I have a custom AppArmor profile to confine Syncthing. (I realise that this might not be a specific Ubuntu question, but I only use Ubuntu so I haven't seen if this affects other Linux distros).

This is the profile:

#include <tunables/global>

/usr/bin/syncthing {
  #include <abstractions/base>

  # Obviously needs Internet access to work.
  network raw,
  network inet,
  network inet6,

 # Access to execute binary
  /usr/bin/syncthing cx,

  # Wants read access to SOMAXCONN
  /proc/sys/net/core/somaxconn r,

  # Needs to be able to read these to work properly
  /run/resolvconf/resolv.conf r,
  /etc/hosts r,
  /etc/host.conf r,
  /etc/nsswitch.conf r,
  /etc/ssl/certs/** r,
  /etc/mime.types r,
  /etc/gai.conf r,

  # Allow access to synced folders.
  owner @{HOME}/Documents/ rw,
  owner @{HOME}/Documents/** rwk,
  owner @{HOME}/Pictures/ rw,
  owner @{HOME}/Pictures/** rwk,
  owner @{HOME}/Public/ rw,
  owner @{HOME}/Public/** rwk,
  owner @{HOME}/Music/ rw,
  owner @{HOME}/Music/** rwk,
  owner @{HOME}/Downloads/ rw,
  owner @{HOME}/Downloads/** rwk,
  owner @{HOME}/.keys/ rw,
  owner @{HOME}/.keys/** rwk,

  # Allow access to config files
  owner @{HOME}/.config/syncthing/ rw,
  owner @{HOME}/.config/syncthing/** rwk,

  # Silence warnings on things we don't want access to
  deny / r,
  deny /* r,
  deny @{HOME} r,


And this is the syslog message I've been getting recently:

Apr 16 11:07:05 supercomputer kernel: [ 1240.879568] audit: type=1400 audit(1460768825.434:31): apparmor="DENIED" operation="open" profile="/usr/bin/syncthing" name=2F686F6D652F7365616E2F566964656F732F43616D65726120566964656F732F pid=2277 comm="syncthing" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Apr 16 11:16:28 supercomputer kernel: [ 1803.632950] audit: type=1400 audit(1460769388.508:32): apparmor="DENIED" operation="open" profile="/usr/bin/syncthing" name=2F686F6D652F7365616E2F566964656F732F43616D65726120566964656F732F pid=2266 comm="syncthing" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Apr 16 11:26:13 supercomputer kernel: [ 2388.037482] audit: type=1400 audit(1460769973.246:33): apparmor="DENIED" operation="open" profile="/usr/bin/syncthing" name=2F686F6D652F7365616E2F566964656F732F43616D65726120566964656F732F pid=1021 comm="syncthing" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Apr 16 11:36:56 supercomputer kernel: [ 3031.177125] audit: type=1400 audit(1460770616.751:34): apparmor="DENIED" operation="open" profile="/usr/bin/syncthing" name=2F686F6D652F7365616E2F566964656F732F43616D65726120566964656F732F pid=2273 comm="syncthing" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000

Since I made the profile myself, I've become relatively familiar with AppArmor and the logs that it produces - but I've never seen this name=2F686F6D652F7365616E2F566964656F732F43616D65726120566964656F732F message before. It doesn't look to be a filepath, which is what AppArmor normally reports on.

What does this error message mean? How can I either allow it or deny it in the profile?

  • This message means that apparmor denied read access to /usr/bin/syncthing. Try to add r flag: /usr/bin/syncthing cxr, and reload profile sudo apparmor_parser -r /etc/apparmor.d/usr.bin.syncthing – EdiD Apr 17 '16 at 8:40
  • If it were denying access to /usr/bin/syncthing, wouldn't it say name=/usr/bin/syncthing? – seanlano Apr 18 '16 at 4:35
  • Would it make sense to commit a version of that apparmor profile upstream? – unhammer Dec 16 '16 at 9:39
  • Does Syncthing have an upstream AppArmor profile? – seanlano Dec 17 '16 at 22:39

The hex string following "name=" is just a hex-encoded string of the path of the file you're looking for. If you copy your hex string into the http://www.asciitohex.com/ in the "hexadecimal" box (or many equivalent sites) and click convert to get the original string back. I won't post the exact string here to preserve your privacy -- just in case it matters.

If you don't want to use a third-party website, you can run a python shell and do the following:

x="2F.... (your string here)"
''.join(chr(int(x[i:i+2], 16)) for i in range(0, len(x), 2))

I encountered this on Debian too. I don't know why this happens.

  • 1
    Thank you so much! I would have never figured that out, it makes perfect sense now. The path name doesn't bother me - /home/sean/Videos/Camera Videos/ is what it came out to be. Which, looking at it, isn't allowed in the AppArmor profile. – seanlano May 6 '16 at 5:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.