Arch Linux

heinrich5991

Member

Registered: 2012-10-01

Posts: 13

[SOLVED] After installing, AppArmor doesn't seem to work.

The problem:
After installing AppArmor from the AUR, activating it for boot time and rebooting the machine, AppArmor doesn't seem to work. When I execute

# aa-status

I only get

apparmor module is loaded.
You do not have enough privilege to read the profile set.

The only similar problem I found was this question on the StackExchange network, but since the ArchLinux Wiki mentions that the kernel in the official repository is compiled with AA-support, this should be a non-issue.

Some stuff:

$ mount | grep security
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
$ dmesg | grep -i apparmor
[    0.000000] Command line: BOOT_IMAGE=/vmlinuz-linux root=UUID=4d0e1a4c-9baa-4a6d-9231-2098bbfd3dc9 ro cryptdevice=UUID=a6a9bb52-2643-4cac-b32b-1502c7cd1f55:root apparmor=1 security=apparmor quiet
[    0.000000] Kernel command line: BOOT_IMAGE=/vmlinuz-linux root=UUID=4d0e1a4c-9baa-4a6d-9231-2098bbfd3dc9 ro cryptdevice=UUID=a6a9bb52-2643-4cac-b32b-1502c7cd1f55:root apparmor=1 security=apparmor quiet
[    0.000037] AppArmor: AppArmor initialized
[    0.250872] AppArmor: AppArmor Filesystem Enabled
[   36.651302] type=1400 audit(1372452512.345:2): apparmor="STATUS" operation="profile_load" name="/bin/syslog-ng" pid=520 comm="apparmor_parser"
[   36.790555] type=1400 audit(1372452512.482:3): apparmor="STATUS" operation="profile_load" name="/usr/bin/ntpd" pid=520 comm="apparmor_parser"
[   37.249605] type=1400 audit(1372452512.942:4): apparmor="STATUS" operation="profile_load" name="/bin/klogd" pid=520 comm="apparmor_parser"
[   37.478716] type=1400 audit(1372452513.172:5): apparmor="STATUS" operation="profile_load" name="/usr/bin/mdnsd" pid=520 comm="apparmor_parser"
[   37.740180] type=1400 audit(1372452513.432:6): apparmor="STATUS" operation="profile_load" name="/bin/syslogd" pid=520 comm="apparmor_parser"
[   38.033876] type=1400 audit(1372452513.725:7): apparmor="STATUS" operation="profile_load" name="/usr/bin/dnsmasq" pid=520 comm="apparmor_parser"
[   38.249323] type=1400 audit(1372452513.942:8): apparmor="STATUS" operation="profile_load" name="/usr/lib/dovecot/dovecot-auth" pid=520 comm="apparmor_parser"
[   38.324157] type=1400 audit(1372452514.018:9): apparmor="STATUS" operation="profile_load" name="/usr/lib/dovecot/imap-login" pid=520 comm="apparmor_parser"
[   38.580784] type=1400 audit(1372452514.275:10): apparmor="STATUS" operation="profile_load" name="/usr/lib/dovecot/pop3-login" pid=520 comm="apparmor_parser"
[   38.684721] type=1400 audit(1372452514.378:11): apparmor="STATUS" operation="profile_load" name="/usr/lib/dovecot/deliver" pid=520 comm="apparmor_parser"
# cat /sys/module/apparmor/parameters/enabled
Y

Last edited by heinrich5991 (2013-06-30 13:01:08)

teekay

Member

Registered: 2011-10-26

Posts: 271

Re: [SOLVED] After installing, AppArmor doesn't seem to work.

https://bbs.archlinux.org/viewtopic.php … 7#p1288987

Last edited by teekay (2013-06-29 17:35:28)

heinrich5991

Member

Registered: 2012-10-01

Posts: 13

Re: [SOLVED] After installing, AppArmor doesn't seem to work.

https://bbs.archlinux.org/viewtopic.php … 7#p1288987

So this means I need to recompile the current kernel + these two patches? If so, is there a reason why they aren't integrated into the repository kernel?

teekay

Member

Registered: 2011-10-26

Posts: 271

Re: [SOLVED] After installing, AppArmor doesn't seem to work.

Correct.

They are not in the core kernel as that's against the Arch philosophy I guess. The real question is why the heck they don't get pushed into mainline by Canonical (or OpenSUSE, their version of the patches looks less intrusive and more clean, which is why they are recommended here in the forums)

heinrich5991

Member

Registered: 2012-10-01

Posts: 13

Re: [SOLVED] After installing, AppArmor doesn't seem to work.

This fixes the issue, topic can be closed.

teekay

Member

Registered: 2011-10-26

Posts: 271

Re: [SOLVED] After installing, AppArmor doesn't seem to work.

You can close it yourself by adding [solved] to the title of the thread.