): error: Failed to destroy domain ${KVM} error: ...
user avatar
  • 2,301
3 votes
1 answer
950 views

apparmor wildcard profile with globbing

I am running Ubuntu 16.04 with apparmor 2.10.95-0ubuntu2.7. I often need to comment on software of dubious quality. I want to employ apparmor to guard my system from harm. I created an apparmor ...
user avatar
  • 4,875
3 votes
1 answer
4k views

How to deny application's access to network by AppArmor?

Environment: OS: Debian GNU/Linux 9.3 (stretch) Kernel parameter: security=apparmor Here is my test profile (created by aa-genprof): /etc/apparmor.d/usr.bin.telnet.netkit #include <tunables/...
user avatar
2 votes
2 answers
2k views

Is AppArmor actively used by Linux Mint 18?

Under my new Linux Mint 18.3 (64 bit) installation on my notebook, the command $ sudo apparmor_status returns the following: apparmor module is loaded. apparmor filesystem is not mounted. Is ...
user avatar
2 votes
1 answer
1k views

Cannot start syslog-ng when apparmor is running

I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin: service apparmor start * Starting AppArmor ... * Loading AppArmor profiles ......
user avatar
  • 1,122