How do I patch my kernel 3.2 with apparmor kernel patches?

Question

I have Ubuntu 12.04 with kernel 3.2 (64 bits)

I downloaded apparmor-2.8.0.tar.gz at https://launchpad.net/apparmor/2.8/2...r-2.8.0.tar.gz

After I untar, I go into apparmor-2.8.0/kernel-patches/3.2/ and there are 3 files:

0001-AppArmor-compatibility-patch-for-v5-network-controll.patch 
0002-AppArmor-compatibility-patch-for-v5-interface.patch
0003-AppArmor-Allow-dfa-backward-compatibility-with-broke.patch

I tried: patch -p1 < 0001-AppArmor-compatibility-patch-for-v5-network-controll.patch

can't find file to patch at input line 26
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|From 125fccb600288968aa3395883c0a394c47176fcd Mon Sep 17 00:00:00 2001
|From: John Johansen <[email protected]>
|Date: Wed, 10 Aug 2011 22:02:39 -0700
|Subject: [PATCH 1/3] AppArmor: compatibility patch for v5 network controll
|
|Add compatibility for v5 network rules.
|
|Signed-off-by: John Johansen <[email protected]>
|---
| include/linux/lsm_audit.h | 4 +
| security/apparmor/Makefile | 19 +++-
| security/apparmor/include/net.h | 40 +++++++++
| security/apparmor/include/policy.h | 3 +
| security/apparmor/lsm.c | 112 ++++++++++++++++++++++++
| security/apparmor/net.c | 170 ++++++++++++++++++++++++++++++++++++
| security/apparmor/policy.c | 1 +
| security/apparmor/policy_unpack.c | 48 +++++++++-
| 8 files changed, 394 insertions(+), 3 deletions(-)
| create mode 100644 security/apparmor/include/net.h
| create mode 100644 security/apparmor/net.c
|
|diff --git a/include/linux/lsm_audit.h b/include/linux/lsm_audit.h
|index 88e78de..c63979a 100644
|--- a/include/linux/lsm_audit.h
|+++ b/include/linux/lsm_audit.h
--------------------------
File to patch:

But it then asks me "File to patch: ".

How do I go about this?

EDIT: The reason I am doing that is that when I try to use aa-enforce, I get the following message:

Setting /bin/ping to enforce mode. Warning: unable to find a suitable fs in /proc/mounts, is it mounted? Use --subdomainfs to override.

and when i try to start Apparmor, i get this:

Cache read/write disabled: /sys/kernel/security/apparmor/features interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.) Warning from /etc/apparmor.d/bin.ping (/etc/apparmor.d/bin.ping line 28): profile /bin/ping network rules not enforced

Answer 1

First which 3.2 kernel source are you using?

• An upstream kernel?
• An Ubuntu kernel that has apparmor already patched?

The Ubuntu 12.04 (3.2) kernel should already have the apparmor patches applied, so patching is not necessary. However if you need to patch, you should be in the root of the kernel source directory, not the patch directory.

This error

Warning: unable to find a suitable fs in /proc/mounts, is it mounted? Use --subdomainfs to override.

tells me that either the apparmor kernel module is not built in, enabled, or securityfs is not mounted.

Does the directory /sys/module/apparmor exist?

• If it exists, apparmor has been builtin but may not be enabled what is the value of sudo cat /sys/module/apparmor/parameters/?

• If Y, then apparmor was enabled at kernel load but the needed filesystems may not be mounted? Is securityfs mount? What is returned by the mount command?

  • You will be looking for a line like: none on /sys/kernel/security type securityfs (rw)
  • If securityfs is mounted and apparmor is enabled what is the output of ls -a /sys/kernel/security/apparmor?

If the /sys/module/apparmor directory does not exist your kernel was not built with apparmor enabled. You will need to either install or build the kernel with apparmor builtin. It does not have to be enabled as the default LSM if you do not want, in such a situation providing security=apparmor as a kernel boot parameter will enable apparmor.