Profile="/usr/bin/whonixcheck" name="/etc/ssl/certs/ca-certificates.crt"

AppArmor
1

new deniend messages:-

output of “sudo tail -f /var/log/kern.log”:

Oct 3 13:24:08 host kernel: [ 334.522174] audit: type=1400 audit(1443878648.603:41): apparmor="DENIED" operation="open" profile="/usr/bin/whonixcheck" name="/etc/ssl/certs/ca-certificates.crt" pid=15401 comm="https" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Oct 3 13:24:09 host kernel: [ 334.983825] audit: type=1400 audit(1443878649.067:42): apparmor="DENIED" operation="open" profile="/usr/bin/whonixcheck" name="/etc/ssl/certs/ca-certificates.crt" pid=15401 comm="https" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Oct 3 13:24:09 host kernel: [ 335.556438] audit: type=1400 audit(1443878649.639:43): apparmor="DENIED" operation="open" profile="/usr/bin/whonixcheck" name="/etc/ssl/certs/ca-certificates.crt" pid=15401 comm="https" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Oct 3 13:24:10 host kernel: [ 336.222451] audit: type=1400 audit(1443878650.303:44): apparmor="DENIED" operation="open" profile="/usr/bin/whonixcheck" name="/etc/ssl/certs/ca-certificates.crt" pid=15401 comm="https" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Oct 3 13:24:10 host kernel: [ 336.683899] audit: type=1400 audit(1443878650.767:45): apparmor="DENIED" operation="open" profile="/usr/bin/whonixcheck" name="/etc/ssl/certs/ca-certificates.crt" pid=15401 comm="https" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Oct 3 13:24:11 host kernel: [ 337.151188] audit: type=1400 audit(1443878651.231:46): apparmor="DENIED" operation="open" profile="/usr/bin/whonixcheck" name="/etc/ssl/certs/ca-certificates.crt" pid=15401 comm="https" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Oct 3 13:24:11 host kernel: [ 337.730734] audit: type=1400 audit(1443878651.811:47): apparmor="DENIED" operation="open" profile="/usr/bin/whonixcheck" name="/etc/ssl/certs/ca-certificates.crt" pid=15401 comm="https" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Oct 3 13:24:12 host kernel: [ 338.406498] audit: type=1400 audit(1443878652.487:48): apparmor="DENIED" operation="open" profile="/usr/bin/whonixcheck" name="/etc/ssl/certs/ca-certificates.crt" pid=15401 comm="https" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Oct 3 13:24:13 host kernel: [ 338.968189] audit: type=1400 audit(1443878653.047:49): apparmor="DENIED" operation="open" profile="/usr/bin/whonixcheck" name="/etc/ssl/certs/ca-certificates.crt" pid=15401 comm="https" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Oct 3 13:24:13 host kernel: [ 339.459109] audit: type=1400 audit(1443878653.539:50): apparmor="DENIED" operation="open" profile="/usr/bin/whonixcheck" name="/etc/ssl/certs/ca-certificates.crt" pid=15401 comm="https" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Oct 3 13:31:18 host kernel: [ 638.209774] sda1: WRITE SAME failed. Manually zeroing.

well i dont specifically know why is this happening , but before 2 days i have installed qTox do u think this is the result of it?

this is the process when i open and close qTox:-

[code]user@host:~$ qtox
[14:58:11.724] src/persistence/settings.cpp:119 : Debug: “Loading settings from /home/user/.config/tox/qtox.ini”
[14:58:11.790] src/ipc.cpp:45 : Debug: Our global IPC ID is 14177188524503320070
[14:58:11.830] src/main.cpp:141 : Debug: built on: 15:22:49 Oct 2 2015 ( 1443813634 )
[14:58:11.830] src/main.cpp:142 : Debug: commit: e622b3fd4861c37a15f2803f1625a73628390e85

[14:58:11.830] src/nexus.cpp:77 : Debug: Starting up
libGL error: pci id for fd 10: 80ee:beef, driver (null)
libGL error: core dri or dri2 extension not found
libGL error: failed to load driver: vboxvideo
[14:58:21.938] src/persistence/profile.cpp:75 : Debug: Loading tox save “/home/user/.config/tox/TNT BOM BOM.tox”
[14:58:22.091] src/persistence/settings.cpp:340 : Debug: “Saving global settings at /home/user/.config/tox/qtox.ini”
[14:58:22.327] src/audio/audio.cpp:214 : Debug: “Opening audio output ALSA Default”
[14:58:22.330] src/audio/audio.cpp:160 : Debug: Opening audio input “ALSA Default”
[14:58:22.331] src/persistence/settings.cpp:283 : Debug: Loading personnal settings from “/home/user/.config/tox/TNT BOM BOM.ini”
[14:58:23.206] src/core/core.cpp:262 : Debug: Loading user profile
[14:58:23.206] src/persistence/profile.cpp:237 : Debug: Loading tox save “/home/user/.config/tox/TNT BOM BOM.tox”
[14:58:23.275] src/core/core.cpp:153 : Warning: Core starting with IPv6 disabled. LAN discovery may not work properly.
[14:58:23.320] src/core/core.cpp:344 : Debug: Self avatar not found
[14:58:23.481] src/widget/systemtrayicon.cpp:130 : Debug: Using the Qt backend
[14:58:24.781] src/core/core.cpp:443 : Debug: “Connecting to 212.71.252.109:33445 (Kr9r0x)”
[14:58:24.782] src/core/core.cpp:443 : Debug: “Connecting to 194.249.212.109:33445 (fluke571)”
[14:58:29.280] src/core/core.cpp:443 : Debug: “Connecting to 185.25.116.107:33445 (MAH69K)”
[14:58:29.281] src/core/core.cpp:443 : Debug: “Connecting to 192.99.168.140:33445 (WIeschie)”
[14:58:33.780] src/core/core.cpp:443 : Debug: “Connecting to 144.76.60.215:33445 (sonOfRa)”
[14:58:33.782] src/core/core.cpp:443 : Debug: “Connecting to 23.226.230.47:33445 (stal)”
[14:58:38.280] src/core/core.cpp:443 : Debug: “Connecting to 195.154.119.113:33445 (Munrek)”
[14:58:38.281] src/core/core.cpp:443 : Debug: “Connecting to 192.210.149.121:33445 (nurupo)”
[14:58:42.781] src/core/core.cpp:443 : Debug: “Connecting to 178.62.250.138:33445 (Impyy)”
[14:58:42.782] src/core/core.cpp:443 : Debug: “Connecting to 130.133.110.14:33445 (Manolis)”
[14:58:47.281] src/core/core.cpp:443 : Debug: “Connecting to 104.167.101.29:33445 (noisykeyboard)”
[14:58:47.282] src/core/core.cpp:443 : Debug: “Connecting to 205.185.116.116:33445 (Busindre)”
[14:58:49.531] src/core/core.cpp:410 : Debug: Connected to the DHT
[14:58:49.532] src/persistence/profile.cpp:302 : Debug: Saving tox save to “/home/user/.config/tox/TNT BOM BOM.tox”
[15:02:01.905] src/audio/audio.cpp:214 : Debug: “Opening audio output ALSA Default”
[15:02:01.926] src/audio/audio.cpp:160 : Debug: Opening audio input “ALSA Default”
[15:04:20.232] src/persistence/profile.cpp:302 : Debug: Saving tox save to “/home/user/.config/tox/TNT BOM BOM.tox”
[15:04:41.761] src/persistence/settings.cpp:340 : Debug: “Saving global settings at /home/user/.config/tox/qtox.ini”
[15:04:41.765] src/persistence/profile.cpp:302 : Debug: Saving tox save to “/home/user/.config/tox/TNT BOM BOM.tox”
[15:04:41.940] src/audio/audio.cpp:224 : Debug: Closing input
[15:04:41.944] src/audio/audio.cpp:242 : Debug: Closing output
[15:04:41.960] src/persistence/settings.cpp:462 : Debug: Saving personal settings at “/home/user/.config/tox/TNT BOM BOM.ini”
[15:04:53.521] src/persistence/settings.cpp:340 : Debug: “Saving global settings at /home/user/.config/tox/qtox.ini”
[15:04:53.523] src/main.cpp:274 : Debug: Clean exit with status 0
user@host:~$
[/code]

2

Cannot be sure the message appears because of the installation of qTox.

The best check would be to remove qTox and re-run whonixcheck.

3

well true it didnt solve the issue by:-

sudo apt-get remove qtox

but why i thought about qtox because of the suspecious installation of it c:-

https://wiki.tox.chat/binaries#gnulinux

so the remaining question is:- if it not qtox then whats happening ? (btw this is the last version of apparmor i have added from the source code.)

4

To make sure, can you try:

sudo apt-get purge apt-transport-https sudo apt-get purge qtox

5

ok the problem solved no more messages. except one problem:-

WARNING: Whonix Meta Packages Test Result: Whonix-Workstation detected, but the meta package whonix-workstation is not installed. Did you accidentally uninstall it? See also: https://www.whonix.org/wiki/Whonix_Debian_Packages If you know what you are doing, feel free to disable this check. Create a file /etc/whonix.d/50_whonixcheck_user and add: whonixcheck_skip_functions+=" check_packages "

you have solved the problem of the apparmor = thats mean my expectation was right

so should we fix the apparmor to be compatible with qtox ? or warn ppl to use apparmor with qtox ? or telling qtox to look for this issue? or it is not an issue ?

6

Updated whonixcheck profile. Whonix Forum

Please reinstall apparmor-profile-whonixcheck from source after Patrick has updated Whonix master branch.

You may encounter more denied messages after reinstalling qTox.

7

Merged. Done. Ready now.

8
You may encounter more denied messages after reinstalling qTox.

or unstoppable whonixcheck messages:- (i think kern.log textfile will blowup)

http://i.imgur.com/TxyunXB.png

the weird thing when it keeps showing the messages which have reached over 100+, the number is kept as 21 ?! c this:-

http://i.imgur.com/A0BfYzq.png

9

Could you post the log in the form .......... so that the whole message is readable?

10

this is the output ofsudo tail -f /var/log/kern.log:- (WS)

Oct 4 23:15:06 host kernel: [ 27.493250] loop: module loaded Oct 4 23:15:06 host kernel: [ 33.049142] NET: Registered protocol family 38 Oct 4 23:15:09 host kernel: [ 37.986112] cfg80211: Calling CRDA to update world regulatory domain Oct 4 23:15:10 host kernel: [ 38.592205] device-mapper: uevent: version 1.0.3 Oct 4 23:15:10 host kernel: [ 38.592793] device-mapper: ioctl: 4.27.0-ioctl (2013-10-30) initialised: dm-devel@redhat.com Oct 4 23:15:12 host kernel: [ 40.627445] Adding 522236k swap on /dev/mapper/swapfile. Priority:-1 extents:1 across:522236k FS Oct 4 15:28:37 host kernel: [ 444.434938] sda1: WRITE SAME failed. Manually zeroing. Oct 4 16:16:57 host kernel: [ 3347.450402] audit_printk_skb: 3 callbacks suppressed Oct 4 16:16:57 host kernel: [ 3347.450405] audit: type=1400 audit(1443975417.531:13): apparmor="STATUS" operation="profile_replace" name="/home/*/tor-browser_*/Browser/firefox" pid=23416 comm="apparmor_parser" Oct 4 16:21:45 host kernel: [ 3635.364275] audit: type=1400 audit(1443975705.127:14): apparmor="STATUS" operation="profile_replace" name="/usr/bin/whonixcheck" pid=24909 comm="apparmor_parser"

the question is why i didnt put the output at the beginning because i have seen the output is diff from WS than the GW c the diff:-

so i couldnt put the output of the GW, or there is away to put the output of the GW ?

i think im gonna enter Guinness records for the highest apparmor denied messages recorded:-

11
so i couldnt put the output of the GW, or there is away to put the output of the GW ?
VirtualBox? You can (temporarily) enable clipboard sharing. https://www.whonix.org/wiki/VirtualBox_Guest_Additions#Clipboard_Sharing
12
VirtualBox? You can (temporarily) enable clipboard sharing. https://www.whonix.org/wiki/VirtualBox_Guest_Additions#Clipboard_Sharing

thnx for reminding me. but the messages seems to be stopped after i have shutdown my pc, c the log:-

user@host:~$ sudo tail -f /var/log/kern.log Oct 5 21:33:49 host kernel: [ 18.530781] 00:00:00.004661 main Executable: /usr/sbin/VBoxService Oct 5 21:33:49 host kernel: [ 18.530781] 00:00:00.004661 main Process ID: 1160 Oct 5 21:33:49 host kernel: [ 18.530781] 00:00:00.004661 main Package type: LINUX_32BITS_GENERIC (OSE) Oct 5 21:33:49 host kernel: [ 18.533151] 00:00:00.007005 main 4.3.30_Debian r101610 started. Verbose level = 0 Oct 5 21:33:50 host kernel: [ 21.609002] cfg80211: Calling CRDA to update world regulatory domain Oct 5 21:33:50 host kernel: [ 22.042751] NET: Registered protocol family 38 Oct 5 21:33:54 host kernel: [ 25.395346] device-mapper: uevent: version 1.0.3 Oct 5 21:33:54 host kernel: [ 25.396071] device-mapper: ioctl: 4.27.0-ioctl (2013-10-30) initialised: dm-devel@redhat.com Oct 5 21:33:55 host kernel: [ 26.243994] Adding 522236k swap on /dev/mapper/swapfile. Priority:-1 extents:1 across:522236k FS Oct 5 13:44:56 host kernel: [ 650.882370] sda1: WRITE SAME failed. Manually zeroing.

but something weird happened inside the WS:-

http://i.imgur.com/OUbgwNJ.png

can i do this? c the image:-

http://i.imgur.com/BDQFxAJ.png

13

Yes
(Related: Debian Packages - Whonix)