How do I block Internet for an app using an apparmor custom profile?

Question

I'm trying to block internet access for an app because it always asks for purchase or update even though it's free. I created an apparmor profile for that app and enforced it but after enforcing, the app is not starting.

This is the profile in /etc/apparmor.d/opt.sublime_text.sublime_text:

/opt/sublime_text/sublime_text {

        deny network inet,
        deny network inet6,
        deny network raw,  #include <abstractions/base>

        /opt/sublime_text/sublime_text mr,
        /opt/sublime-text/ rw,
        /home/shady/.config/sublime-text-3/ rw,
}

I included the directories that this app may need. What am I doing wrong?

Answer 1

You need much more to launch this type of app. When there is something missing in your profile it has no access to it. Sublimetext must have access to things like :

• X server
• system fonts
• Xauthority file
• dconf
• glib
• etc ...

The best and easiest way to create your own profile is to install apparmor-utils

sudo apt-get install apparmor-utils

then create your profile using generate profile tool:

sudo aa-genprof /opt/sublime_text/sublime_text  

In this moment it creates sublimetext profile in /etc/apparmor.d/ and is listening for program actions. This profile is in complain mode and it is logging to /var/log/syslog. Now you need to launch your sublimetext and make some actions like opening and saving files, etc.. all this acions will be saved in log file which is used by aa-genproffor creating rules. When you are done with activities hit s key and answer for questions about access or deny to your resources. When done use f key for saving your newly created profile and turning it to enforce mode.

---

However it is quite easy this tool is not working perfectly. It will not include everything and you must add something manually like access to X
In /etc/apparmor.d/opt.sublime_text.sublime_text:

include <abstractions/X>  

If any changes were made you have to reload config file:

sudo apparmor_parser r /etc/apparmor.d/opt.sublime_text.sublime_text