Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [apparmor]

AppArmor ("Application Armor") is a mandatory access control (MAC) like security system for Linux. It is designed to work with standard Unix discretionary access control (DAC) permissions while being easy to use and deploy, by allowing an admin to confine only specific applications.

0
votes
0answers
24 views

Can't load /etc/my.cnf because of Apparmor

I installed MYSQL 5.7 and can't load data from /etc/my.cnf because of Apparmor. Tried this manual, but my.cnf still blocked by Apparmor. journalctl -xe output: Nov 24 11:12:21 JCSM002 audit[27912]: ...
0
votes
0answers
47 views

Enabling apparmor for Apache2 in Ubuntu 18.04

I’m looking for a way to enable the Apache2 apparmor profile on Ubuntu Server 18.04 According to the documentation it has to be manually activated (opt-in): https://wiki.ubuntu.com/SecurityTeam/...
-2
votes
1answer
131 views

Even with root user Im receiving 'Operation not permitted' when try creating gluster volume between Ubuntu 14.04 LXC containers

Even with root user Im receiving 'Operation not permitted' when try creating gluster volume between Ubuntu 14.04 LXC containers. Need test the solution locally before install it on prodution and even ...
0
votes
0answers
35 views

How to lock down application using appamor in Ubuntu

I am trying to lock down tcpdump from being executed on a system using apparmor and I have successfully stopped the process from running using the profile below. My question is...is there a way to ...
0
votes
0answers
160 views

libvirt snapshot-create-as failing when using --disk-only flag with apparmor

I am trying to create a snapshot for an existing domain using the following command. virsh snapshot-create-as test-vm test-backup "test-backup-1" --disk-only --atomic --no-metadata I get the ...
0
votes
2answers
864 views

Permission denied error when launching instance (“Could not open backing file”)

Working with OpenStack, installed from packages available on Debian testing (buster). When I try to launch an instance, it fails after building with this message in nova-compute.log: Could not open ...
0
votes
0answers
77 views

How to set niceness of mysql under ubuntu with apparmor

I am trying to setup mysqld with a lower priority to prioritize Web Application tasks on the same server. I did the following in /etc/mysql/mysql.conf.d/mysqld.cnf [mysqld_safe] socket = /...
3
votes
1answer
786 views

How do I get the right AppArmor profile for mysql on Ubuntu?

I think I have an old profile (copied below). I don't know where to look to find the correct profile. Is there an authoritative source for standard apparmor profiles - or would this be somewhere in ...
1
vote
0answers
112 views

AppArmor denies changes in mysqld.cnf

I've got the following issue with MySQL on an Ubuntu 16.04.3 LTS instance with AppArmor activated. The issue happens when changing MySQL's bind-address to anything other than 127.0.0.X and restarts ...
1
vote
0answers
143 views

apparmor.service fails within container (LXC)

I am trying to enable apparmor within the privileged container but for some reason it fails. I have already enabled the apparmor in the host kernel(4.9) and also in the userspace(apparmor 2.11 version)...
2
votes
0answers
91 views

AppArmor: How to apply different profiles for same executable according to UID?

I'd like to jail my (chrooted) php-fpm pool workers using AppArmor. As each pool runs under a separate UID, I'd like to apply different AppArmor profiles for the workers so that a worker process can ...
0
votes
0answers
307 views

Unprivileged lxc container versus AppArmor

I want to run several instances of apache2 (2.4 to be precise) with php 7 (libapache2-mod-php7.0) under debian stretch. Is it more secure to run every instance (with its own config) in its own ...
6
votes
2answers
2k views

How to disallow the Docker Daemon to mount host's root file system into the container

I have the following Container Setup. On a bare metal server there are two Docker Daemons installed and running. Main Docker Daemon Runs my application containers exposing 80/443 to the outside ...
0
votes
1answer
326 views

rsyslogd wont start correctly on Ubuntu 14.04.4 LTS while using the Init-Script

somehow my init-script for rsyslogd does not work. I tried to enable rsyslogd to accept logging-data on udp:514. If I start my rsyslogd via Init-Script, no logging-data is forwarded. Not even syslog! ...
3
votes
2answers
503 views

Does nginx really need dac_override in its AppArmor policy?

I am building an AppArmor policy for nginx in Ubuntu 14.04 and I cannot make it work without enabling the dac_override capability. Does nginx really need this enabled or is there some way to work ...
0
votes
1answer
817 views

Dovecot auth-worker permission denied to PAM and even /dev/log

Problem I have a problem dovecot authenticating users via pam_sss.so (in an LXC container, which may be related or may be not). # doveadm auth login semenov Password: passdb: semenov auth failed ...
0
votes
1answer
138 views

How to install Apparmor profile on Ubuntu 14.04 for sendmail?

I am running sendmail on ubuntu 14.04 together with OpenEmm. The man page of OpenEmm claims that I have to add some lines to the Apparmor profile if it is active. Unfortunately there is no sendmail ...
3
votes
1answer
221 views

kvm snapshot-create-as failed

I have Ubuntu server with qemu/kvm. I'm try to create snapshot (for further backup) using libvirt and get this error: # virsh snapshot-create-as --domain 56 --name copy_snap --no-metadata --disk-only ...
0
votes
3answers
939 views

BIND9 denying queries from IPs outsite localnet (External IPs) on Ubuntu

BIND9 denying queries from IPs outsite localnet (External IPs) on Ubuntu. options { listen-on port 53 { any; }; directory "/var/bind"; allow-query ...
1
vote
1answer
61 views

Bind9 and different zone locations

I'm just trying to get a DNS server off the ground and most of the guides I followed online tells me to create zone files in /etc/bind/zones or just /etc/bind/. But I want to use a different path, /...
1
vote
1answer
74 views

Processes not in enforce mode although a profile is defined?

I have defined the following profile #include <tunables/global> /usr/bin/convert.im6 { #include <abstractions/base> /usr/bin/convert.im6 mr, /** mrwlkix, set rlimit as <= ...
2
votes
0answers
237 views

Apparmor default allow profile

I read this page and confused: http://wiki.apparmor.net/index.php/FAQ#What_is_Default_Deny_.28White_listing.29 I want to create a profile for my command and I want my profile be in "default allow (...
3
votes
2answers
3k views

New Dovecot install not allowing login, giving permissions error despite saying that permissions “appear ok”

I'm installing dovecot onto a Virtualbox VM running Ubuntu Server 64-bit 14.04 guest. Dovecot itself is being installed into a Docker container (I'm not sure that that's relevant here, but am noting ...
2
votes
1answer
5k views

mysql wont start after update (seems an apparmor issue)

I just updated mysql-server to 5.5.35-0ubuntu0.12.04.1 and MySQL does not restart anymore. dmesg shows following errors: [ 832.490460] type=1400 audit(1392612759.575:31): apparmor="STATUS" operation=...
5
votes
1answer
2k views

Apparmor denies ntpd access to its own logs

ntpd complains that it cannot access its own logs # ntpd -qgddd ... 11 Sep 16:23:00 ntpd[7262]: can't open /var/log/ntpstats/peerstats.20130911: Permission denied ... 11 Sep 16:23:01 ntpd[7262]: ...
0
votes
2answers
1k views

apparmor blocking mysql start

I'm running ubuntu 12.04 and moved the datadir for my mysql server (retaining same ownerships and permissions) from /var/lib/mysql to /u/apps/mysql in /etc/mysql/my.cnf, then I updated /etc/apparmor.d/...
0
votes
1answer
100 views

Is there a way to restore iptables rules to the ones set after a fresh installation?

I have a server which is being kept behind a corporate firewall, so the corporate firewall takes care of all firewall issues. After making a fresh installation of the server, and setting the ...
1
vote
1answer
3k views

need to configure BIND server query logging with versions

I've been trying to get BIND server query logging working, creating 3 versions, max 100mb each. The system is SUSE SLES 11. I have found numerous how to articles on the web but none of them do ...
2
votes
1answer
3k views

Best way to set up permissions with nginx + php-fpm on shared hosting?

I'm running a shared hosting server with nginx and php-fpm on Debian. Everything works fine, php-fpm has separate pools for each users running as separate users and they each have their own socks. ...
3
votes
1answer
2k views

Mounting a network file system inside LXC on Ubuntu 12.10

On an Ubuntu 12.10 server, I created an Ubuntu cloud lxc container. In the /var/lib/lxc/MY_CONTAINER/config file, I uncommented the line: lxc.aa_profile = unconfined and started the container. ...
4
votes
1answer
2k views

AppArmor - root: “You do not have enough privilege to read the profile set.”

I'm trying to use AppArmor on a remote hosted Xen server with a custom built kernel. AppArmor appears to be running, but not correctly. For example if I run the following command as root: # aa-...
4
votes
2answers
2k views

Strict security and virtual host isolation with Nginx?

I currently have an Apache web server set up under which each virtual host is isolated using HTTPD-ITK and the AppArmor module. Each virtual host's workers are setuid/setgid by the server and are ...
4
votes
1answer
152 views

How can I run a command with a specific AppArmor profile/hat?

I'm hoping there exists something like sudo for AppArmor, so I can run something in a context like: aado -hat my-hat command arg arg arg Does this exist?
0
votes
1answer
554 views

gcc sandboxing tool - AppArmor / CHROOT jail on Ubuntu 12.04

We have a Node application as the front end to a C++ sandboxing tool, which compiles code using gcc and outputs the result to the browser. e.g. exec("gcc -o /tmp/test /tmp/test.cpp", function (...
1
vote
1answer
2k views

How do I patch my kernel 3.2 with apparmor kernel patches?

I have Ubuntu 12.04 with kernel 3.2 (64 bits) I downloaded apparmor-2.8.0.tar.gz at https://launchpad.net/apparmor/2.8/2...r-2.8.0.tar.gz After I untar, I go into apparmor-2.8.0/kernel-patches/3.2/ ...
2
votes
1answer
992 views

How to properly secure Unicorn/RoR server on ubuntu? Or, harden RoR application stack?

I have few Unicorn servers running on Ubuntu 12.04 and I am looking to secure them against exploits which give remote shell. My main concern is, if it makes sense to deploy ModSecurity? Another ...
5
votes
0answers
282 views

Apparmor externally included hats not working

Running apache2 on Ubuntu 12.04, using mod-apparmor for change-hat support. I have installed and verified that change-hat is working but that it is not working for externally included hats like the ...
0
votes
1answer
648 views

Do I need to chroot BIND 9 if I'm using AppArmor? [duplicate]

Possible Duplicate: bind9 in a chroot jail - necessary or not? I'm redoing my external dns servers and thinking about skipping chroot this time. And using apparmor or selinux as an alternativen. ...
1
vote
1answer
214 views

Ubuntu 10.04 bind9 local zone include files and apparmor

Rather than putting all my zones in one named.conf.local file, I'd like to have them in groups that I can manage as separate files. So, I've tried putting the following into named.conf.local: ...
3
votes
2answers
4k views

MySQL moving ibdata & ib_logfile

I'm trying to move ibdata & ib_logfile on ssd drive. I tried this way, but it don't work: service mysql stop cd /var/lib/ cp -ra mysql mysql_backup cp -a mysql/ibdata1 mysql/ib_logfile* /...
1
vote
1answer
2k views

apparmor on fedora / rhel / centos

My application relies heavily on AppArmor for security. I use Ubuntu to host it myself, but I have gotten requests from others that want to host in on a Fedora or RHEL machine. Now I am aware that ...
1
vote
1answer
1k views

Creating a raw InnoDB disk in Ubuntu 10.04 with LVM

I'm trying to create a 2TB raw partition for MySQL/InnoDB to use on one of my LVM's. I created the raw disk: Disk /dev/mapper/g0-sql: 2190.4 GB, 2190433320960 bytes 255 heads, 63 sectors/track, ...
11
votes
1answer
9k views

mysql init-file config option giving file not found error

I want to have a SQL script run whenever mysql starts but I can't get it working in Ubuntu 11.10. I added a "init-file" option to the mysql config file: > sudo emacs -nw /etc/mysql/my.cnf ... [...
3
votes
2answers
785 views

apparmor not working ubuntu 11.04 insize OpenVZ

so it seems I have everything installed, but apparmor_status gives "apparmor module is not loaded." Also some apparmor scripts check for presence of /sys/module/apparmor and it is not there... Any ...
11
votes
1answer
366 views

apparmor: same profile for multiple apps

so I have: #include <tunables/global> /usr/bin/python2.7 { /** mixrw, deny /** lwk, } /usr/lib/jvm/java-6-openjdk/jre/bin/java { /** mixrw, deny /** lwk, } /var/www/service/...
1
vote
1answer
156 views

AppArmor failing to start

I'm trying to start AppArmor in an openSUSE 11.4 system. I run: rcapparmor start and I always get this error: Starting AppArmor Loading AppArmor module failed Is there any log ...
3
votes
1answer
2k views

Creating a Linux “sandbox” with AppArmor

I'm trying to sandbox a particular Python process, giving it access only to network communications and a select number of files on the file system. I followed the directions on the Ubuntu community ...