0

I have a problem with IPSec. After debugging, I found this message in dmesg:

apparmor=“DENIED” operation=“create” profile=“/usr/lib/ipsec/charon” ..... requested_mask=“create” denied_mask=“create”

I tried to edit /etc/apparmor.d/usr.lib.ipsec.charon, and give /usr/lib/ipsec/charon Permession: rwmix But the problem still there. Any solution?

Improve this question

1 Answer 1

Reset to default
0

You can try to set charon to complain mode.

Do sudo aa-status to see if /usr/lib/ipsec/charon is in enforce mode. Set it to complain by doing
sudo aa-complain /usr/lib/ipsec/charon

Improve this answer
3
  • Thanks for your reply. I check charon status, and it in enforce mode. I tried to make it in complain using aa-complain, but aa-complain in “apparmor-utils” which not installed in my device. And I don’t have any access to the internet in that device to install it via apt. So does there any another way to make profile in complain mode without needed to connect to the internet? Thanks again.
    – Post Nerdism
    Aug 22, 2019 at 13:31
  • @PostNerdism Make a backup copy of /etc/apparmor.d/usr.lib.ipsec.charon Edit your /etc/apparmor.d/usr.lib.ipsec.charon file with your favorite editor. In this file, you should see one of the first lines that says profile /usr/lib/ipsec/charon or something similar. After the charon part, add a flag, so it looks like profile /usr/lib/ipsec/charon flags=(complain) {, then restart apparmor.
    – maik
    Aug 22, 2019 at 14:36
  • Thanks. It works in complain mode now. But that doesn't affect the problem. As I read about complain mode, it not enforce any rule to the profile. And as I know, that mean all operations that the software can do, but still the problem there.
    – Post Nerdism
    Aug 29, 2019 at 7:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .