Need help || Apparmor Profiles

[bodhi.zazen]

The first line, "#include <tunables/global>" needs to go below the

"/usr/bin/dropbox {" with the other includes.

Also you can consolidate

owner @{HOME}/*/.dropbox-dist/ r,
owner @{HOME}/*/.dropbox-dist/** r,
owner @{HOME}/*/.dropbox-dist/ncrypt-0.6.4-py2.5-linux-x86_64.egg/_ncrypt.so mr,
owner @{HOME}/*/.dropbox-dist/netifaces-0.5-py2.5-linux-x86_64.egg/netifaces.so mr,

And why do you have a * in "@{HOME}/*/"

specify a directory rather then a * , you can {list,multiple,directories} if needed

[linuxyogi]

The first line, "#include <tunables/global>" needs to go below the

"/usr/bin/dropbox {" with the other includes.

Also you can consolidate

owner @{HOME}/*/.dropbox-dist/ r,
  owner @{HOME}/*/.dropbox-dist/** r,
  owner @{HOME}/*/.dropbox-dist/ncrypt-0.6.4-py2.5-linux-x86_64.egg/_ncrypt.so mr,
  owner @{HOME}/*/.dropbox-dist/netifaces-0.5-py2.5-linux-x86_64.egg/netifaces.so mr,

And why do you have a * in "@{HOME}/*/"

specify a directory rather then a * , you can {list,multiple,directories} if needed

Hi, I just moved that line below but the "/usr/bin/dropbox"

But still getting the error.

Now the profile looks like

# Last Modified: Sat Aug 20 11:34:47 2011


  /usr/bin/dropbox {
 
  #include <tunables/global>
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/ubuntu-konsole>


  capability sys_ptrace,


  deny /etc/passwd r,

  /bin/dash rix,
  /bin/readlink ix,
  /bin/which rix,
  /etc/python2.6/sitecustomize.py r,
  owner @{HOME}/*/ r,
  owner @{HOME}/*/.config/autostart/dropbox.desktop w,
  owner @{HOME}/*/.dropbox-dist/ r,
  owner @{HOME}/*/.dropbox-dist/icons/hicolor/16x16/status/ r,
  owner @{HOME}/*/.dropbox-dist/ncrypt-0.6.4-py2.5-linux-x86_64.egg/_ncrypt.so mr,
  owner @{HOME}/*/.dropbox-dist/ncrypt-0.6.4-py2.5-linux-x86_64.egg/ncrypt/__init__.pyc r,
  owner @{HOME}/*/.dropbox-dist/ncrypt-0.6.4-py2.5-linux-x86_64.egg/ncrypt/cipher.pyc r,
  owner @{HOME}/*/.dropbox-dist/ncrypt-0.6.4-py2.5-linux-x86_64.egg/ncrypt/dh.pyc r,
  owner @{HOME}/*/.dropbox-dist/ncrypt-0.6.4-py2.5-linux-x86_64.egg/ncrypt/digest.pyc r,
  owner @{HOME}/*/.dropbox-dist/ncrypt-0.6.4-py2.5-linux-x86_64.egg/ncrypt/rsa.pyc r,
  owner @{HOME}/*/.dropbox-dist/ncrypt-0.6.4-py2.5-linux-x86_64.egg/ncrypt/ssl.pyc r,
  owner @{HOME}/*/.dropbox-dist/ncrypt-0.6.4-py2.5-linux-x86_64.egg/ncrypt/x509.pyc r,
  owner @{HOME}/*/.dropbox-dist/netifaces-0.5-py2.5-linux-x86_64.egg/netifaces.so mr,
  owner @{HOME}/*/.dropbox/ r,
  @{HOME}/*/.dropbox/** rix,
  owner @{HOME}/*/.dropbox/config.db rwk,
  owner @{HOME}/*/.dropbox/config.db-journal rw,
  owner @{HOME}/*/.dropbox/dropbox.pid rwk,
  owner @{HOME}/*/.dropbox/filecache.db wk,
  owner @{HOME}/*/.dropbox/filecache.db-journal rw,
  owner @{HOME}/*/.dropbox/host.db w,
  owner @{HOME}/*/.dropbox/l/** rw,
  owner @{HOME}/*/.dropbox/sigstore.db rwk,
  owner @{HOME}/*/.dropbox/unlink.db rw,
  owner @{HOME}/*/.fontconfig/7ef2298fde41cc6eeb7af42e48b7d293-le64.cache-3 r,
  owner @{HOME}/*/.icons/ r,
  owner @{HOME}/*/.local/share/icons/hicolor/16x16/apps/ r,
  owner @{HOME}/*/.local/share/icons/hicolor/32x32/apps/ r,
  owner @{HOME}/*/.local/share/icons/hicolor/48x48/apps/ r,
  owner @{HOME}/*/Dropbox/.dropbox w,
  owner @{HOME}/*/Dropbox/.~216883113597249541HI w,
  owner @{HOME}/*/Dropbox/.~3945515783863310787HI w,
  owner @{HOME}/*/Dropbox/.~5397912888794637208HI w,
  owner @{HOME}/*/Dropbox/.~7317713414570696711HI w,
  owner @{HOME}/*/Dropbox/wallpapers/Mt.Kailash.jpg r,
  owner @{HOME}/*/Dropbox/wallpapers/hazel-0a.jpg r,
  owner @{HOME}/*/Dropbox/wallpapers/kar106a.jpg r,
  owner @{HOME}/*/Dropbox/wallpapers/mt-kailash.jpg r,
  owner @{HOME}/*/Dropbox/wallpapers/sonal-chauhan-7a.jpg r,
  owner "@{HOME}/*/Dropbox/wallpapers/sonam kapoor Hot.jpg" r,
  @{HOME}/*/.dropbox-dist/* rix,
  @{HOME}/*/.dropbox-dist/dropboxd rix,
  /proc/*/cmdline r,
  owner /proc/*/mounts r,
  /sbin/ldconfig rix,
  /sbin/ldconfig.real rix,
  /usr/bin/dirname ix,
  /usr/bin/dropbox rix,
  /usr/bin/gconftool-2 rix,
  /usr/bin/gnome-open rix,
  /usr/bin/nautilus rix,
  /usr/bin/objdump rix,
  /usr/bin/python2.6 ix,
  /usr/lib{,32,64}/** mr,
  /usr/local/lib/python2.6/dist-packages/ r,
  /usr/share/applications/dropbox.desktop r,
  /usr/share/applications/nautilus.desktop r,
  /usr/share/pyshared/PIL.pth r,
  /usr/share/pyshared/apport_python_hook.py r,
  /usr/share/pyshared/cairo/__init__.py r,
  /usr/share/pyshared/gtk-2.0/gio/__init__.py r,
  /usr/share/pyshared/gtk-2.0/glib/__init__.py r,
  /usr/share/pyshared/gtk-2.0/glib/option.py r,
  /usr/share/pyshared/gtk-2.0/gobject/__init__.py r,
  /usr/share/pyshared/gtk-2.0/gobject/constants.py r,
  /usr/share/pyshared/gtk-2.0/gobject/propertyhelper.py r,
  /usr/share/pyshared/gtk-2.0/gtk/__init__.py r,
  /usr/share/pyshared/gtk-2.0/gtk/_lazyutils.py r,
  /usr/share/pyshared/gtk-2.0/gtk/deprecation.py r,
  /usr/share/pyshared/pygst.pth r,
  /usr/share/pyshared/pygtk.py r,
  /usr/share/pyshared/zope.interface-3.5.3-nspkg.pth r,
  /usr/share/themes/Ambiance/gtk-2.0/gtkrc r,
  /usr/share/themes/Default/gtk-2.0-key/gtkrc r,

}

Need to get rid of this error, then I will try n improve the profile.

[linuxyogi]

@Bodhi Zazen

I just noticed that sound id not working in FF with that profile in enforce mode.

Sorry for being late. I was away from home.

Log shows nothing related to FF.

Solved !!! Added the following to the profile

/dev/shm/** r,
/lib/** mr,
owner /home/*/.pulse/** drix,

But the dropbox profile is still erroneous.