Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I understand there is a safer, more targeted way to troubleshoot AppArmor's possible contribution to an issue than completely stopping the service and tearing down AppArmor profiles. Can someone give me the details, and the advantages of the better approach?

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

Here's what I was thinking of (from https://wiki.ubuntu.com/DebuggingApparmor ) -- "complain mode" . This doesn't address the issue of relative merits or consequences of this versus other debugging methods.

When debugging, it may also be useful to put apparmor into 'complain' mode. This will allow your application to function normally while apparmor reports accesses that are not in the profile. To enable 'complain' mode, use:

sudo aa-complain /path/to/bin

where '/path/to/bin' is the absolute path to the binary, as reported in the 'profile=...' portion of the 'audit' entry. Eg:

sudo aa-complain /usr/sbin/slapd

To re-enable enforcing mode, use 'aa-enforce' instead:

sudo aa-enforce /path/to/bin

To disable a profile:

sudo touch /etc/apparmor.d/disable/path.to.bin
sudo apparmor_parser -R /etc/apparmor.d/path.to.bin

When troubleshooting then, if there is something broken that appears to be related to a spooky permissions problem ('Hmm, looks like access control, but it's not a Unix permissions problem, or an NFS issue, or PAM issue, or a media mounting goof, etc. -- perhaps it's AppArmor.'), Kees Cook points out that best course of action is too check your system logs. Notably, per Kees Cook, "the output of dmesg will report all AppArmor denials, and will include the profile."

share|improve this answer
1  
The output of dmesg will report all AppArmor denials, and will include the profile. It is not needed to ever guess at whether AppArmor is responsible or not. Either there was a denial in the logs and you can disable that profile, or there wasn't. :) –  Kees Cook Jan 29 '11 at 3:56
    
@Kees -- Brilliant, thanks. So I only have to guess if I don't know what I'm doing. Ha. I'll update my answer. –  belacqua Jan 29 '11 at 4:13
    
@Kees -- I guess there is still a chance (in some possible universe) that the kernel, LSM subsystem, or AppArmor itself could have out-of-spec behavior (i.e., a bug). Which might be tested with service tear... no, no, even in that vanishingly small spot of possible reality where this might occur, it would probably be better just to open a bug report. –  belacqua Jan 29 '11 at 4:38
    
Note that in natty, you can disable a specific profile with the aa-disable(1) command. –  Steve Beattie Apr 1 '11 at 2:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.