Groups > linux.debian.user > #197612

Re: Apparmor: 1 processes are unconfined but have a profile defined

From	Reco <recoverym4n@gmail.com>
Newsgroups	linux.debian.user
Subject	Re: Apparmor: 1 processes are unconfined but have a profile defined
Date	2018-07-13 22:50 +0200
Message-ID	<wbdaN-I1-3@gated-at.bofh.it> (permalink)
References	<wb8Xv-6Cn-1@gated-at.bofh.it> <wbceJ-7f-1@gated-at.bofh.it> <wbdaN-I1-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

	Hi.

I accept on-list communication only.

On Fri, Jul 13, 2018 at 11:09:19PM +0300, Ge wrote:
> Hi i couldn't figure out so i delete all Firefox profiles and i started
> again from the beginning

If you just deleted the files from /etc/apparmor.d - that won't be
enough as old profiles are still loaded into the running kernel.
See if it sticks after the reboot.

But,

> My Firefox profile now seems to work.
> 
>  sudo cat ./usr.lib.firefox-esr.firefox-esr

If your Apparmor profile is not world-readable then you're doing it
wrong (i.e. sudo should not be needed for this).

> [sudo] password for gssd:
> # Last Modified: Fri Jul 13 19:58:57 2018
> #include <tunables/global>
> 
> /usr/lib/firefox-esr/firefox-esr {

That line's crucial. Enabling and disabling should be done via
aa-enforce/aa-complain /usr/lib/firefox-esr/firefox-esr.

>   "/home/gssd/.mozilla/firefox/Crash Reports/*" r,

This one and everything like it are better written as:

owner "@{HOME}/.mozilla/firefox/Crash Reports/*" r

And I wonder whenever disabling writing crash reports was intentional.

>   /home/*/.mozilla/firefox/72z9u2as.default/browser-extension-data/** rw,

This one:

owner @{HOME}/.mozilla/firefox/*/browser-extension-data/** rw,

Everything else is more or less ok.

Reco

Thread

Apparmor: 1 processes are unconfined but have a profile defined Ge <gpdsbe@mailbox.org> - 2018-07-13 18:20 +0200
  Re: Apparmor: 1 processes are unconfined but have a profile defined Reco <recoverym4n@gmail.com> - 2018-07-13 21:50 +0200
    Re: Apparmor: 1 processes are unconfined but have a profile defined Reco <recoverym4n@gmail.com> - 2018-07-13 22:50 +0200
      Re: Apparmor: 1 processes are unconfined but have a profile defined Ge <gpdsbe@mailbox.org> - 2018-07-13 23:00 +0200
        Re: Apparmor: 1 processes are unconfined but have a profile defined Reco <recoverym4n@gmail.com> - 2018-07-14 12:10 +0200

csiph-web