Questions tagged [apparmor]

AppArmor is a Mandatory Access Control (MAC) mechanism which can be used to confine processes on Linux systems. Use AppArmor tag in questions about AppArmor in general, AppArmor profiles or AppArmor related problems.

Filter by
Sorted by
Tagged with
1
vote
1answer
25 views

How to find which processes are started/utilized when USB drive inserted

I want to restrict the processes involved in handling removable storage via AppArmor on a Debian system. Which processes are used by Debian when a removable storage device (USB) is inserted? Which ...
1
vote
1answer
64 views

Block/allow specific subprocesses being launched by a process

I block all Internet traffic for my kids' Linux accounts using iptables. Sometimes I want to allow them to use one program or another. In such cases I enable them to run that program as another(...
1
vote
1answer
29 views

Allow file read only through application

I have a file with a secret and a generator application that reads it and generates something similar to a license. There are users on that Linux machine who are allow to use that application. Because ...
0
votes
0answers
18 views

Linux Security Modules - SELinux/AppArmor

can someone explain to me why SELinux is officially broken under Ubuntu while AppArmor works fine? AppArmor is build on the "Linux Security Modules" framework and so is SELinux. As a result, ...
0
votes
0answers
14 views

Apparmor profile that allows setarch

When I try this on 64 bit fedora: $ docker run -it i386/ubuntu setarch i386 -3 -R bash I get: setarch: failed to set personality to i386 I don't want to run the container --privileged (which solves ...
0
votes
0answers
30 views

Can't use proxychains because of apparmor

I was trying to start using proxychains so I first started tor service by typing service tor start tor was started without any errors but when I do proxychains ping www.google.com but that shows up ...
1
vote
1answer
39 views

AppArmor equivalent to Firejail --net=none

firejail --net=none creates a sandbox looking like a computer without any network interfaces. Is it possible to achieve the same result with AppArmor? It looks like, AppArmor's deny network just ...
0
votes
1answer
47 views

Permissions problem when using ruby based snap 'mdl'

Because I don't understand Ruby, but want to use the ruby based program mdl (markdownlint), I have installed it using snap. While I can run the program, if I try and set up a customizations in a ~/....
0
votes
0answers
99 views

config file '/etc/apparmor/parser.conf' not found

I have a Debian 10 System in which I have set up some AppArmor profiles. I installed the apparmor-profile-everything package from whonix repo, in order to easily pull down the apparmor profiles. Later,...
-1
votes
1answer
25 views

Modify OS Security Module Configuration on SELinux vs AppArmor

Just some pretext, I am fairly new to this and I'm still learning how SELinux works. I am trying to Modify OS security module configurations, but the instructions given to me were for Ubuntu and ...
3
votes
1answer
131 views

Are LSM tools such as AppArmor and SELinux considered IDS/IPS? [closed]

I know this is kind of an odd question. An IDS/IPS basically autonomously recognizes and optionally prevents intrusions. And while SELinux and AppArmor seem to be trying to do the same, they are never ...
1
vote
2answers
87 views

kdenlive not able to open/save due to apparmor

I've been struggling with this for a few days. Ubuntu 18.04.4 LTS appamor 2.12-4ubuntu5.1 https://www.linuxquestions.org/questions/linux-desktop-74/kdenlive-snap-can%27t-save-or-load-because-of-...
0
votes
0answers
12 views

Add a custom interface to a snap (or customize it by other means)

What are the mechanisms by which someone can customize a 3rd party snap package? For example, the default rules for Chromium as packaged into a snap by Ubuntu disallow it access to anything but the ...
0
votes
0answers
401 views

AppArmor fails to load AppArmor profiles during startup

Woke up to find my system unable to startup with the following lines: [FAIL] Unable to find AppArmor initscript functions ... failed! [FAIL] startpar: service(s) returned failure: AppArmor ... failed!...
0
votes
0answers
94 views

Apparmor Profile Transition Not Found

I wrote the following profile for /usr/bin/atril: # Last Modified: Sun Mar 1 14:16:31 2020 #include <tunables/global> /usr/bin/atril { #include <abstractions/audio> #include <...
1
vote
1answer
355 views

Why does `sudo cat /proc/self/attr/current` return “Invalid argument”?

I have read that the current AppArmor profile should be listed in the /proc/self/attr/current file, and that if it's empty the current profile is "unconfined". But why does cat return "Invalid ...
0
votes
0answers
44 views

LiveCD/USB and AppArmor not working correctly (Debian)

What needs to be done to get AppArmor to work on the stacked filesystem? AppArmor is not working correctly on my Debian-based LiveCD/Flash. The apparmor_status command shows 0 loaded profiles: ...
3
votes
0answers
125 views

AppArmor blocking firefox on Linux Mint 18.3

Using aa-genprof, I've attempted to generate a profile for Firefox, but AppArmor keeps blocking access to a connect capability when Firefox attempts to start, which throws an error : Failed to ...
1
vote
0answers
124 views

How is the best way to debug an AppArmor syntax error?

Recently I upgraded Debian, from Stretch (v9x) to Buster (v10.2). Now in Thunderbird (package v68.3.0) when I click a link in an email, my browser (FireFox, v71.0, downloaded, i.e. not packaged) ...
2
votes
1answer
685 views

snapd fails on openSUSE Leap 15.1

I've installed and enabled snappy on my openSUSE Leap 15.1 system according to this documentation: https://snapcraft.io/docs/installing-snap-on-opensuse When adding the repository, I used the one for ...
1
vote
0answers
133 views

How to to access /sys/bus/usb/devices/ from qemu with AppArmor enabled? (“Cannot Open File” and “Cannot read serial from…”)

I'm trying to access an USB device with AQEMU. For this I have added an USB port in the media options. But when starting the virtual machine I'm getting these errors: AQEMU Warning [..] >>> ...
1
vote
0answers
22 views

Crtl-C does not kill AppArmour and namespace sandboxed process

Given this AppArmour profile (intended to avoid manipulation of git repositories): /RISC_OS { signal, ptrace, unix, network, / mrixwlk, /** mrixwlk, deny /**/.git** wl, deny /**/refs/...
1
vote
0answers
257 views

Sudenly, firefox is not opening at Parrot OS

I was using few times Parrot OS live booted from RAM or USB as well. Firefox is the web browser built in and my favourite by the way, so I used it. Unfortunatelly is not working properly anymore. I ...
1
vote
1answer
628 views

Why is apparmor logging ALLOWED cases for LibreOffice?

I'm using Devuan Beowulf (~= Debian Buster). I'm seeing quite a few /var/log/messages messages involving apparmor, e.g.: Oct 29 12:05:20 my_host_name kernel: [232254.998790] audit: type=1400 audit(...
1
vote
0answers
257 views

Strange permission issue [media server]

I've been using my Linux machine (Ubuntu - 19.04 based) as a media server which has worked flawlessly so far - but suddenly I've been getting permission issues. I'm running the media server (...
1
vote
0answers
73 views

Docker containers and AppArmor profiles

The default AppArmor profile for Docker containers is an "unattached profile". It doesn't name the program being confined. According to the docs, an unattached profile need to be attached to a program....
0
votes
0answers
34 views

lxc-create undefined symbol: file_to_buf

I just migrate my stretch installation to a Buster install. I was previously running a LXC 3.x compiled by me and i have uninstall it to take the buster version. i can create container, start and ...
1
vote
2answers
567 views

How to load apparmor profile for a service that runs in systemd's user space

I have been trying to load apparmor profile for a service that runs in systemd's user instance. I have two service files sample.service, for the process and another sample-profile-loader.service which ...
1
vote
1answer
34 views

Is iteratively adding more AppArmor rules bad?

As far as I know, AppArmor cannot grant privileges to a program that otherwise doesn't have it (i.e. it can only further restrict). Given that, would it be okay to "allow all" for all programs at ...
3
votes
1answer
1k views

Firefox Apparmor Profile

I'm running Ubuntu Mate 19.04. I want to enable apparmor for Firefox. I found an existing profile in /etc/apparmor.d/usr.bin.firefox, which I enabled by deleting /etc/apparmor.d/disable/usr.bin....
1
vote
2answers
194 views

I've accidentily deleted /etc/apparmor/, what should I do to restore it?

I accidentally deleted the /etc/apparmor/ folder on my debian 4.19.28-2 box by having the wrong folder selected in a gui file browser. My questions are: Should I be worried? #apparmor_status ...
1
vote
1answer
107 views

Where apparmor stores information about profiles in enforce/complain mode?

Where does AppArmor store information about which profiles should be loaded on system start in enforce or complain mode? What happens when I do aa-enforce /etc/apparmor.d/usr.bin.firefox? My problem ...
0
votes
1answer
1k views

Re-installation of AppArmor misses some files

I have Ubuntu 16.04 and lately I reinstalled AppArmor: sudo rm -rf /etc/apparmor* sudo apt-get install apparmor --reinstall sudo service apparmor restart When I am trying to parse a profile with ...
2
votes
2answers
1k views

How to install AppArmor on alpine

I have a container with alpine image (docker:dind) and I want to install ApparMor inside it to see how it works before I put it on the host. I found ApparMor package in alpine repostiroy but I don'...
0
votes
1answer
149 views

How does AppArmor match profiles to processes?

What are all the ways AppArmor profiles can be matched to processes? One seems to be path based (e.g. the /sbin/dhclient profile is applied when /sbin/dhclient is executed) but is this due to /sbin/...
0
votes
1answer
317 views

AppArmor “Multiple definitions for hat sanitized_helper” Error Running Firefox Profile in Enforce Mode

I've made myself an AA profile and am trying to run in enforce mode: aa-enforce /usr/bin/firefox is giving me ERROR: Multiple definitions for hat sanitized_helper in profile (null) exist,bailing ...
1
vote
1answer
683 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
2
votes
1answer
9k views

How to allow specific Proxmox LXC containers to mount NFS shares on the network?

This question is very similar to How to fix ”mount.nfs: access denied …“ when trying to mount a NFS share exported by a Proxmox 5 machine?. On a Proxmox LXC container I'm trying to mount a NFS share ...
4
votes
2answers
621 views

How to teach AppArmor about toplevel symlinks

I have my "root" partition split into two: a normal one that contains most files and a second one used for those areas that can "grow". Concretely, this means, I have symlinks like: /var/log -> ...
1
vote
0answers
436 views

apt-get says apparmor is installed, but the Docker kernel compatibility check says it's not

I'm in the process of installing Docker for the first time. In the official documentation, at this point, it says I should download and run a script (check-config.sh) to test whether my system has ...
4
votes
2answers
6k views

How to configure AppArmor so that KVM can start guest that has a backing file chain

I'm playing around with using Qemu external snapshots for KVM (because they are so fast!) on Ubuntu 16.04 and have the following setup: All files for the VM are within a single directory (named after ...
0
votes
0answers
252 views

(AppArmor) Does allowing a confined program to execute another binary unconfined ruin security?

I have recently tried to get to know SELinux and AppArmor and then decided to use AppArmor for its simplicity. I started writing some profiles using aa-genprof and aa-logprof but big programs like ...
1
vote
1answer
1k views

docker socket: permission denied

I have home server with proxmox 5 installed and some services in docker containers. All was fine till yestarday. I rebooted the server and all services in all containers cannot bind socket because of ...
0
votes
1answer
2k views

KVM: Can not destroy VM (Permission denied) - AppArmor blocking Libvirt

Every time I run virsh destroy ${KVM} as root I get the following error (virsh shutdown ${KVM} is showing absolutely no reaction, nothing happens): error: Failed to destroy domain ${KVM} error: ...
3
votes
1answer
751 views

apparmor wildcard profile with globbing

I am running Ubuntu 16.04 with apparmor 2.10.95-0ubuntu2.7. I often need to comment on software of dubious quality. I want to employ apparmor to guard my system from harm. I created an apparmor ...
3
votes
1answer
3k views

How to deny application's access to network by AppArmor?

Environment: OS: Debian GNU/Linux 9.3 (stretch) Kernel parameter: security=apparmor Here is my test profile (created by aa-genprof): /etc/apparmor.d/usr.bin.telnet.netkit #include <tunables/...
2
votes
2answers
2k views

Is AppArmor actively used by Linux Mint 18?

Under my new Linux Mint 18.3 (64 bit) installation on my notebook, the command $ sudo apparmor_status returns the following: apparmor module is loaded. apparmor filesystem is not mounted. Is ...
2
votes
1answer
1k views

Cannot start syslog-ng when apparmor is running

I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin: service apparmor start * Starting AppArmor ... * Loading AppArmor profiles ......
10
votes
1answer
15k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
1
vote
0answers
357 views

SLES 12 - vsftpd with AppArmor in enforce mode, “lftp” error for “ls” command: `ls' at 0 [500 OOPS: setrlimit]

In a virtual machine (VM) with SLES 12 (SUSE Linux Enterprise Server 12), after enforcing ("enforce mode") the AppArmor profile for "vsftpd" to confine it (via the "aa-enforce vsftpd" command), I'm ...