Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #197609

Re: Apparmor: 1 processes are unconfined but have a profile defined

Show all headers | View raw

	Hi.

On Fri, Jul 13, 2018 at 07:10:51PM +0300, Ge wrote:
> Hello
> Im trying to make my own profiles for apparmor.
> 
> I made a profile for firefox-esr but for some reason i cant get apparmor
> to confine it.  I run aa-enforce firefox-esr but nothing change.

First, you're supposed to restart confined process, as Apparmor profile
applies on process start only.

Second, Apparmor applies to a full pathnames only, and aa-enforce is
dumb enough to pick /usr/bin/firefox-esr instead of a real firefox
binary (which should be /usr/lib/firefox-esr/firefox-esr).


> Any ideas?
> Thanks in advance for your help.

Third, I see a discrepancy here:

> $sudo aa-status
> apparmor module is loaded.
> 21 profiles are loaded.
> 21 profiles are in enforce mode.
>    /etc/apparmor.d/usr.lib.firefox-esr.firefox-esr
...
>    /usr/bin/firefox
...
> 3 processes are in enforce mode.
>    /usr/bin/freshclam (689)
>    /usr/lib/firefox-esr/plugin-container (1843)
...
> 1 processes are unconfined but have a profile defined.
>    /usr/lib/firefox-esr/firefox-esr (1798)

Which binary does your custom profile apply to?
Can you share it?

Reco

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Apparmor: 1 processes are unconfined but have a profile defined Ge <gpdsbe@mailbox.org> - 2018-07-13 18:20 +0200
  Re: Apparmor: 1 processes are unconfined but have a profile defined Reco <recoverym4n@gmail.com> - 2018-07-13 21:50 +0200
    Re: Apparmor: 1 processes are unconfined but have a profile defined Reco <recoverym4n@gmail.com> - 2018-07-13 22:50 +0200
      Re: Apparmor: 1 processes are unconfined but have a profile defined Ge <gpdsbe@mailbox.org> - 2018-07-13 23:00 +0200
        Re: Apparmor: 1 processes are unconfined but have a profile defined Reco <recoverym4n@gmail.com> - 2018-07-14 12:10 +0200

csiph-web