Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Ubuntu 14.04 and Skype 4.2 installed. I've set up AppArmor using the Skype AppArmor profile from this wiki. When I use AppArmor with Skype, it has no audio. Is anyone using AppArmor successfully with the latest Skype? How can I make this work?

UPDATE:
The profile below is what I now use successfully. I commented out a few permissions that I think Skype shouldn't have. If you have problems with this profile, then try removing all hashes (#) after line 15, and reload the profile with apparmor_parser -r /etc/apparmor.d/usr.bin.skype.

# Last Modified: Tue Jun 24 05:59:42 2014
#include <tunables/global>

/usr/bin/skype {
  #include <abstractions/audio>
  #include <abstractions/consoles>
  #include <abstractions/dbus-session>
  #include <abstractions/gnome>
  #include <abstractions/kde>
  #include <abstractions/nameservice>
  #include <abstractions/video>

  deny /sys/devices/virtual/dmi/** r,
  deny owner @{HOME}/docker** r,
  deny owner @{HOME}/.mozilla/ r,
  deny owner @{HOME}/.mozilla/** r,

#  /dev/ r,
  /dev/video[0-9]* mrw,
#  /etc/ r,
  /etc/asound.conf r,
  /etc/machine-id r,
  /etc/xdg/Trolltech.conf r,
#  /etc/xdg/Trolltech.conf rk,
  /etc/xdg/sni-qt.conf r,
#  /etc/xdg/sni-qt.conf rk,
  /sys/devices/pci*/*/usb[0-9]*/*/{idVendor,idProduct,speed} r,
  /sys/devices/system/cpu/cpu[0-9]*/cpufreq/scaling_{cur_freq,max_freq} r,
#  /tmp/** rwlk,
  /usr/bin/kde4-config mrPUx,
  /usr/bin/skype mrix,
  /usr/bin/xdg-open mrPUx,
  /usr/lib{,32}/libv4l/v4l2convert.so r,
#  /usr/lib{,32}/libv4l/v4l2convert.so mr,
  /usr/lib{,32}/skype/skype mrix,
  /usr/share/icons/*/index.theme r,
#  /usr/share/icons/*/index.theme rk,
  /usr/share/nvidia/nvidia-application-profiles-*-rc r,
#  /usr/share/skype/ r,
  /usr/share/skype/** r,
#  /usr/share/skype/lib/libQtWebKit.so.4 mr,
  /{run,dev}/shm/pulse-shm* r,
#  /{run,dev}/shm/pulse-shm* rwk,
#  /home/ r,
  owner @{HOME}/ r,
  owner @{HOME}/.Xauthority r,
  owner @{HOME}/.cache/fontconfig/* r,
  owner @{HOME}/.kde/** r,
  owner @{HOME}/.Skype/ r,
  owner @{HOME}/.Skype/** rwk,
  owner @{HOME}/.config/Skype/ r,
  owner @{HOME}/.config/Skype/** rwk,
  owner @{HOME}/.config/Trolltech.conf r,
#  owner @{HOME}/.config/Trolltech.conf rwk,
  owner @{HOME}/.config/fontconfig/fonts.conf r,
  owner @{HOME}/.config/gtk-3.0/bookmarks r,
  owner @{HOME}/.config/oxygen-gtk/argb-apps.conf r,
#  owner @{HOME}/.config/oxygen-gtk/argb-apps.conf rw,
  owner @{HOME}/.config/pulse/cookie r,
#  owner @{HOME}/.config/pulse/cookie rwk,
  owner @{HOME}/.icons/** r,
  owner @{HOME}/.kde4/share/config/gtkrc-2.0 r,
  owner @{HOME}/.kde4/share/config/kdeglobals r,
#  owner @{HOME}/.kde4/share/config/kdeglobals rwk,
  owner @{HOME}/.kde4/share/config/oxygenrc r,
  owner @{HOME}/Downloads/ r,
  owner @{HOME}/Downloads/** rw,
  owner @{PROC}/[0-9]*/cmdline r,
  owner @{PROC}/[0-9]*/fd/ r,
  owner @{PROC}/[0-9]*/status r,
  owner @{PROC}/[0-9]*/task/ r,
  owner @{PROC}/[0-9]*/task/[0-9]*/stat r,
  @{PROC}/*/net/route r,
  @{PROC}/[0-9]*/net/arp r,
  @{PROC}/sys/kernel/{ostype,osrelease} r,
  @{PROC}/sys/vm/overcommit_memory r,
}
share|improve this question
    
I'm curious, what exact steps did you follow to enable this profile? –  Seth Jun 23 at 20:12
    
@Seth I put the info in the file /etc/apparmor.d/usr.bin.skype and cat /etc/apparmor.d/usr.bin.skype | apparmor_parser -a (and -r to reload) –  Sepero Jun 23 at 20:16
    
And this is Skype 4.2 not 4.3? And you get audio when disable the AA profile? –  Seth Jun 23 at 20:18
    
@Seth Yes and yes. It is skype:i386 (version 4.2) from the canonical partner repository. –  Sepero Jun 23 at 20:19
    
@Sepero, thank you for a working AppArmor profile for Skype 4.3 –  utapyngo Aug 25 at 15:17

1 Answer 1

up vote 2 down vote accepted

You will have to manually review and debug they Apparmor Profile you copied from Arch. My guess is that you can review and make a few (minor) changes.

If you can not do this, then I suggest you put the profile into complain mode and run aa-logprof

sudo aa-complain /etc/apparmor.d/usr.bin.skype

Open and use Skype. Close Skype.

Then run aa-logprof

sudo aa-logprof

Review and accept the changes.

I suggest you review the final profile ;)

Then re-enable the profile

sudo aa-enforce /etc/apparmor.d/usr.bin.skype

See:

https://help.ubuntu.com/community/AppArmor

https://wiki.ubuntu.com/DebuggingApparmor

share|improve this answer
    
I did like you said, and to really be sure, I enabled almost everything aa-complain requested. It's working now. Hopefully I can figure out exactly why I was having the issue before. :) –  Sepero Jun 24 at 10:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.