Whonix AppArmor Profiles Development Discussion

Patrick · November 13, 2015, 5:10pm

[quote=“troubadour, post:620, topic:108”]An update to apparmor-profile-icedove.
https://github.com/troubadoour/apparmor-profile-icedove/commit/a2859e5bb1e1d03a9dab7dce712a4e42f35b01d6[/quote]
Merged.

Patrick · November 13, 2015, 6:09pm

All apparmor profiles have been updated in the testers repository. (usual delay of ~ 1 hour for mirror.whonix.de)

Patrick · November 28, 2015, 7:55pm

simi · November 30, 2015, 2:31pm

Got this error on gateway when installing apparmor–profiles-whonix from testers (virtualbox profile error line 50…“allows dangerous…”)

Patrick · November 30, 2015, 8:10pm

It’s a warning. Not an error. A non-perfection of the profile.

Patrick · November 30, 2015, 8:10pm

Patrick · December 3, 2015, 9:20pm

Are you subscribed (“watch” function) to torbrowser-launcher at github? There was some minor apparmor change. I could keep posting these here, since I subscribed to torbrowser-launcher at github. (Need to keep up with TBB changes.)

troubadour · December 4, 2015, 8:05pm

Yes, I’m subscribed to torbrowser-launcher at github.

We may need it some day, so added the line to the Whonix profile.

troubadour · December 4, 2015, 10:11pm

A new one. Related: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=805074
fix some denied messages due to installation of iceowl-extension in l… · troubadoour/apparmor-profile-icedove@9ff1964 · GitHub

troubadour · December 5, 2015, 9:35pm

Most likely related to the above.

Patrick · December 5, 2015, 10:33pm

Are you sure + /etc/timezone.anondist r, · troubadoour/apparmor-profile-anondist@659bb0b · GitHub is required?

Shouldn’t /etc/apparmor.d/tunables/home.d/anondist prevent need for that?

alias /etc/timezone -> /etc/timezone.anondist,
alias /etc/timezone -> /etc/timezone.anondist-orig,

( apparmor-profile-anondist/anondist at ad9af43077e907e5c68e8f2508392e1c74663d06 · troubadoour/apparmor-profile-anondist · GitHub )

Patrick · December 5, 2015, 10:34pm

Or thinking about this differently… Please revert + /etc/timezone.anondist r, · troubadoour/apparmor-profile-anondist@659bb0b · GitHub and add /etc/timezone r, to apparmor-profile-icedove instead please.

Patrick · December 10, 2015, 1:37pm

Two icedove denied messages. Happening when you try to store a file in Qubes-Whonix inside the ~/Downloads folder.

Dec 10 13:30:11 host kernel: [49430.266714] audit: type=1400 audit(1449754211.436:23): apparmor="DENIED" operation="open" profile="/usr/lib/icedove/icedove" name="/home/user/" pid=20708 comm="pool" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000

.

Dec 10 13:30:14 host kernel: [49433.517170] audit: type=1400 audit(1449754214.687:24): apparmor="DENIED" operation="mkdir" profile="/usr/lib/icedove/icedove" name="/home/user/.config/gtk-2.0/" pid=3337 comm="icedove" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000

Patrick · December 10, 2015, 2:38pm

This is now a bug.

github.com

Kicksecure/apparmor-profile-thunderbird/blob/9ff1964edc96feac948bad6e65a36b8b8eaa4d1c/etc/apparmor.d/usr.lib.icedove.icedove#L128


      
          /usr/bin/gpg rix,
          /usr/bin/gpg2 rix,
          /usr/bin/gpg-agent rix,
          /usr/bin/gpg-connect-agent rix,
          /usr/bin/gpgconf rix,
          /usr/bin/pinentry* rix,
          /usr/bin/mkdir rix,
          /usr/bin/update-desktop-database rix,
          /usr/bin/dpkg rix,
          /usr/bin/dpkg-query rix,
          /usr/bin/torbrowser Px,
          /usr/bin/qubesdb-cmd rix,
          
          

          
## Unneeded on normal Debian Jessie System (untested on Qubes OS).
          # /sys/devices/pci0000:00/0000:00:02.0/uevent r,
          
          
## Allow to open links via iceweasel.
          ## This requires iceweasel to be already running since the process forked
          ## by icedove runs with the same profile as icedove.
          /usr/lib/iceweasel/iceweasel rix,

Opening links from iceweasel in Tor Browser no longer works because we deprecated the /usr/bin/torbrowser AppArmor profile. Any idea how to fix it?

troubadour · December 10, 2015, 5:24pm

Yes, we run /usr/bin/torbrowser unconfined. Tor Browser is still enforced.

Patrick · December 10, 2015, 5:32pm

Merged.
…

Patrick · December 10, 2015, 7:58pm

Minor.

Patrick · January 29, 2016, 9:09pm

troubadour · January 31, 2016, 11:58am

Merged.

Patrick · February 10, 2016, 12:21am

systemd AppArmorProfile= directive unavailable leads to not loading AppArmor profile on Debian jessie:

systemd AppArmorProfile= directive unavailable leads to not loading AppArmor profile on Debian jessie (#18294) · Issues · Legacy / Trac · GitLab
[Whonix-devel] whonix apparmor not enforcing for tor process?