I have a problem with IPSec. After debugging, I found this message in dmesg:

apparmor=“DENIED” operation=“create” profile=“/usr/lib/ipsec/charon” ..... requested_mask=“create” denied_mask=“create”

I tried to edit /etc/apparmor.d/usr.lib.ipsec.charon, and give /usr/lib/ipsec/charon Permession: rwmix But the problem still there. Any solution?


You can try to set charon to complain mode.

Do sudo aa-status to see if /usr/lib/ipsec/charon is in enforce mode. Set it to complain by doing
sudo aa-complain /usr/lib/ipsec/charon

  • Thanks for your reply. I check charon status, and it in enforce mode. I tried to make it in complain using aa-complain, but aa-complain in “apparmor-utils” which not installed in my device. And I don’t have any access to the internet in that device to install it via apt. So does there any another way to make profile in complain mode without needed to connect to the internet? Thanks again. – Post Nerdism Aug 22 '19 at 13:31
  • @PostNerdism Make a backup copy of /etc/apparmor.d/usr.lib.ipsec.charon Edit your /etc/apparmor.d/usr.lib.ipsec.charon file with your favorite editor. In this file, you should see one of the first lines that says profile /usr/lib/ipsec/charon or something similar. After the charon part, add a flag, so it looks like profile /usr/lib/ipsec/charon flags=(complain) {, then restart apparmor. – maik Aug 22 '19 at 14:36
  • Thanks. It works in complain mode now. But that doesn't affect the problem. As I read about complain mode, it not enforce any rule to the profile. And as I know, that mean all operations that the software can do, but still the problem there. – Post Nerdism Aug 29 '19 at 7:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.