4

I tried to open a pdf in my external HD with Evince (pdf reader), but apparmor denied. Then I tried to find Evince's profile to add a link to it in /etc/apparmor.d/disable in order to disable the profile. I used the command
aa-status
to find the profile. It shows:
snap.evince.evince

The apparmor manual page explains that some in the profiles list generated by the former command, the slashes are replaced by dots, so I tried to find /snap/evince/evince; it does not exist.

Then I tried to set the evince profile to "complain", instead of "enforce", using this command:
sudo aa-complain snap.evince.evince

Result:
Can't find snap.evince.evince in the system path list. If the name of the application is correct, please run 'which snap.evince.evince' as a user with correct PATH environment set up in order to find the fully-qualified path and use the full path as parameter.

I tried do use which and whereis to find the profile, but it was of no avail.

Then I used these commands:
sudo systemctl stop apparmor
sudo systemctl disable apparmor

I tried to open a pdf file with Evince, but AppArmor denied it. I rebooted and I am in the same situation.

Can I disable all profiles at once?
Can I disable a specific profile by any other mean?

P.S - I am asking this question because removing apparmor makes snap unusable, which is very counterproductive.
Thanks in advance.
I am using Ubuntu Budgie 20.04. LTS

Improve this question
3
  • did you try to disable apparmor via the kernel command line in grub? use apparmor=0 in /etc/default/grub.
    – Doug Smythies
    Apr 27, 2020 at 22:10
  • 1
    Does this answer your question? Boot hangs indefinitely on a start job
    – Raffa
    Apr 27, 2020 at 22:13
  • I read quite a lot about apparmor and found that for the moment best choice for me is not disabling the complete service, but to put a profile in complain mode, meaning that this profile will not affect anymore the operation in question, but will just log it. In my case it was mysqld, so I ran sudo aa-complain /usr/sbin/mysqld. Initially command was not working, so I found that I need to install apparmor utils with sudo apt-get install apparmor-utils.
    – Ivaylo
    Sep 4, 2022 at 22:11

1 Answer 1

Reset to default
4

You can execute command sudo aa-teardown. Here works like a charm.

Improve this answer
4
  • 1
    what is the drawback of disabling this?
    – Sadra
    Jul 14, 2022 at 18:04
  • All your services will be opened and another disk areas can be reached. This can be a serious security hazard.
    – Valtoni Boaventura
    Sep 8, 2022 at 16:00
  • And what is the command to enable AppArmor again after using aa-teardown?
    – baptx
    Nov 3, 2022 at 19:00
  • apparmor is so bad, there really is no security risk, by the way - it is not like Selinux
    – france1
    Mar 25 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.