Questions tagged [apparmor]
AppArmor is a Linux Security Module
327
questions
5
votes
1
answer
207
views
Browsing nautilus folder containing a dvi file -- apparmor/evince error
If a browse a nautilus folder that contains a .dvi file, I get errors that pop onto my screen:
I think that this is due to the thumbnailer processing the file. I don't care about getting thumbnails ...
2
votes
0
answers
467
views
Apparmor KVM Ubuntu 14
I am running Ubuntu 14.10. I am trying to install KVM guest. When I try to do so with VNC I get following apparmor error in syslog:
kernel: [ 3016.448241] audit: type=1400 audit(1423018183.349:51): ...
1
vote
0
answers
357
views
AppArmor on BeagleBoard Black (and probably other ARMv7 devices)
I've installed Ubuntu onto my BeagleBoard, using the instructions at http://www.elinux.org/BeagleBoardUbuntu . This runs the ARM version of Ubuntu 14.04.
This all went to plan and it worked, and I ...
4
votes
1
answer
3k
views
How to customize locally an apparmor profile?
I would like to run Firefox with aa-enforce(d) apparmor profile. This works fine, except I have a plugin that need access to the keyring via dbus. When the plugin (https://github.com/swick/moz-gnome-...
0
votes
1
answer
1k
views
Having problems with Samba4/BIND9_DLZ : AppArmor permission issue
(12.04.5LTS Server)
Have a user "named", configured in the bind9 service to start.
My /etc/apparmor.d/local/usr.sbin.named file
/usr/local/samba/lib/** rm,
/usr/local/samba/private/dns.keytab r,
/...
1
vote
1
answer
273
views
Is evince-gtk protected by apparmor?
The 14.10 software center offers evince and a version called evince-gtk with fewer GNOME dependencies.
In /etc/apparmor.d there is an apparmor profile for evince: /etc/apparmor.d/usr.bin.evince. My ...
0
votes
1
answer
906
views
How to make non-ascii-armored public key from ascii-armored secret key
I have
old key pair (GnuPG keys), both only ascii-armored
1 fresh Ubuntu-Desktop 14.04 installation
How can I make a non-ascii armored public key from the old secret key?
1
vote
1
answer
2k
views
How do I block all traffic except firefox?
Lets say for example I want to block all traffic except incoming from nginx, outgoing for firefox and allow out and incoming to some torrent client. Would that be possible? I took a look at apparmor ...
2
votes
2
answers
154
views
Permissions for thumbnailer on device
I'm developing an application for U-Touch that gets a thumbnail from a video in C++ code using libthumbnailer system library. The app does the thumbnailing perfectly in my computer, but when i try to ...
0
votes
0
answers
81
views
How to enable AppArmor as kernel LSM? [duplicate]
I have installed AppArmor but when I start it it says
* AppArmor not available as kernel LSM.
how can I resolve this?
3
votes
0
answers
681
views
How to use Firefox AppArmor profile with IcedTea Java plugin on Ubuntu 14.04?
Whenever I set up Ubuntu on a new system, I active the default AppArmor profile for Firefox via
sudo aa-enforce /etc/apparmor.d/usr.bin.firefox
Doing this on Ubuntu 14.04, however, makes Java ...
2
votes
0
answers
834
views
Suspend broken: pm-suspend fails due to /sys/power/* being a Read-only file system
My System 76 laptop running 14.04 won't suspend. Running sudo pm-suspend fails with the following in /var/log/pm-suspend.log:
Running hook /usr/lib/pm-utils/sleep.d/94cpufreq suspend suspend:
/usr/...
0
votes
1
answer
91
views
Would AppArmor protect against a bug like Heartbleed?
Is it capable of "containing"/preventing the exploitation of things such as this?
1
vote
2
answers
2k
views
SLAPd - TLS not working / apparmor Errors
I've been trying to get LDAP working and set up for a few days now. The real head scratcher is that everything went fine until I got to the point of setting up TLS. I was using this guide from the ...
2
votes
0
answers
258
views
Can AppArmor have default policies for all applications without profiles?
Is it possible to deny all applications network access and then allow a select few explicitly defined applications all network access?
0
votes
2
answers
1k
views
Skype doesn't see my webcam
I've got Logitech C270 (/dev/video0) that is seen by Cheese in Xubuntu 14.04, but Skype doesn't recognize it. What can I do? Should I blame my apparmor profile?
4
votes
2
answers
2k
views
Tor not working after update
Yesterday I updated my Ubuntu 14.04 LTS and after that Tor stopped working :
When I try to run Tor using command
sudo service tor start it gives an error
aa-exec: ERROR: profile 'system_tor' does ...
6
votes
1
answer
13k
views
How to fix apparmor="DENIED" for telepathy-mission-control-5 under Ubuntu 14.04?
Just installed Ubuntu 14.04 LTS a week ago and a few programs for my work & fun:
nginx server, rabbitmq server, mysql server
php-fpm, hhvm
sublime-text, mysql workbench
hplib (for printer/scanner)...
4
votes
1
answer
2k
views
Anyway to use Skype in AppArmor?
Ubuntu 14.04 and Skype 4.2 installed. I've set up AppArmor using the Skype AppArmor profile from this wiki. When I use AppArmor with Skype, it has no audio. Is anyone using AppArmor successfully with ...
-1
votes
2
answers
4k
views
Evince: error while loading shared libraries: Permission denied
While opening a PDF, I get a permission denied error, while ROOT.
root@brix:~# evince *.pdf
evince: error while loading shared libraries: libz.so.1: failed to map segment from shared object: ...
6
votes
2
answers
7k
views
Contain Docker Engine with AppArmor
In face of the reminders that the Docker Engine should be run contained with AppArmor or SELinux, how to run Docker under AppArmor on Ubuntu 14.04?
The Docker Security documentation and the LXC ...
1
vote
0
answers
2k
views
apparmor="DENIED"
I get loads of error messages like this in dmesg
[613107.890167] type=1400 audit(1402488663.041:108): apparmor="DENIED"
operation="exec"
profile="/usr/bin/evince-thumbnailer//sanitized_helper"
name="/...
4
votes
1
answer
2k
views
How to change apparmor logging file?
Apparmor logging to syslog by default. How to change apparmor config to logging to /var/log/apparmor.log for example?
2
votes
1
answer
4k
views
Allow folder in all AppArmor profiles?
I want to put all my modified ubuntu server configurations files (/etc/...) in one folder via symbolic links. However, it's annoying having to write the same line in all apparmor profiles.
Is there ...
3
votes
1
answer
10k
views
Mysql on Ubuntu 14.04 problem with AppArmor permissions for data directory
I've been using MySQL with a different location for the database date since Ubuntu 12.04 and had no problems.
My configuration was like this:
Data in /home/db/mysql
Link in the default location sudo ...
2
votes
1
answer
1k
views
How can I put tomcat under apparmor?
For security reasons, I want to put Tomcat under apparmor. The Ubuntu server(12.04 LTS) guide has a good explanation about apparmor, but I am not sure what is the correct way of creating a profile for ...
3
votes
1
answer
4k
views
What is reason for apparmor="DENIED" operation="open"
Jan 26 13:25:27 nanak-P570WM kernel: [ 3184.247986] type=1400 audit(1390703127.047:85): apparmor="DENIED" operation="open" parent=2911 profile="/usr/lib/telepathy/mission-control-5" name="/home/jagat/....
1
vote
1
answer
8k
views
Ubuntu 12.04 not loading after installing updates - initctl: Event failed
After updating my Ubuntu installation I get a blank screen when try to load it. I have dual boot with Windows which works fine.
Going into recovery mode -> resume normal boot gives me the following ...
2
votes
1
answer
129
views
U1DB problems with apparmor
I'm having problem with u1db and apparmor. The application works fine, but when it is packaged apparmor does not allow the app to save data into $HOME/.local/share/.. so I can't actually save my ...
9
votes
3
answers
3k
views
Can apparmor restrict interpreted languages?
For interpreted/vm languages(e.g. python, java, shell scripts) can apparmor be set to only confine a particular script or program? If so, how?
3
votes
1
answer
1k
views
What are orcexec files?
Apparmor shows various programs need read access to files with names like "orcexec.3JIkjU84". it's always orcexec.* which allows for them to be read.
What is the purpose of these files?
1
vote
1
answer
90
views
Is it possible to have two g++ executables with shared lib?
It might sound weird but I do want to have two g++ executables. One in normal /usr/bin/g++ which is currently working well. The other under /sandbox/g++ that is protected by apparmor. However when I ...
7
votes
1
answer
5k
views
apt-get hang at Rsyslog
When I try to install something, there is a hang, I don't know if it's a bug or something else...
root@computer:~# apt-get install
Reading package list... Done
Building dependancy tree
Reading state ...
4
votes
3
answers
6k
views
Removing AppArmor
I have MySQL installed in my development machine, where I just don't need any additional security measure.
I want to move MySQL Data files to another partition, which implies a lot of change in ...
8
votes
1
answer
4k
views
How to display AppArmor denied messages as desktop notifications
How can I get live notifications on my desktop whenever an AppArmor denied message is triggered?
5
votes
1
answer
2k
views
Preventing a specific application from accessing a folder [duplicate]
I just installed an application that has the bad habit of automatically scanning all my folders for files to edit.
The app has no available options to disable this behavior. I cannot just remove read/...
3
votes
1
answer
4k
views
Bind9 - openssl problem
when I try to start bind9; simply fail because of chroot & openssl
/etc/init.d/bind9 start
log messages;
Feb 17 08:26:27 ISTVS2024 named[2440]: initializing DST: openssl failure
Feb 17 08:26:27 ...
2
votes
0
answers
211
views
Hide Skype from panel with apparmor and keep links in chat openable
To hide Skype from unity panel we can add file /etc/apparmor.d/usr.bin.skype with such content:
# Last Modified: Tue Jun 12 03:49:49 2012 by izx
# REPOSITORY: http://apparmor.test.opensuse.org/...
5
votes
4
answers
11k
views
How to fix AppArmor `could not open` error when installing php+mysql?
I want to install php5-imap php5-ldap php5-curl
sudo apt-get install php5-imap php5-ldap php5-curl
I get this error:
AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld in /etc/apparmor.d/usr....
10
votes
1
answer
899
views
Apparmor has hats like null-12b08
I am running a Ubuntu 12.04.2 server with Apache using mod_apparmor. When I run aa-status, I see thousands and thousands (seriously, over 100,000) of profiles with names like
/usr/lib/apache2/mpm-...
1
vote
2
answers
175
views
Is apparmor active after installation? [duplicate]
Possible Duplicate:
How can I tell that apparmor is working?
I want to know is apparmor active after installing ubuntu12.04 ?
Thank you
1
vote
2
answers
9k
views
mysql: unrecognized service (apparmor)
Mysql was working, then I tried to move the MySql database directory as in this question which I already successfully used several times, but this time something went wrong and I got the error:
$ ...
106
votes
3
answers
52k
views
What is apparmor?
I hear a lot of talk about apparmor, I want to know the following:
What is apparmor?
How does apparmor work?
27
votes
3
answers
24k
views
How can I tell that apparmor is working?
Some questions I want answered in the answer:
How do I know if apparmor is running?
How can I tell if it's working well?
8
votes
3
answers
3k
views
How does AppArmor deal with non-profiled Programs?
I setup and configured AppArmor in Ubuntu and I would like to know how AppArmor deals with Packages and Applications which have no AppArmor Profile?
After installing the package with sudo apt-get ...
-1
votes
1
answer
789
views
Are these Apparmor profiles unnecessary?
I'm running Lubuntu 12.10. I've installed apparmor-profiles. I uninstalled the Chromium browser have the latest Chrome stable in its place.
Now I'm trying to learn a little about Apparmor profiles. ...
0
votes
1
answer
3k
views
Where can I find apparmor profiles?
I'm interested in using apparmor to secure my laptop, and I am wondering if there is a place where I can find apparmor profiles for firefox and other desktop programs.
1
vote
1
answer
808
views
Why is there no Apparmor profile for the terminal?
I understand that Apparmor profiles are useful for securing programs that have access to the internet. Hence the question. I don't see any "terminal"-related profile here.
3
votes
0
answers
541
views
Another apparmor / mysql wont install
I am trying to config another instance of mysql on my present but i can't
mysql_install_db --user=mysql --datadir=/var/lib/mysql2
Installing MySQL system tables...
ERROR: 1005 Can't create table '...
2
votes
1
answer
6k
views
Having problems getting Samba4 and Bind9 working together because of apparmor
So I've been following the Samba4 HOWTO, which has gone reasonably well. The issue I'm having is I can't get BIND9 to restart when the samba configuration is included in /etc/bind/named.conf.local:
...