Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #197594 > unrolled thread
| Started by | Ge <gpdsbe@mailbox.org> |
|---|---|
| First post | 2018-07-13 18:20 +0200 |
| Last post | 2018-07-14 12:10 +0200 |
| Articles | 5 — 2 participants |
Back to article view | Back to linux.debian.user
Apparmor: 1 processes are unconfined but have a profile defined Ge <gpdsbe@mailbox.org> - 2018-07-13 18:20 +0200
Re: Apparmor: 1 processes are unconfined but have a profile defined Reco <recoverym4n@gmail.com> - 2018-07-13 21:50 +0200
Re: Apparmor: 1 processes are unconfined but have a profile defined Reco <recoverym4n@gmail.com> - 2018-07-13 22:50 +0200
Re: Apparmor: 1 processes are unconfined but have a profile defined Ge <gpdsbe@mailbox.org> - 2018-07-13 23:00 +0200
Re: Apparmor: 1 processes are unconfined but have a profile defined Reco <recoverym4n@gmail.com> - 2018-07-14 12:10 +0200
| From | Ge <gpdsbe@mailbox.org> |
|---|---|
| Date | 2018-07-13 18:20 +0200 |
| Subject | Apparmor: 1 processes are unconfined but have a profile defined |
| Message-ID | <wb8Xv-6Cn-1@gated-at.bofh.it> |
Hello Im trying to make my own profiles for apparmor. I made a profile for firefox-esr but for some reason i cant get apparmor to confine it. I run aa-enforce firefox-esr but nothing change. Any ideas? Thanks in advance for your help. $sudo aa-status apparmor module is loaded. 21 profiles are loaded. 21 profiles are in enforce mode. /etc/apparmor.d/usr.lib.firefox-esr.firefox-esr /usr/bin/exo-open /usr/bin/firefox /usr/bin/freshclam /usr/bin/gsettings-data-convert /usr/bin/liferea /usr/bin/lsb_release /usr/bin/mupdf /usr/bin/proxy /usr/bin/vlc /usr/lib/firefox-esr/firefox-esr /usr/lib/firefox-esr/plugin-container /usr/lib/mupdf/mupdf-x11 /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitNetworkProcess /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitWebProcess /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 thunderbird thunderbird//browser_java thunderbird//browser_openjdk thunderbird//gpg thunderbird//sanitized_helper 0 profiles are in complain mode. 4 processes have profiles defined. 3 processes are in enforce mode. /usr/bin/freshclam (689) /usr/lib/firefox-esr/plugin-container (1843) thunderbird (925) 0 processes are in complain mode. 1 processes are unconfined but have a profile defined. /usr/lib/firefox-esr/firefox-esr (1798)
[toc] | [next] | [standalone]
| From | Reco <recoverym4n@gmail.com> |
|---|---|
| Date | 2018-07-13 21:50 +0200 |
| Message-ID | <wbceJ-7f-1@gated-at.bofh.it> |
| In reply to | #197594 |
Hi. On Fri, Jul 13, 2018 at 07:10:51PM +0300, Ge wrote: > Hello > Im trying to make my own profiles for apparmor. > > I made a profile for firefox-esr but for some reason i cant get apparmor > to confine it. I run aa-enforce firefox-esr but nothing change. First, you're supposed to restart confined process, as Apparmor profile applies on process start only. Second, Apparmor applies to a full pathnames only, and aa-enforce is dumb enough to pick /usr/bin/firefox-esr instead of a real firefox binary (which should be /usr/lib/firefox-esr/firefox-esr). > Any ideas? > Thanks in advance for your help. Third, I see a discrepancy here: > $sudo aa-status > apparmor module is loaded. > 21 profiles are loaded. > 21 profiles are in enforce mode. > /etc/apparmor.d/usr.lib.firefox-esr.firefox-esr ... > /usr/bin/firefox ... > 3 processes are in enforce mode. > /usr/bin/freshclam (689) > /usr/lib/firefox-esr/plugin-container (1843) ... > 1 processes are unconfined but have a profile defined. > /usr/lib/firefox-esr/firefox-esr (1798) Which binary does your custom profile apply to? Can you share it? Reco
[toc] | [prev] | [next] | [standalone]
| From | Reco <recoverym4n@gmail.com> |
|---|---|
| Date | 2018-07-13 22:50 +0200 |
| Message-ID | <wbdaN-I1-3@gated-at.bofh.it> |
| In reply to | #197609 |
Hi.
I accept on-list communication only.
On Fri, Jul 13, 2018 at 11:09:19PM +0300, Ge wrote:
> Hi i couldn't figure out so i delete all Firefox profiles and i started
> again from the beginning
If you just deleted the files from /etc/apparmor.d - that won't be
enough as old profiles are still loaded into the running kernel.
See if it sticks after the reboot.
But,
> My Firefox profile now seems to work.
>
> sudo cat ./usr.lib.firefox-esr.firefox-esr
If your Apparmor profile is not world-readable then you're doing it
wrong (i.e. sudo should not be needed for this).
> [sudo] password for gssd:
> # Last Modified: Fri Jul 13 19:58:57 2018
> #include <tunables/global>
>
> /usr/lib/firefox-esr/firefox-esr {
That line's crucial. Enabling and disabling should be done via
aa-enforce/aa-complain /usr/lib/firefox-esr/firefox-esr.
> "/home/gssd/.mozilla/firefox/Crash Reports/*" r,
This one and everything like it are better written as:
owner "@{HOME}/.mozilla/firefox/Crash Reports/*" r
And I wonder whenever disabling writing crash reports was intentional.
> /home/*/.mozilla/firefox/72z9u2as.default/browser-extension-data/** rw,
This one:
owner @{HOME}/.mozilla/firefox/*/browser-extension-data/** rw,
Everything else is more or less ok.
Reco
[toc] | [prev] | [next] | [standalone]
| From | Ge <gpdsbe@mailbox.org> |
|---|---|
| Date | 2018-07-13 23:00 +0200 |
| Message-ID | <wbdku-M8-5@gated-at.bofh.it> |
| In reply to | #197612 |
Hi!
Thanks for your detail reply.
On 07/13/2018 11:42 PM, Reco wrote:
> Hi.
>
> I accept on-list communication only.
>
> On Fri, Jul 13, 2018 at 11:09:19PM +0300, Ge wrote:
>> Hi i couldn't figure out so i delete all Firefox profiles and i started
>> again from the beginning
>
> If you just deleted the files from /etc/apparmor.d - that won't be
> enough as old profiles are still loaded into the running kernel.
> See if it sticks after the reboot.
>
> But,
I also reboot my laptop
>
>> My Firefox profile now seems to work.
>>
>> sudo cat ./usr.lib.firefox-esr.firefox-esr
>
> If your Apparmor profile is not world-readable then you're doing it
> wrong (i.e. sudo should not be needed for this).
>
Why?
>> [sudo] password for gssd:
>> # Last Modified: Fri Jul 13 19:58:57 2018
>> #include <tunables/global>
>>
>> /usr/lib/firefox-esr/firefox-esr {
>
> That line's crucial. Enabling and disabling should be done via
> aa-enforce/aa-complain /usr/lib/firefox-esr/firefox-esr.
>
Yes i used aa-enforce and aa-disable. I didnt use aa-complain that much.
>
>> "/home/gssd/.mozilla/firefox/Crash Reports/*" r,
>
> This one and everything like it are better written as:
>
> owner "@{HOME}/.mozilla/firefox/Crash Reports/*" r
>
> And I wonder whenever disabling writing crash reports was intentional.
>
>> /home/*/.mozilla/firefox/72z9u2as.default/browser-extension-data/** rw,
>
> This one:
>
> owner @{HOME}/.mozilla/firefox/*/browser-extension-data/** rw,
>
>
I didnt write the profile files. I used aa-genprof and aa-logprof to
automatically created them.
Thanks again for your help!
> Everything else is more or less ok.
>
> Reco
>
[toc] | [prev] | [next] | [standalone]
| From | Reco <recoverym4n@gmail.com> |
|---|---|
| Date | 2018-07-14 12:10 +0200 |
| Message-ID | <wbpEZ-8rL-5@gated-at.bofh.it> |
| In reply to | #197613 |
Hi. On Fri, Jul 13, 2018 at 11:59:00PM +0300, Ge wrote: > > On Fri, Jul 13, 2018 at 11:09:19PM +0300, Ge wrote: > >> Hi i couldn't figure out so i delete all Firefox profiles and i started > >> again from the beginning > > > > If you just deleted the files from /etc/apparmor.d - that won't be > > enough as old profiles are still loaded into the running kernel. > > See if it sticks after the reboot. > > > > But, > I also reboot my laptop > > > >> My Firefox profile now seems to work. > >> > >> sudo cat ./usr.lib.firefox-esr.firefox-esr > > > > If your Apparmor profile is not world-readable then you're doing it > > wrong (i.e. sudo should not be needed for this). > > > Why? You won't increase overall security by setting such files non-world-readable, and requiring root just to read such files is wrong. Reco
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.user
csiph-web