Page 10 of 12 FirstFirst ... 89101112 LastLast
Results 91 to 100 of 112

Thread: Share your AppArmor Profiles

  1. #91
    Join Date
    Apr 2006
    Location
    Montana
    Beans
    Hidden!
    Distro
    Kubuntu Development Release

    Re: Share your AppArmor Profiles

    Quote Originally Posted by tlu View Post
    Thanks, bodhi.zazen. Here's the complete output:
    Well, you are in quite a tizzy I see.

    You really need to start over.

    1. Stop firefox.

    2. Reload apparmor

    Code:
    sudo service apparmor stop
    sudo service apparmor start
    That will clear out all those null profiles.

    3. You need to understand what you are doing as I think you are missing the point. As I keep telling you, a null profile is generated when the apparmor denies execute access to something.

    In complain mode, access is allowed, but the process is then named null something. For example, you have a long list,

    /usr/lib/firefox-3.6.5pre/firefox-*bin//null-24

    See the null-24 ?

    Apparmor will generate a denial for everything "/usr/lib/firefox-3.6.5pre/firefox-*bin//null-24" tries to access.

    You do not debug "/usr/lib/firefox-3.6.5pre/firefox-*bin//null-24" , you fix the initial denial that caused "/usr/lib/firefox-3.6.5pre/firefox-*bin//null-24" to be created.

    So you have to look up in your logs to the last denial that does not contain a "null". Fix that denial, and the nulls will go away.

    This elaborate procedure is to "help" debugging apparmor profiles, but in practice, it is of little help at all, and as you can see, causes more confusion.

    You do not "debug" anything with a "//null-xx" in the name, you have to debug the initial denial that caused the null.

    As with previous posts, you are not posting the initial denial. Your posts keep getting longer, but I do not think you understand what to look for.

    Please:

    1. Do not post long logs like that. They do not help and only clutter your posts.

    2. Do not post any log message that contains a null profile. They clutter your post and do not help at all.


    Now, open a terminal. Enter:

    Code:
    tail -F /var/log/messages
    Watch this terminal for errors.

    With your firefox apparmor in complain mode, open firefox. If firefox is not working, apparmor is not the problem -> go debug firefox or whatever addon or plugin that is broken.

    If firefox works, close firefox, and debug any denials you received in the "tail -F /var/log/messages" terminal.

    Keep repeating until you have managed all the denials.

    Then put the firefox profile into enforcing mode and try to start firefox.

    Post any denial you do not understand, but do not post any denial with a null profile in it.
    There are two mistakes one can make along the road to truth...not going all the way, and not starting.
    --Prince Gautama Siddharta

    #ubuntuforums web interface

  2. #92
    Join Date
    Aug 2006
    Beans
    82
    Distro
    Kubuntu 13.10 Saucy Salamander

    Re: Share your AppArmor Profiles

    Thanks for your detailed response!

    Quote Originally Posted by bodhi.zazen View Post

    1. Stop firefox.

    2. Reload apparmor

    Code:
    sudo service apparmor stop
    sudo service apparmor start
    Done.

    So you have to look up in your logs to the last denial that does not contain a "null". Fix that denial, and the nulls will go away.
    ...

    If firefox works, close firefox, and debug any denials you received in the "tail -F /var/log/messages" terminal.
    In complain mode I didn't get any log entry without the "null".


    Then put the firefox profile into enforcing mode and try to start firefox.

    Post any denial you do not understand, but do not post any denial with a null profile in it.
    After switching to enforce mode I got the following log (now without the "null"):

    Code:
    May 29 12:25:16 HANNIBAL kernel: [ 1587.419979] __ratelimit: 171 callbacks suppressed
    May 29 12:25:16 HANNIBAL kernel: [ 1587.419981] type=1505 audit(1275128716.952:375):  operation="profile_replace" pid=4012 name="/usr/lib/firefox-3.6.5pre/firefox-*bin"
    May 29 12:25:16 HANNIBAL kernel: [ 1587.420171] type=1505 audit(1275128716.956:376):  operation="profile_replace" pid=4012 name="/usr/lib/firefox-3.6.5pre/firefox-*bin//firefox_java"
    May 29 12:25:16 HANNIBAL kernel: [ 1587.420302] type=1505 audit(1275128716.956:377):  operation="profile_replace" pid=4012 name="/usr/lib/firefox-3.6.5pre/firefox-*bin//firefox_openjdk"
    May 29 12:25:48 HANNIBAL kernel: [ 1619.060824] type=1503 audit(1275128748.596:378):  operation="exec" pid=4037 parent=4036 profile="/usr/lib/firefox-3.6.5pre/firefox-*bin" requested_mask="x::" denied_mask="x::" fsuid=1000 ouid=1000 name="/home/tlu/tmp/flashgot.ho87hudj.Default_20User/flashgot.fgt"

  3. #93
    Join Date
    Apr 2006
    Location
    Montana
    Beans
    Hidden!
    Distro
    Kubuntu Development Release

    Re: Share your AppArmor Profiles

    THAT'S IT !!!!

    May 29 12:25:48 HANNIBAL kernel: [ 1619.060824] type=1503 audit(1275128748.596:378): operation="exec" pid=4037 parent=4036 profile="/usr/lib/firefox-3.6.5pre/firefox-*bin" requested_mask="x::" denied_mask="x::" fsuid=1000 ouid=1000 name="/home/tlu/tmp/flashgot.ho87hudj.Default_20User/flashgot.fgt"
    You need to allow execution of flashgot, add this:

    Code:
    owner @{HOME}/tul/tmp/flashgot.*/flashgot* rix,
    restart apparmor ...

    Try to start firefox again. See if there are additional denials (there may well be) and fix those as well.

    It is possible the "flashgot.*" may need to be slightly adjusted, perhaps

    @{HOME}/tul/tmp/flashgot.*.*/* rix,

    Or you may need to add m or k

    Watch the logs ...
    There are two mistakes one can make along the road to truth...not going all the way, and not starting.
    --Prince Gautama Siddharta

    #ubuntuforums web interface

  4. #94
    Join Date
    Aug 2006
    Beans
    82
    Distro
    Kubuntu 13.10 Saucy Salamander

    Re: Share your AppArmor Profiles

    Quote Originally Posted by bodhi.zazen View Post
    THAT'S IT !!!!
    Yes, indeed, it is!

    You need to allow execution of flashgot, add this:

    Code:
    owner @{HOME}/tul/tmp/flashgot.*/flashgot* rix,
    I added that (without the /tul - obviously a typo of yours ) and that fixes the problem. No more denials.

    Thanks a lot, bodhi.zazen !

  5. #95
    Join Date
    Apr 2006
    Location
    Montana
    Beans
    Hidden!
    Distro
    Kubuntu Development Release

    Re: Share your AppArmor Profiles

    Alrighty then, hope you learned a little about apparmor
    There are two mistakes one can make along the road to truth...not going all the way, and not starting.
    --Prince Gautama Siddharta

    #ubuntuforums web interface

  6. #96

    Re: Share your AppArmor Profiles

    hello
    there is AppArmor Support Thread
    you should write such support discussion there, i think.

  7. #97
    cprofitt's Avatar
    cprofitt is offline νόησις νοήσεως - nóesis noéseos
    Join Date
    Oct 2006
    Location
    平静
    Beans
    1,444
    Distro
    Ubuntu Development Release

    Re: Share your AppArmor Profiles

    Very nice thread -- is there a good guide you guys can point to in regards to setting up profiles.

  8. #98
    Join Date
    Apr 2006
    Location
    Montana
    Beans
    Hidden!
    Distro
    Kubuntu Development Release

    Re: Share your AppArmor Profiles

    Quote Originally Posted by cprofitt View Post
    Very nice thread -- is there a good guide you guys can point to in regards to setting up profiles.
    http://www.linuxtopia.org/online_boo...ide/index.html

    It has much SUSE specific content, which can be ignored with impunity.

    It is incomplete in some areas, especially how to debug profiles.

    But it is the best single guide I know, from there, as with all things, it come with use.

    If you use apparmor it takes about 2-3 hours of time for it to all click (hint toggle between complain and enforce mode, "tail -F /var/log/messages").
    There are two mistakes one can make along the road to truth...not going all the way, and not starting.
    --Prince Gautama Siddharta

    #ubuntuforums web interface

  9. #99
    Join Date
    Apr 2008
    Location
    Far, far away
    Beans
    2,148
    Distro
    Ubuntu 11.04 Natty Narwhal

    Re: Share your AppArmor Profiles

    @Bodhi,

    I tried out a couple profiles from your site's repo. Wireshark and Skype. I think Wireshark worked well except a minor change for usb devices ("/dev/usbmon? r," if you even use it for watching usb traffic).

    But Skype has changed a fair bit since that one was created. This nasty program wants to get to all sorts of system info and you can't enforce against it without the program not starting. I ended up enabling the things it wanted.

    The one thing I wanted to ask about is why it wants "m" access to the /etc/passwd file. I know the passwords aren't stored there now but I'm just curious what use it has for looking at the "accounts list" and related info.

    Along with denying access to the /var/lib/dbus/machine-id file, I'd much prefer it not look at those files. But that doesn't appear to be an usable option.

    Anyway, I updated my own copy of the skype profile to work with 10.4 and Skype 2.1 and if anyone wants it I could post it here.

  10. #100
    Join Date
    Apr 2006
    Location
    Montana
    Beans
    Hidden!
    Distro
    Kubuntu Development Release

    Re: Share your AppArmor Profiles

    It is amazing what some of these applications access !!!

    Aye, those profiles are "templates" to get started, glad you found them helpful.
    There are two mistakes one can make along the road to truth...not going all the way, and not starting.
    --Prince Gautama Siddharta

    #ubuntuforums web interface

Page 10 of 12 FirstFirst ... 89101112 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •