Questions tagged [apparmor]

AppArmor is a Mandatory Access Control (MAC) mechanism which can be used to confine processes on Linux systems. Use AppArmor tag in questions about AppArmor in general, AppArmor profiles or AppArmor related problems.

Filter by
Sorted by
Tagged with
15
votes
4answers
2k views

Simplest possible secure sandboxing (limited resources needed)

I'm working on a project that implements distributed simulations: arbitrary code is executed on multiple nodes and the results are later collected and aggregated. Each node is an instance of an ...
13
votes
8answers
5k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
12
votes
2answers
18k views

Why am I getting apparmor error messages in the syslog about NTP and LDAP?

On my newly installed Ubuntu 12.04 machine, with ntp and slapd installed, the following messages appear in /var/log/syslog at regular intervals: Feb 23 18:54:07 my-host kernel: [ 24.610703] type=...
12
votes
3answers
395 views

Prompt user on Linux security denial

Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card ...
11
votes
2answers
5k views

AppArmor profiles in Docker/LXC

I have a Docker container (LXC) which runs MySQL. Since the idea behind Docker is generally "one running process per container," if I define AppArmor profiles targeting the MySQL binary, will they be ...
10
votes
2answers
6k views

Evince fails to start because it cannot read .Xauthority

I'm logged in remotely over SSH with X forwarding to a machine running Ubuntu 10.04 (lucid). Most X11 applications (e.g. xterm, gnome-terminal) work fine. But Evince does not start. It seems unable to ...
8
votes
1answer
21k views

Permission denied writing to mysql log

I am just testing out a new Ubuntu (Vivid 15.04) install on Vagrant, and getting problems with mysql and logging to a custom location. In /var/log/syslog I get /usr/bin/mysqld_safe: cannot create /...
8
votes
1answer
10k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
8
votes
3answers
2k views

Does AppArmor decrease the system performance?

Does AppArmor decrease the system performance? I have a slow system (900 MHz CPU) which has AppArmor because it was installed by default I would like to know if it become faster if I remove it, ...
7
votes
2answers
4k views

Restrict particular applications from accessing certain files

Normally the private files stored in the home directory of a user can be accessed by applications running with the effective UID of the user. How can I restrict a particular application from accessing ...
5
votes
1answer
2k views

AppArmor Profile: Deny internet access

I want to deny the internet permission for some applications. Therefore, I tried first to deny the internet permission for ping, but it doesn't work. Here is the profile of /etc/apparmor.d/bin.ping /...
4
votes
2answers
673 views

Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?

In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?". User @IwillnotexistIdonotexist ...
4
votes
2answers
3k views

How to configure AppArmor so that KVM can start guest that has a backing file chain

I'm playing around with using Qemu external snapshots for KVM (because they are so fast!) on Ubuntu 16.04 and have the following setup: All files for the VM are within a single directory (named after ...
4
votes
3answers
681 views

AppArmor: Are multiple profiles per application (Firefox, Thunderbird) possible? Syntax?

Is there a way to create an AppArmor profile for each Firefox profile, when running multiple profiles off a single installation of Firefox? Or more generally for any application supporting multiple ...
4
votes
2answers
382 views

How to teach AppArmor about toplevel symlinks

I have my "root" partition split into two: a normal one that contains most files and a second one used for those areas that can "grow". Concretely, this means, I have symlinks like: /var/log -> ...
4
votes
1answer
5k views

How can I run tcpdump from a Python script without AppArmor complaining?

For inconvenient reasons going beyond the scope of this question, I have to run tcpdump from within a Python script. I currently just call subprocess.Popen(['tcpdump', ...) and everything works just ...
3
votes
1answer
2k views

How to deny application's access to network by AppArmor?

Environment: OS: Debian GNU/Linux 9.3 (stretch) Kernel parameter: security=apparmor Here is my test profile (created by aa-genprof): /etc/apparmor.d/usr.bin.telnet.netkit #include <tunables/...
3
votes
1answer
442 views

AppArmor and bind-mounts

Can someone outline the semantics of AppArmor with respect to bind-mounted folders? As I understand after reading the documentation (1, 2, 3, 4) - yes, I am using Ubuntu 12.04 with the 3.8 kernel - ...
3
votes
1answer
1k views

Restrict applications to access certain hardware (webcam, microphone…)

If I tell applications like VLC or Audacity to record from my webcam or microphone, they just wake the hardware if sleeping and do their work without my interference. Although this is a good thing, I'...
3
votes
0answers
61 views

AppArmor blocking firefox on Linux Mint 18.3

Using aa-genprof, I've attempted to generate a profile for Firefox, but AppArmor keeps blocking access to a connect capability when Firefox attempts to start, which throws an error : Failed to ...
3
votes
0answers
279 views

how to solve apparmor “profile transition not found”

I get repeated apparmor messages like the following in my syslog (profile is in complain mode): Aug 29 02:07:13 titan kernel: [19497.559718] audit: type=1400 audit(1472454433.147:1131): apparmor="...
3
votes
0answers
476 views

Apparmor: does complain mode enable capability dac_override?

I'm trying to adjust an AppArmor profile after I found some guidance that it should be disabled for my use-case (not too happy running an IPSec daemon naked). So I've tried to put it in complain mode ...
3
votes
1answer
325 views

Can AppArmor restrict access to a specific interface?

A deceptively simple question; Can Apparmor on Ubuntu (any release) restrict network access for a specific application to a specific network interface? If it can; an example/tutorial/etc link would ...
2
votes
1answer
1k views

AppArmor Firefox profile allows read and write to anywhere in HOME unless explicit deny used

I am using the default AppArmor Firefox profile, which is supposed to only allow downloads to be saved to ~/Downloads. However, I can still download to any location within my home directory. I checked ...
2
votes
1answer
557 views

apparmor wildcard profile with globbing

I am running Ubuntu 16.04 with apparmor 2.10.95-0ubuntu2.7. I often need to comment on software of dubious quality. I want to employ apparmor to guard my system from harm. I created an apparmor ...
2
votes
2answers
3k views

what is apparmor “profile_replace” log message

Can anyone explain this line in the log.smbd? Searching the internet for apparmor details gets so many hits I cannot find the information. This occurs when smbd is started. kernel: [908896.070790] ...
2
votes
1answer
820 views

Cannot start syslog-ng when apparmor is running

I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin: service apparmor start * Starting AppArmor ... * Loading AppArmor profiles ......
2
votes
1answer
936 views

apparmor and Firefox

I am currently re-setting up the apparmor profile for Firefox 19.0.2 on Ubuntu 12.04 and I am slightly confused. I must of had Firefox 7.01 last time I used this and if I do apparmor_status then ...
2
votes
0answers
136 views

What is machine-id?

Just read the machine-id manpage, still not clear on how it's used by applications. QuiteRSS and Firefox among others seem to use it. Is it generally safe to blacklist (using apparmor) certain ...
2
votes
1answer
305 views

AppArmor is causing Firefox segfaults

I realise this is probably a bad question but I'm stuck. After a lot of googling I'm struggling to fix the problem. I've been trying to get AppArmor to work on Debian. I've been following the ...
2
votes
1answer
789 views

apparmor - cannot load library

I'm trying to get apparmor set up on my system and am having troubles getting past the permission denied error: ping: error while loading shared libraries: libcap.so.2: cannot stat shared object: ...
2
votes
0answers
44 views

AppArmor: make it ask me for decision to allow/disallow

I'm having fun writing AppArmor profile for firefox. I like to open downloaded files directly from firefox (by double-click on it), it is really convenient. But then firefox should have permissions ...
2
votes
0answers
116 views

LXC apparmor profile limits executing scripts in /run/*

LXC is blocking a trusted container from running scripts in /run/*, how do I configure LXC to allow scripts to run here?
2
votes
0answers
140 views

Unable to use aa-genprof without compatibility patch

I run 3.6.10 kernel, It seems like apparmor compatibility patch were dropped in latest kernel, so aa-genprof won't work anymore, any suggestions? Looks like aa-status or other aa- commands were ...
1
vote
2answers
183 views

How to protect against data leak?

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them. However our boss is concerned that someone (upon ...
1
vote
1answer
476 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
1
vote
2answers
1k views

Is AppArmor actively used by Linux Mint 18?

Under my new Linux Mint 18.3 (64 bit) installation on my notebook, the command $ sudo apparmor_status returns the following: apparmor module is loaded. apparmor filesystem is not mounted. Is ...
1
vote
1answer
6k views

How to allow specific Proxmox LXC containers to mount NFS shares on the network?

This question is very similar to How to fix ”mount.nfs: access denied …“ when trying to mount a NFS share exported by a Proxmox 5 machine?. On a Proxmox LXC container I'm trying to mount a NFS share ...
1
vote
2answers
3k views

VirtualBox guest hangs when: Starting Apparmor profiles

I have a Fedora 14. I installed the Ubuntu 11.04 i386 mini.iso in Virtualbox. After install when I reboot it it just hangs with this message: /dev/mapper/vg-root: tiszta, 52354/5103616 fájl, 559633/...
1
vote
1answer
90 views

snapd fails on openSUSE Leap 15.1

I've installed and enabled snappy on my openSUSE Leap 15.1 system according to this documentation: https://snapcraft.io/docs/installing-snap-on-opensuse When adding the repository, I used the one for ...
1
vote
1answer
28 views

Is iteratively adding more AppArmor rules bad?

As far as I know, AppArmor cannot grant privileges to a program that otherwise doesn't have it (i.e. it can only further restrict). Given that, would it be okay to "allow all" for all programs at ...
1
vote
2answers
62 views

I've accidentily deleted /etc/apparmor/, what should I do to restore it?

I accidentally deleted the /etc/apparmor/ folder on my debian 4.19.28-2 box by having the wrong folder selected in a gui file browser. My questions are: Should I be worried? #apparmor_status ...
1
vote
1answer
784 views

What does “ptrace (trace) peer=” mean in AppArmor profile?

I've been writing some AppArmor profiles and with each new profile I encounter more advanced rules that I haven't seen before. In this case I'm creating profile for PulseAudio. I also had a profile ...
1
vote
1answer
51 views

Using apprarmor/grsec to gain capabilities for file

I know that using apparmor, one can reduce process capabilities(7). But is it possible to gain them? For example: ping requires CAP_NET_RAW. It's binary has no suid set and doesn't have any file ...
1
vote
1answer
249 views

Fix this apparmor rule?

I don't really know how to add this rule to the profile, since the name was "wired", it's not some absolute path on my system, kernel: type=1400 audit(1353749970.556:556): apparmor="ALLOWED" ...
1
vote
0answers
18 views

How is the best way to debug an AppArmor syntax error?

Recently I upgraded Debian, from Stretch (v9x) to Buster (v10.2). Now in Thunderbird (package v68.3.0) when I click a link in an email, my browser (FireFox, v71.0, downloaded, i.e. not packaged) ...
1
vote
0answers
47 views

How to to access /sys/bus/usb/devices/ from qemu with AppArmor enabled? (“Cannot Open File” and “Cannot read serial from…”)

I'm trying to access an USB device with AQEMU. For this I have added an USB port in the media options. But when starting the virtual machine I'm getting these errors: AQEMU Warning [..] >>> ...
1
vote
0answers
18 views

Crtl-C does not kill AppArmour and namespace sandboxed process

Given this AppArmour profile (intended to avoid manipulation of git repositories): /RISC_OS { signal, ptrace, unix, network, / mrixwlk, /** mrixwlk, deny /**/.git** wl, deny /**/refs/...
1
vote
0answers
91 views

Sudenly, firefox is not opening at Parrot OS

I was using few times Parrot OS live booted from RAM or USB as well. Firefox is the web browser built in and my favourite by the way, so I used it. Unfortunatelly is not working properly anymore. I ...
1
vote
1answer
90 views

Why is apparmor logging ALLOWED cases for LibreOffice?

I'm using Devuan Beowulf (~= Debian Buster). I'm seeing quite a few /var/log/messages messages involving apparmor, e.g.: Oct 29 12:05:20 my_host_name kernel: [232254.998790] audit: type=1400 audit(...