6

I tried to open a pdf in my external HD with Evince (pdf reader), but apparmor denied. Then I tried to find Evince's profile to add a link to it in /etc/apparmor.d/disable in order to disable the profile. I used the command
aa-status
to find the profile. It shows:
snap.evince.evince

The apparmor manual page explains that some in the profiles list generated by the former command, the slashes are replaced by dots, so I tried to find /snap/evince/evince; it does not exist.

Then I tried to set the evince profile to "complain", instead of "enforce", using this command:
sudo aa-complain snap.evince.evince

Result:
Can't find snap.evince.evince in the system path list. If the name of the application is correct, please run 'which snap.evince.evince' as a user with correct PATH environment set up in order to find the fully-qualified path and use the full path as parameter.

I tried do use which and whereis to find the profile, but it was of no avail.

Then I used these commands:
sudo systemctl stop apparmor
sudo systemctl disable apparmor

I tried to open a pdf file with Evince, but AppArmor denied it. I rebooted and I am in the same situation.

Can I disable all profiles at once?
Can I disable a specific profile by any other mean?

P.S - I am asking this question because removing apparmor makes snap unusable, which is very counterproductive.
Thanks in advance.
I am using Ubuntu Budgie 20.04. LTS

Improve this question
3
  • did you try to disable apparmor via the kernel command line in grub? use apparmor=0 in /etc/default/grub.
    – Doug Smythies
    Commented Apr 27, 2020 at 22:10
  • 1
    Does this answer your question? Boot hangs indefinitely on a start job
    – Raffa
    Commented Apr 27, 2020 at 22:13
  • I read quite a lot about apparmor and found that for the moment best choice for me is not disabling the complete service, but to put a profile in complain mode, meaning that this profile will not affect anymore the operation in question, but will just log it. In my case it was mysqld, so I ran sudo aa-complain /usr/sbin/mysqld. Initially command was not working, so I found that I need to install apparmor utils with sudo apt-get install apparmor-utils.
    – Ivaylo
    Commented Sep 4, 2022 at 22:11

1 Answer 1

Reset to default
5

If you execute the command sudo aa-teardown, then this will unload all AppArmor profiles. It works like a charm.

Improve this answer
5
  • 1
    what is the drawback of disabling this?
    – Sadra
    Commented Jul 14, 2022 at 18:04
  • All your services will be opened and another disk areas can be reached. This can be a serious security hazard.
    – Valtoni Boaventura
    Commented Sep 8, 2022 at 16:00
  • And what is the command to enable AppArmor again after using aa-teardown?
    – baptx
    Commented Nov 3, 2022 at 19:00
  • apparmor is so bad, there really is no security risk, by the way - it is not like Selinux
    – france1
    Commented Mar 25, 2023 at 13:31
  • aa-teardown can cause issues if your application uses hats (change_hat). With the AppArmor profile unloaded, the application will be attempting to use a non-existent hat, which will be denied by AppArmor. I've been bitten by this in PHP-FPM.
    – Ondra Simek
    Commented Mar 31 at 12:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .