Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to use AppArmor on a remote hosted Xen server with a custom built kernel.

AppArmor appears to be running, but not correctly. For example if I run the following command as root:

# aa-status
apparmor module is loaded.
You do not have enough privilege to read the profile set.

Any ideas what's going on would be helpful. Thank you!

Here's my kernel options:

# grep -i APPARMOR /boot/config-3.6.11-xen 
CONFIG_SECURITY_APPARMOR=y
CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
CONFIG_DEFAULT_SECURITY_APPARMOR=y
CONFIG_DEFAULT_SECURITY="apparmor"

dmesg showing AppArmor started:

# dmesg | grep AppArmor
AppArmor: AppArmor initialized
AppArmor: AppArmor Filesystem Enabled

AppArmor hooks in /sys and their corresponding values:

(Note: no /sys/kernel/security/apparmor/profiles)

# for x in $(find /sys -type f | grep apparmor) ; do echo -n "$x - "; cat $x ; done
/sys/kernel/security/apparmor/features/rlimit/mask - cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
/sys/kernel/security/apparmor/features/capability - 0xffffff
/sys/kernel/security/apparmor/features/file/mask - create read write exec append mmap_exec link lock
/sys/kernel/security/apparmor/features/domain/change_profile - yes
/sys/kernel/security/apparmor/features/domain/change_onexec - yes
/sys/kernel/security/apparmor/features/domain/change_hatv - yes
/sys/kernel/security/apparmor/features/domain/change_hat - yes
/sys/kernel/security/apparmor/.remove - cat: /sys/kernel/security/apparmor/.remove: Invalid argument
/sys/kernel/security/apparmor/.replace - cat: /sys/kernel/security/apparmor/.replace: Invalid argument
/sys/kernel/security/apparmor/.load - cat: /sys/kernel/security/apparmor/.load: Invalid argument
/sys/module/apparmor/parameters/mode - enforce
/sys/module/apparmor/parameters/audit - normal
/sys/module/apparmor/parameters/debug - N
/sys/module/apparmor/parameters/paranoid_load - Y
/sys/module/apparmor/parameters/enabled - Y
/sys/module/apparmor/parameters/path_max - 8192
/sys/module/apparmor/parameters/logsyscall - N
/sys/module/apparmor/parameters/lock_policy - N
/sys/module/apparmor/parameters/audit_header - Y

The user-land packages I have installed:

# dpkg -l apparmor*
Version                                         Description
+++-===============================================-===============================================-==============================================================================================================
ii  apparmor                                        2.7.102-0ubuntu3.7                              User-space parser utility for AppArmor
ii  apparmor-notify                                 2.7.102-0ubuntu3.7                              AppArmor notification system
ii  apparmor-profiles                               2.7.102-0ubuntu3.7                              Profiles for AppArmor Security policies
ii  apparmor-utils                                  2.7.102-0ubuntu3.7                              Utilities for controlling AppArmor

Again, if anyone has any idea why it's not operating correctly, including user-error, let me know. As far as I can see it looks like it should be working.

Thanks again for any guidance.

share|improve this question
add comment

1 Answer

I had the same problem ;)

  • Just download a apparmor package from: http://launchpad.net/apparmor/2.7/2.7.2/+download/apparmor-2.7.2.tar.gz

  • navigate to: /apparmor-2.7.2/kernel-patches/3.1 < Here you have a patches for the kernel. Don't worry - they are working with 3.2.x version ;)

  • patch the kernel, select the option "Enable AppArmor 2.4 compatability" (eg. from make nconfig/make menuconfig).

  • Compile and be happy with fully working apparmor

Hope it helps!

PS. Sorry for my lame english - It's not my primary language :)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.