AppArmor is a Linux Security Module

learn more… | top users | synonyms

73
votes
3answers
16k views

What is apparmor?

I hear a lot of talk about apparmor, I want to know the following: What is apparmor? How does apparmor work?
30
votes
15answers
61k views

Can't start mysql - mysql respawning too fast, stopped

Today I did a fresh install of ubuntu 12.04 and went about setting up my local development environment. I installed mysql and edited /etc/mysql/my.cnf to optimise InnoDB but when I try to restart ...
18
votes
2answers
2k views

Is it a bad idea to run SELinux and AppArmor at the same time?

My corporate policy says that Linux boxes must be secured with SELinux (so that a security auditor can check the 'yes, we're extremely secure!' checkbox for each server). I had hoped to take ...
16
votes
6answers
29k views

How to secure ubuntu server from bruteforce ssh attacks?

I have my passwords secure, but I heard people complaining about perfomance of a server going down drastically when a bruteforce attack is taking place. How can I secure my ubuntu 10.10 server from ...
15
votes
2answers
3k views

How can I tell that apparmor is working?

Some questions I want answered in the answer: How do I know if apparmor is running? How can I tell if it's working well?
11
votes
1answer
1k views

How do you permanently activate all AppArmor profiles?

I want all the AppArmor profiles activated wherever applicable permanently, how can I do that?
8
votes
1answer
17k views

How to allow bind in app armor?

Question: I did setup bind9 as described here: http://ubuntuforums.org/showthread.php?p=12149576#post12149576 Now I have a little problem with apparmor: If I switch it off, it works. If apparmor ...
8
votes
1answer
2k views

AppArmor denying a mount operation

How do I convince apparmor to allow this operation? [28763.284171] type=1400 audit(1344273461.387:192): apparmor="DENIED" operation="mount" info="failed type match" error=-13 parent=7101 profile="lxc-...
7
votes
2answers
468 views

How does AppArmor deal with non-profiled Programs?

I setup and configured AppArmor in Ubuntu and I would like to know how AppArmor deals with Packages and Applications which have no AppArmor Profile? After installing the package with sudo apt-get ...
6
votes
1answer
3k views

apt-get hang at Rsyslog

When I try to install something, there is a hang, I don't know if it's a bug or something else... root@computer:~# apt-get install Reading package list... Done Building dependancy tree Reading state ...
6
votes
1answer
750 views

Is troubleshooting AppArmor with 'teardown' unsafe?

I understand there is a safer, more targeted way to troubleshoot AppArmor's possible contribution to an issue than completely stopping the service and tearing down AppArmor profiles. Can someone give ...
6
votes
2answers
1k views

What does Firefox AppArmor restrict/allow?

I know the AppArmor profiles resides in /etc/apparmor.d/, but I do not know how to interpret it. Any translation would be enlightening.
6
votes
1answer
609 views

Can apparmor restrict interpreted languages?

For interpreted/vm languages(e.g. python, java, shell scripts) can apparmor be set to only confine a particular script or program? If so, how?
5
votes
3answers
10k views

Unable to start mysql server after update

Today I updated the system, and I cant start the mysql server: I'm getting the following error: Aug 14 14:32:09 VULTURUS kernel: [ 1996.413190] init: mysql main process (14122) terminated with ...
5
votes
2answers
547 views

How to prevent users from installing non-free software?

Is it possible to disable installation of non-free or proprietary softwares and applications in Ubuntu?
5
votes
2answers
4k views

Contain Docker Engine with AppArmor

In face of the reminders that the Docker Engine should be run contained with AppArmor or SELinux, how to run Docker under AppArmor on Ubuntu 14.04? The Docker Security documentation and the LXC ...
5
votes
1answer
178 views

How do I create a default fallback profile for any process that doesn't have one in AppArmor?

Is there a way to specify a default profile on any executable that doesn't have a profile already defined? The idea is to avoid any unconstrained processes.
5
votes
1answer
695 views

File access: open fails for one program but not another

This is the most unusual thing. I'm trying to start up mysqld with a different my.cnf (so I can have two MySQL daemons running without conflict). The file is /etc/mysql/my2.cnf but mysql won't open it....
5
votes
1answer
368 views

Apparmor has hats like null-12b08

I am running a Ubuntu 12.04.2 server with Apache using mod_apparmor. When I run aa-status, I see thousands and thousands (seriously, over 100,000) of profiles with names like /usr/lib/apache2/mpm-...
4
votes
1answer
3k views

Where do I get the AppArmor 2.4 compatibility patch?

I just compiled the 2.6.39-rc1 kernel and AppArmor complains about a missing /sys interface (plus, it slows down the boot). Where do I get the AppArmor 2.4 compatibility patch AppArmor asks for?
4
votes
1answer
1k views

Anyway to use Skype in AppArmor?

Ubuntu 14.04 and Skype 4.2 installed. I've set up AppArmor using the Skype AppArmor profile from this wiki. When I use AppArmor with Skype, it has no audio. Is anyone using AppArmor successfully with ...
4
votes
1answer
293 views

AppArmor Error: “invalid VM definition” after starting lxc on updated version of libvirt (1.2.12)

I am trying to start an LXC on a newer version of libvirtd but it fails to start with the following error: $ virsh -c lxc: start textlxc error: Failed to start domain testlxc error: internal error: ...
4
votes
1answer
92 views

Browsing nautilus folder containing a dvi file — apparmor/evince error

If a browse a nautilus folder that contains a .dvi file, I get errors that pop onto my screen: I think that this is due to the thumbnailer processing the file. I don't care about getting ...
4
votes
1answer
98 views

How is the guest account prevented from using su and sudo?

It's already known that the guest account can't use su or sudo: Why is su disabled from guest sessions? Sudo not available in guest login How is this done? My guess would be apparmor. However, ...
4
votes
1answer
384 views

Preventing a specific application from accessing a folder

I just installed an application that has the bad habit of automatically scanning all my folders for files to edit. The app has no available options to disable this behavior. I cannot just remove read/...
3
votes
2answers
1k views

Where could I get the apparmor profile for latest Skype4?

Where could I get the apparmor profile for latest Skype4? I tried to make my own based on previous skype version but there are too many errors while launching.
3
votes
1answer
51 views

How do I block Internet for an app using an apparmor custom profile?

I'm trying to block internet access for an app because it always asks for purchase or update even though it's free. I created an apparmor profile for that app and enforced it but after enforcing, the ...
3
votes
2answers
5k views

Why do I have to enable the AppArmor profile for Firefox? Why isn't it “on” by default?

I have a pretty standard default install of 11.10 (Unity 3D). I'm trying to understand a bit about AppArmor. sudo aa-status shows me that the available Firefox profile isn't being enforced (since it ...
3
votes
1answer
170 views

AppArmor blocks logging set up through iptables for guest account - How to enable?

To log the internet usage (visited URLs) of my local guest account, I asked the question Monitor visited websites of guest account through any browser and after assigning the guest account the fixed ...
3
votes
0answers
161 views

How can I allow macchanger to run on ubuntu touch/apparmor?

I'm trying to run macchanger from the terminal application of an ubuntu touch device to avoid unscrupulous 3rd parties(i.e. wifi providers) from tracing my mac address. However it fails miserably with ...
3
votes
0answers
449 views

How to use Firefox AppArmor profile with IcedTea Java plugin on Ubuntu 14.04?

Whenever I set up Ubuntu on a new system, I active the default AppArmor profile for Firefox via sudo aa-enforce /etc/apparmor.d/usr.bin.firefox Doing this on Ubuntu 14.04, however, makes Java ...
3
votes
2answers
742 views

Tor not working after update

Yesterday I updated my Ubuntu 14.04 LTS and after that Tor stopped working : When I try to run Tor using command sudo service tor start it gives an error aa-exec: ERROR: profile 'system_tor' does ...
3
votes
0answers
428 views

Another apparmor / mysql wont install

I am trying to config another instance of mysql on my present but i can't mysql_install_db --user=mysql --datadir=/var/lib/mysql2 Installing MySQL system tables... ERROR: 1005 Can't create table '...
2
votes
2answers
79 views

Permissions for thumbnailer on device

I'm developing an application for U-Touch that gets a thumbnail from a video in C++ code using libthumbnailer system library. The app does the thumbnailing perfectly in my computer, but when i try to ...
2
votes
1answer
4k views

How to fix apparmor=“DENIED” for telepathy-mission-control-5 under Ubuntu 14.04?

Just installed Ubuntu 14.04 LTS a week ago and a few programs for my work & fun: nginx server, rabbitmq server, mysql server php-fpm, hhvm sublime-text, mysql workbench hplib (for printer/...
2
votes
2answers
544 views

Apparmor problem: Icedtea plugin freezes firefox (35.0.1)

EDIT5: finally it's probably is an Apparmor problem. /usr/lib/firefox/firefox{,*[^s][^h]} is indeed in complain mode, but /usr/lib/firefox/firefox{,*[^s][^h]}//browser_java /usr/lib/firefox/...
2
votes
2answers
354 views

How to get back the firefox apparmor profile after deleting it?

I deleted the apparmor profile for firefox when I was tinkering with it... And now I can't get it back. I uninstalled (complete) the apparmor program, profiles, etc. And when it reinstalled, I ...
2
votes
1answer
6k views

Mysql on Ubuntu 14.04 problem with AppArmor permissions for data directory

I've been using MySQL with a different location for the database date since Ubuntu 12.04 and had no problems. My configuration was like this: Data in /home/db/mysql Link in the default location sudo ...
2
votes
1answer
110 views

U1DB problems with apparmor

I'm having problem with u1db and apparmor. The application works fine, but when it is packaged apparmor does not allow the app to save data into $HOME/.local/share/.. so I can't actually save my ...
2
votes
1answer
728 views

How to display AppArmor denied messages as desktop notifications

How can I get live notifications on my desktop whenever an AppArmor denied message is triggered?
2
votes
1answer
3k views

Having problems getting Samba4 and Bind9 working together because of apparmor

So I've been following the Samba4 HOWTO, which has gone reasonably well. The issue I'm having is I can't get BIND9 to restart when the samba configuration is included in /etc/bind/named.conf.local: ...
2
votes
2answers
6k views

How to re-enable a disabled standard user account?

Disabled a standard user account but did not opt to delete files. Later, tried to enable the account. At that time, a password had to be selected so entered a different one from the earlier one. Now, ...
2
votes
1answer
1k views

Ubuntu 15.10. Failed to start LSB: AppArmor initialization

I recently updated to Ubuntu 15.10. I am now getting a failed boot with the following message: Failed to start LSB: AppArmor initialization How can I further diagnose and fix this problem?
2
votes
1answer
35 views

Sporadic messages output to console after logging in

Coming right from a fresh install of Ubuntu 14.04 Minimal/Netboot (plus some small utilities like acpid, wicd-curses, etc.), after logging in, I occasionally get floating messages (the kind typically ...
2
votes
1answer
439 views

the aa-enforce command for apparmor results in a “command not found” error

I am trying to enable the apparmor profile for firefox, but when i enter sudo aa-enforce /etc/apparmor.d/usr.bin.firefox i get a aa-enforce command not found message. apparmor_status indicates ...
2
votes
1answer
296 views

Ubuntu Touch Development: DBus connection via apparmor-template=unconfined?

I am trying to send DBus messages via Ubuntu Touch C++ application. With configuring default template (no error with unconfined) for Apparmor file my application is getting following error as reply: ...
2
votes
1answer
149 views

apparmor aa-logprof not asking about all dependencies

In trying to write an apparmor profile for my python-flask app (which executes via gunicorn) I can't get aa-logprof to ask me about all the dependencies. If in complain mode the application works as ...
2
votes
1answer
1k views

How to fix AppArmor `could not open` error when installing php+mysql?

I want to install php5-imap php5-ldap php5-curl sudo apt-get install php5-imap php5-ldap php5-curl I get this error: AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld in /etc/apparmor.d/...
2
votes
1answer
1k views

Apparmor not starting with kernel LSM error [closed]

Starting apparmor on a Ubuntu Lucid Lynx gives the following: user@host:~$ sudo /etc/init.d/apparmor start * Starting AppArmor profiles * AppArmor not available as kernel LSM. ...fail! ...
2
votes
1answer
235 views

AppArmor denial when trying to open file using content hub

When trying to open a file using content hub using C++ I get these errors: Opening with peer com.ubuntu.music_music_2.1.857 Sdk-Launcher> Application was resumed Sdk-Launcher> There has been a ...