Arch Linux

ihet

Member

Registered: 2019-04-01

Posts: 11

apparmor operation="getattr"info="Failed name lookup-disconnected path

type=AVC msg=audit(1554376929.497:1145): apparmor="DENIED" operation="getattr" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/firefox{,-[0-9]*}/firefox{,*[^s][^h]}" name="dev/dri/renderD128" pid=1396 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

I got this error in my audit log when starting Firefox and after some reading and trying I solved it by adding a flag (attach_disconnected) to the profile:

/usr/lib/firefox{,-[0-9]*}/firefox{,*[^s][^h]} flags=(attach_disconnected) {

This resolved the error in audit log but I cant seem to understand what exactly this does and if it is the right way to solve this? Hoped that someone here maybe could give me an input on the matter and maybe if it is able to solve it in a better fashion?

Thanks for taking your time.

Nickolas0

Member

Registered: 2019-02-16

Posts: 30

Re: apparmor operation="getattr"info="Failed name lookup-disconnected path

Yes, it's the right way for things which need it.

Attach flags consist of two pairs of mutually exclusive flags: attach_disconnected or no_attach_disconnected (determine if path names resolved to be outside of the namespace are attached to the root, which means they have the '/' character at the beginning), and chroot_attach or chroot_no_attach (control path name generation when in a chroot environment while a file is accessed that is external to the chroot but within the namespace).