AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy

AppArmor
438

That fix was uploaded just now to all repositories.

1 Like
439

I think this is ready for a call for testers. Can you post it?

1 Like
440

Was merged just now.

1 Like
441

Draft needed.

Could you write something similar as Using apparmor-profile-everything on Debian Buster? (Can be shorter - can be longer - but need some text to post.)

1 Like
442

A post was split to a new topic: Full System AppArmor Policy - Testers Wanted!

443

The call for testes news went live.

444

Could you fix these please?

Oct 08 17:56:29 host audit[1907]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/lib/whonix-firewall/" name=“/usr/bin/whonix_firewall” pid=1907 comm=“enable-firewall” requested_mask=“x” denied_mask=“x” fsuid=0 ouid=0 target="/usr/lib/whonix-firewall///null-/usr/bin/whonix_firewall”

Oct 08 17:56:29 host audit[1907]: AVC apparmor=“ALLOWED” operation=“file_mmap” profile=“/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall” name=“/bin/bash” pid=1907 comm=“whonix_firewall” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0

Oct 08 17:56:29 host audit[1924]: AVC apparmor=“ALLOWED” operation=“open” profile=“/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-workstation-firewall//null-/usr/bin/id” name=“/lib/x86_64-linux-gnu/libnss_files-2.28.so” pid=1924 comm=“id” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0

Oct 08 17:56:29 host audit[1924]: AVC apparmor=“ALLOWED” operation=“file_mmap” profile=“/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-workstation-firewall//null-/usr/bin/id” name=“/lib/x86_64-linux-gnu/libnss_files-2.28.so” pid=1924 comm=“id” requested_mask=“rm” denied_mask=“rm” fsuid=0 ouid=0

1 Like
445

https://github.com/Whonix/whonix-firewall/pull/8

1 Like
446

Merged.

1 Like
447

A telegram user reported broken shared folders. Perhaps access should be very permissive to this directory?

2 Likes
448

What directory? Shared folders can be set at arbitrary directories. It’s impossible to support all configurations at once. Unless you’re referring to ~/shared? That’s already allowed. You just can’t execute from it.

2 Likes
449

Yeah I was referring to /mnt/shared in the VM.

2 Likes
450
2 Likes
451
1 Like
452 
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**" name="/proc/cmdline" pid=2712 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**" name="/proc/cmdline" pid=2713 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="exec" profile="/usr/lib/whonix-firewall/**" name="/usr/bin/whonix_firewall" pid=2717 comm="enable-firewall" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 target="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/bin/bash" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/ld-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/etc/ld.so.cache" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libtinfo.so.6.1" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libtinfo.so.6.1" pid=2717 comm="whonix_firewall" requested_mask="rm" denied_mask="rm" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libdl-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libdl-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="rm" denied_mask="rm" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libc-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libc-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="rm" denied_mask="rm" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/dev/tty" pid=2717 comm="whonix_firewall" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/locale/locale-archive" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/etc/nsswitch.conf" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/etc/ld.so.cache" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libnss_files-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libnss_files-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="rm" denied_mask="rm" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/etc/passwd" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/bin/whonix_firewall" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="exec" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/bin/whonix-gateway-firewall" pid=2718 comm="whonix_firewall" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 target="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-gateway-firewall"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-gateway-firewall" name="/usr/bin/bash" pid=2718 comm="whonix-gateway-" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-gateway-firewall" name="/usr/lib/x86_64-linux-gnu/ld-2.28.so" pid=2718 comm="whonix-gateway-" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-gateway-firewall" name="/etc/ld.so.cache" pid=2718 comm="whonix-gateway-" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
453

All of these are already allowed.

1 Like
454

Similar to AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy - #444 by Patrick

Aren’t these just ALLOWED because the profile is still in complain mode and not yet in enforce mode? If the profile was in enforce mode, I guess these would become DENIED?

Why would the log mention ALLOWED? If apparmor profiles would log everything every time something was allowed, that would overwhelm logs. So even if allowed, that log message should be made gone somehow?

1 Like
455

I’m not sure why this is happening but the denials you’re facing are certainly already allowed, many of them in the base abstraction.

1 Like
456
457

Merged.

Cannot reproduce anymore. Perhaps I missed journalctl -b or --boot.

1 Like