Questions tagged [apparmor]
AppArmor is a Linux Security Module
331
questions
0
votes
3
answers
1k
views
Unable to launch evince
When launching evince, I get this error:
EvinceDocument-WARNING **: 10:14:16.337: Error opening directory “/usr/lib/x86_64-linux-gnu/evince/4/backends”: Permission denied
I have already put evince ...
- 101
0
votes
0
answers
17
views
New to apparmor- why are all downloaded appoarmor prifiles blanc?
background: I'm on Ubuntu 20.04.03 LTS and looking for "how to make my next installation more secure". I am interested in a topic that often relies on third party- and maybe older/not well ...
- 63
0
votes
1
answer
26
views
How to fix Foliate 3 unable to open any epub file after recent update?
After the recent update, the Foliate ebook reader cannot open ebooks anymore (in both APT and Snap versions).
This issue seems to occur in Ubuntu 22.04 with snap, as well as in Ubuntu 24.04 (daily ...
- 28.5k
2
votes
2
answers
158k
views
What does it means: Warning from XXX: apparmor_parser: File 'XXX' missing feature abi, falling back to default policy feature abi
After a dist upgrade, I get a lot of warnings like this one:
Warning from /etc/apparmor.d/sbin.dhclient (/etc/apparmor.d/sbin.dhclient line 4): apparmor_parser: File '/etc/apparmor.d/sbin.dhclient' ...
CommunityBot
- 1
0
votes
0
answers
57
views
snap causes the shell to freeze upon login
Since the past 2~3 days I'm experiencing a bad slowdown when I login in 22.04.4.
I have HWE enabled and using Nvidia 550.54.14 (latest Stable binaries - installed via Proprietary GPU Drivers ppa)
The ...
- 636
0
votes
1
answer
87
views
How can I parse apparmor profile?
I want to see the restrictions of apparmor for dhclient for example
I tried to run
apparmor_parser -p /sys/kernel/security/apparmor/policy/profiles/usr.sbin.dhclient.6/raw_data
I got :
AppArmor ...
2
votes
2
answers
3k
views
Snap/Apparmor stopped working in Ubuntu 22.04
I can no longer update snap apps on Ubuntu 22.04. If I try to refresh firefox I get:
$ sudo snap refresh firefox
error: cannot perform the following tasks:
- Setup snap "firefox" (2277) ...
- 14.6k
8
votes
3
answers
2k
views
Libreoffice 5.4.5.1 gets access denied on NFS mounted filesystem
Using Ubuntu 17.10 and Libreoffice I've updated everything today.
Trying to open .od_ documents from my /Documents folder now yields "Access denied"
(see also question [Access to *.doc was denied | ...
0
votes
1
answer
5k
views
Apparmor permission for libvirt-qemu
I am trying to run custom build qemu with libvirt. However, every time it fails due to apparmor permission.
dmesg shows that:
[ 82.818348] audit: type=1400 audit(1563507497.685:181): apparmor="...
CommunityBot
- 1
0
votes
2
answers
61
views
apparmor bind interaction, preventing jnl file updates
Ubuntu 22.04.4 LTS
Bind 9.18.18
I have placed by named zones files in /etc/bind/zones, but I have made the machine a secondary for dynamic DNS, it is a primary for static zones, though in actuality ...
0
votes
0
answers
21
views
Ubuntu 20.04 snaps: Allow a snap app access to a VM shared folder
I have Ubuntu 20.04 guest system with a shared folder (lets say, /home/me/VMShared) between guest and host. On the guest machine user me is added to vboxsf group which allows full access to this ...
- 439
0
votes
0
answers
144
views
Selinux on Ubuntu Server 22.04
I uninstalled apparmor then installed and enabled Selinux.
But I'm getting errors, such as following;
Failed to start D-Bus System Message Bus
Failed to start Network Manager
Server is booting but I'...
- 896
1
vote
0
answers
546
views
AppArmor issues with Libvirt
I have a fresh Ubuntu Server 22.04.3 and Debian 12.1.0 installed and updated. Along with Cockpit and Cockpit virtual machines on both tests machines.
I am getting the following errors and warning when ...
- 74.9k
4
votes
1
answer
2k
views
How to change apparmor logging file?
Apparmor logging to syslog by default. How to change apparmor config to logging to /var/log/apparmor.log for example?
0
votes
1
answer
1k
views
audit: type=1400, apparmor='denied'
I have written a program .c and Makefile. Makefile created a file .ko, afer this I used the next commands:
sudo insmod filename.ko
sudo sysctl kernel.dmesg_restrict=0
dmesg | tail
As result, I ...
- 11
0
votes
0
answers
82
views
Bluetooth stopped working on 22.04 server - (apparently not) apparmor issue?
I'm running bluetooth on a Ubuntu 22.04 server, to communicate with some sensors. And it appears that the previously working setup has suddenly stopped working.
The service reports OK:
tmikoss@home-...
- 109
3
votes
1
answer
1k
views
Gnome Seahorse Crashing all the time
I have Ubuntu 22.04.2 on my Latitude 5490.
Very often I have a small window opening saying "The application Passwords and Keys has closed unexpectedly", mostly right after I boot my computer....
3
votes
1
answer
2k
views
AppArmor error Gnome Software Ubuntu 20.04
I'm very new to this stuff. I had a problem with snap-software so I purged it and installed gnome-software and I'm seeing the below error message.
Sorry, something went wrong:
An AppArmor policy ...
- 1,290
1
vote
2
answers
1k
views
How do I repair an ubuntu install with apparmor running forever at startup?
I tried to upgrade an Ubuntu 22.04.2 LTS install to 23.04 last night. Upon reboot, the system will hang trying to start AppArmor. I found a few posts in the past about disabling app armor from ...
3
votes
0
answers
65
views
Discord (among others) filling syslog. Is there a privacy preserving solution yet?
Discord is constantly spamming the system for a ptrace read that is being repeatedly denied by AppArmor/Snap. This happens for good reason as it is intended to find what games you might be playing. ...
- 31
0
votes
1
answer
171
views
How to let Firefox access system files?
I am trying to package an HTML user guide with my app.
Currently, it is placed in /etc/oqm/static/guide.html, with read permissions set to all.
However, firefox doesn't seem to have access to it.
I ...
- 609
6
votes
1
answer
484
views
Cannot access GIMP help because AppArmor stops it
I just installed GIMP through Ubuntu Software, which I understand uses snap. I tried to access GIMP help but it was blocked. I got this error:
Could not open 'https://docs.gimp.org/2.10/en/gimp-help....
- 976
1
vote
0
answers
195
views
Snap Firefox spams system logs with Apparmor / Mutter error
On my Ubuntu 23.10, during normal navigation Firefox adds lots of lines like this one to /var/log/syslog, so that the file gets bigger and bigger (it got to several gigabytes and filled up my disk):
...
- 637
0
votes
0
answers
44
views
Whether Apparmor has to be enable for mysql database to work properly
We have OS unbuntu 22.04 with mysql 8.0.33 database and Hugepages is not working properly in 8.0.33 MySQL Community Server.
We have set vm.nr_hugepages = 4646 in sysctl.conf file and large_pages=ON, ...
- 1
6
votes
0
answers
2k
views
apparmor="DENIED" operation="dbus_method_call"
My syslog is getting many messages like this:
dbus-daemon[1311]: message repeated 12 times: [ apparmor="DENIED" operation="dbus_method_call" bus="session" path="/...
- 1
5
votes
1
answer
2k
views
How can I configure apparmor to allow mariadb load a shared library?
After a routine update yesterday, MariaDB would not start because a shared library file is not loading because it is being blocked by apparmor.
Here's the output from the journalctl -xe
Apr 17 11:44:...
- 111
0
votes
0
answers
141
views
What do I do if AppArmor and GNOME configuration seem to be interfering with normal suspend/resume in Ubuntu 23.10
Follow up to my other question: https://askubuntu.com/a/1492540/806813
I followed the advice and got some log output below.
Is there a magic wand? I'm an app developer and have the utmost respect for ...
- 739
1
vote
0
answers
71
views
apparmor complain mode profile with null-
After doing the following:
sudo aa-easyprof /usr/local/bin/my_proc > usr.local.bin.my_proc
sudo mv usr.local.bin.my_proc/etc/apparmor.d/
sudo apparmor_parser -r /etc/apparmor.d/usr.local.bin....
- 11
13
votes
2
answers
2k
views
Evince can not open links in snap Firefox
When I click on a link in a PDF document in Evince, it does not work. Instead, I only see cursor turning into a spinner and a message appearing in the terminal:
env: ‘/snap/bin/firefox’: Permission ...
- 241
3
votes
1
answer
4k
views
Bind9 - openssl problem
when I try to start bind9; simply fail because of chroot & openssl
/etc/init.d/bind9 start
log messages;
Feb 17 08:26:27 ISTVS2024 named[2440]: initializing DST: openssl failure
Feb 17 08:26:27 ...
CommunityBot
- 1
0
votes
1
answer
109
views
Apparmor prevents access to certificate bundle for IKEv2 VPN
I am trying to get a Strongswan / IKEV2 VPN set up on Ubuntu 23.04.
I have the Network Manager plugin compiled and working.
When I attempt the connection, I get the below error in syslog, that it is ...
- 101
2
votes
1
answer
447
views
How do I add extra download directories to AppArmor for Firefox running under snap?
I recently updated to Ubuntu 22.04.1 and went to a site where I occasionally download things from. I typically save files from this site to an sshfs mount shared from another system on my home network,...
- 103
6
votes
2
answers
17k
views
Can not boot! Failed to start AppArmor initialization... Computer hanging in booting.. can not start
My HP Elitebook 2570p cannot boot! Failed to start AppArmor initialization... Computer hanging in booting process starting gnome display manager, dispatcher service....system changes .. p link was ...
- 509
5
votes
2
answers
3k
views
Why does apparmor kill dhclient?
I successfully upgraded my KVM server to 20.04.1 LTS but when later trying to access it by ssh, there were no network route to the server, while the VMs still were happily running just great. Logging ...
- 3,199
7
votes
1
answer
5k
views
LibreOffice can't access /tmp files in 18.04
Just installed LibreOffice 6.0.4.2 in Ubuntu 18.04.
LibreOffice can't open (nor list) files from /tmp directory.
I've read about AppArmor profiles, devs talking about the "expected" /home use case, ...
CommunityBot
- 1
0
votes
0
answers
4k
views
Snap-store cannot create directory ‘/run/user/0’
22.04 LTS
After some updates:
sudo apt-get update
sudo apt-get upgrade
I am not able to open snap-store:
sudo snap-store
mkdir: cannot create directory ‘/run/user/0’: Permission denied
Bus error
...
- 21
0
votes
0
answers
119
views
How to configure AppArmor to deny disk access (real /etc/), while allowing container image access (virtual /etc)
I would like to allow a container to write to its own virtual disk (/etc), but prevent it from accessing the real disk (/etc). I believe this is possible with SELinux by using labels, but is it also ...
- 1
8
votes
1
answer
1k
views
Excessive Firefox related AppArmor log entries
I recently installed and fully updated Ubuntu 22.04.1 LTS (jammy), 64-bit (amd64, x86_64). I removed 'snapd' and its default set of installed applications, which includes Firefox browser (which in 22....
- 51
0
votes
0
answers
105
views
Can AppArmor provide isolation between containers? (like SELinux)
I'm interested in using AppArmor to enforce security boundaries between containers.
https://www.redhat.com/sysadmin/apparmor-selinux-isolation was written a few years ago comparing AppArmor and ...
- 101
0
votes
0
answers
128
views
Firefox crashes when trying to upload or browse a file
On some websites (like Facebook), there are buttons to select and upload a file. Clicking on them crashes Firefox.
AppArmor seems to be involved. dmesg | tail gives me this:
[ 2935.306465] audit: ...
- 1,258
0
votes
0
answers
193
views
Browser problem after upgrades
I'm running Ubuntu 22.04.02 LTS and just applied some updates as recommended by the OS. SInce then my Brave browser (& all other browsers) stopped working and would not launch from the sidebar. ...
- 179
0
votes
0
answers
188
views
System crashing on snap apparmor brave error
Relevant passage from syslog:
Jun 29 18:06:28 noah-HP-Pavilion-Laptop-15-cs0xxx NetworkManager[1023]: <info> [1688076388.3763] manager: NetworkManager state is now CONNECT
ED_SITE\
Jun 29 18:06:...
- 115k
1
vote
0
answers
152
views
How to make other users have read access on a folder in my home?
My server is ubuntu22.04 and AppArmor is enabled. I want to share my folders (/home/syang/public) with other users. I give the read permission by chmod -R go+rX /home/syang/public, but they still ...
- 11
0
votes
2
answers
483
views
Problems after upgrading to 22.04 to 22.04.2 LTS
I've upgraded to 22.04.2 LTS from 22.04 via the update manager and have noticed that many of my apps no longer work. As an example, if I run firefox at the terminal with the command snap run firefox ...
0
votes
2
answers
610
views
Stop Snaps from accessing user home directory?
I am trying to sandbox all my applications by default using firejail. Firejail doesn't support snap applications.
It appears that by default if requested by a snap, snapd will grant the snap read/...
2
votes
0
answers
874
views
How to modify Firefox's AppArmor profile to allow evince to open links
When I try to open a link from a PDF using Evince I get an error message in the terminal.
env: ‘/snap/bin/firefox’: Permission denied
It used to work when Firefox wasn't a snap package.
I think the ...
- 637
1
vote
1
answer
204
views
Apparmor full system implementation help
I am trying to implement Apparmor full system implementation on Ubuntu Bionic in AWS EC2 instances.
https://gitlab.com/apparmor/apparmor/-/wikis/FullSystemPolicy#distribution
My goal is employ a deny-...
- 1,759
0
votes
0
answers
181
views
Apparmor PHP8.1 requests rw access to "/"
I'm writing an apparmor profile for php (specifically 8.1), and I'm having some trouble with my particular config of php (this is for a webserver running dokuwiki).
I've gotten all the functionality ...
CommunityBot
- 1
9
votes
2
answers
5k
views
Why is firefox trying to access fstab and how can I stop it?
Today I ran journalctl -k and found hundreds of entries like this one:
Mar 27 22:15:11 charm kernel: audit: type=1400 audit(1679915711.422:1671372): apparmor="DENIED" operation="open&...
- 1,942
0
votes
1
answer
302
views
Apparmor: Allow Inkscape to execute extensions in $HOME/config/inkscape/extensions/
I want to extend Inkscape (installed with snap) by putting the SVGO-Optimizer SVGO in Inkscape's local extension directory.
According to the Inkscape preferences dialog (Edit/Preferences/System), the ...
- 5,004