AppArmor & FoxyProxy denied message

[phabricator-migrator]

Information

ID: 662
PHID: PHID-TASK-fzu4hm5huqdi66rihrcn
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Low

Description

https://forums.whonix.org/t/apparmor-foxyproxy

FoxyProxy works fine with Tor Browser 7.0a2 hardened, but the AppArmor message appears as follows:

apparmor="DENIED" operation="open"
profile="/home/**/tor-browser*/Browser/firefox"
name="/run/user/1000/dconf/user" pid=XXXX comm="firefox"
requested_mask="rwc" denied_mask="rwc" fsuid=1000 ouid=1000

Comments

---

JasonJAyalaP

2017-06-27 17:34:40 UTC

I’ll talk with torjunkie in the forum. I’ll close this ticket because it’s not a whonix 14 blocker, and every AA fix can’t have its own ticket

---

Patrick

2017-06-27 22:34:54 UTC

Probably hasn’t solved itself. This bug report presupposes quite a lot knowledge, isn’t well described. Reproduction isn’t obvious since it has two prerequisites. To explain what this is about and required for reproduction:

• sudo apt-get install apparmor-browser-profile (plus newer version from GitHub - Kicksecure/apparmor-profile-torbrowser: AppArmor profile for The Tor Browser Bundle (TBB) - https://www.whonix.org/wiki/AppArmor - for better security (hardening).)
• foxy proxy in use as per https://www.whonix.org/wiki/Template:FoxyProxy
  ** (used here: Login required - Whonix)

very AA fix can’t have its own ticket

Why not? How else would we keep track of which ones are fixed?

---

JasonJAyalaP

2017-06-28 22:01:04 UTC

Probably hasn’t solved itself.
You told him it wasn’t a problem. But if you think it’s worth it, alright.

Why not? How else would we keep track of which ones are fixed?
We have a “no unknown denied” policy with AA? Alright.

Patrick reopened this task as “Open”.
And they’re blockers? Fine with me.

To explain what this is about and required for reproduction

OK i’m investigating.

---

JasonJAyalaP

2017-06-28 23:00:42 UTC

I opened a ticket on the FoxyProxy system:

Hi. I’m debugging an app armor profile for the tor browser bundle. A user noticed a denied message while using foxy proxy. The file the browser wants to access was /run/user/1000/dconf/user. (/run/user/1000 is the user-specific tmp directory)

I’m trying to replicate it with the latests version of FP standard and TBB/firefox

I noticed that the dconf folder and user file is created when FP is installed. I’m vaguely aware that dconf is a backend to GSettings (used to store settings, particularly for Gnome apps?). I’m guessing that FP uses this to store temporary values? I grepped the FP src for dconf/gsettings, but I’m unsure when exactly this file is read and written to. (I fiddled around with FP, but dconf/user is still empty).

Thanks for your time!

---

JasonJAyalaP

2017-06-28 23:08:33 UTC

What do the other AA profiles do with the /run/user/1000? We give them access to 1000/APPNAME only?

Ahh. I see icedove has:

owner /run/user/[0-9]*/dconf/user rw

FP unfortunately uses dconf/user, which looks pretty generic and is shared by icedove, for example. I bet more apps use it. I don’t see how these apps can have access to dconf/user (which I assume is necessary for their function) without the above line, therefore being able to see each other’s tmp settings (while running)

---

Patrick

2017-06-29 00:14:31 UTC

owner /run/user/[0-9]*/dconf/user rw

If it works… Perhaps add it as comment.

Or does it work when denied?

---

JasonJAyalaP

2017-06-29 00:20:18 UTC

FP replied

Sorry, but we have no idea what dconf/settings is. FoxyProxy does not read or write to such a file

Or does it work when denied?
FP is certainly creating it. Or maybe firefox when it interacts with certain plugin features?
I cant get latest FP on latest TB to actually use that file (and generate an error). I’m not sure what torjunkie does to trigger it.

---

Patrick

2017-06-29 00:45:53 UTC

I cant get latest FP on latest TB to actually use that file (and generate an error). I’m not sure what torjunkie does to trigger it.

Actually use foxyproxy?

---

JasonJAyalaP

2017-06-29 01:18:08 UTC

Do you got a proxy I can configure it to use? Still waiting for him to reply.

---

Patrick

2017-06-29 12:08:14 UTC

A local proxy should do. Use any of these guides.

• foxy proxy in use as per https://www.whonix.org/wiki/Template:FoxyProxy
  ** (used here: Login required - Whonix)

(any from this list)

I doubt the proxy has to be functional for this apparmor warning to pop up.

---

JasonJAyalaP

2017-06-30 03:30:39 UTC

Ahh I see. I can setup i2p/freenet/zeronet and use FP to go through that.

I got zeronet working and browsing around. Latest aa profiles, aa-notify -p, journctl -f

No denied messages.

owner /run/user/[0-9]*/dconf/user rw

If it works… Perhaps add it as comment.
It would need to be added to tor browser aa profile. Are you willing to accept that? It seems some extensions save temporary info here and firefox creates it and uses it for them.

Or does it work when denied?
Torjunkie didn’t say that FP stopped working. Or we can add the line to tor browser aa since sooner or later some extension will need access to it?

Actually use foxyproxy?
I doubt the proxy has to be functional for this apparmor warning to pop up.

The hell? Lol. I install FP, force a missing proxy, and get no message. You tell me to “actually use it” and setup it up with i2p/freenet/zeronet/etc. Then you say it doesn’t make a difference? Ha. No matter. I did both things and can’t get the denied message.

---

Patrick

2017-06-30 10:15:45 UTC

! In T662#13958, @JasonJAyalaP wrote:
Ahh I see. I can setup i2p/freenet/zeronet and use FP to go through that.

I got zeronet working and browsing around. Latest aa profiles, aa-notify -p, journctl -f

No denied messages.

Great, so this can be closed until we hear back from anyone any instructions on how to reproduce this.

owner /run/user/[0-9]*/dconf/user rw

If it works… Perhaps add it as comment.
It would need to be added to tor browser aa profile. Are you willing to accept that? It seems some extensions save temporary info here and firefox creates it and uses it for them.

Why would I oppose a comment. A commented out command. It does nothing. It only helps users who need this. Who’d manually add it to the /etc/apparmor.d/local folder.

Or does it work when denied?
Torjunkie didn’t say that FP stopped working. Or we can add the line to tor browser aa since sooner or later some extension will need access to it?

No.

Actually use foxyproxy?
I doubt the proxy has to be functional for this apparmor warning to pop up.

The hell? Lol. I install FP, force a missing proxy, and get no message. You tell me to “actually use it” and setup it up with i2p/freenet/zeronet/etc. Then you say it doesn’t make a difference? Ha. No matter. I did both things and can’t get the denied message.

Well, I am using various degrees of uncertainty words.

---

JasonJAyalaP

2017-07-01 01:41:45 UTC

Ok. I added the commented line to home.tor-browser.firefox

I also noted that /run/user isn’t in abstractions/user-tmp, which is out of date (only includes tmp directories and not the more modern /run/usr. Oh well).

---

JasonJAyalaP

2017-07-01 01:27:39 UTC

I get the message after a reboot.

audit: type=1400 audit(1498871907.064:25): apparmor=“DENIED” operation=“mkdir” profile=“/home//tor-browser*/Browser/firefox" name=“/run/user/1000/dconf/” pid=6407 comm=“firefox” requested_mask=“c” denied_mask=“c” fsuid=1000 ouid=1000
Jul 1 01:18:27 host kernel: [ 348.994506] audit: type=1400 audit(1498871907.076:26): apparmor=“DENIED” operation=“mkdir” profile="/home//tor-browser*/Browser/firefox” name=“/run/user/1000/dconf/” pid=6407 comm=64636F6E6620776F726B6572 requested_mask=“c” denied_mask=“c” fsuid=1000 ouid=1000

debugging now

---

JasonJAyalaP

2017-07-01 01:48:18 UTC

Ok, the line should be:

owner /run/user/[0-9]*/** rwkl,

(I don’t see why we need the * after 0-9, since it’s supposed to be the user id, but icedove has it. Dunno.)

Added:

apparmor-profile-torbrowser/etc/apparmor.d/home.tor-browser.firefox at master · Kicksecure/apparmor-profile-torbrowser · GitHub

As far as I can tell, firefox doesn’t normally use /run/user for its tmp directory (which would be more modern). However, with certain extensions, it wants to use dconf inside /run/user.

owner /run/user/[0-9]*/** rwkl,

really should be part of abstractions/user-tmp, but that file is very old.

---

JasonJAyalaP

2017-07-01 01:51:48 UTC

I really think that “access to the temp folder” should be a basic AA allowance. In fact, it is right now with #include user-tmp. However, user-tmp is so old (I’m guessing) it doesn’t have /run/user/[0-9]/**

It’s added as comment to the firefox profile, and I think it should be uncommented. You decide Patrick.

But it should be apart of abstractions/user-tmp. Are you comfortable doing this, Patrick? Who do I need to talk to in order to discuss updating user-tmp?

---

Patrick

2017-07-01 08:42:42 UTC

JasonJAyalaP (Jason J. Ayala P.):

But it should be apart of abstractions/user-tmp. Are you comfortable doing this, Patrick?

No.

Who do I need to talk to in order to discuss updating user-tmp?

dpkg -S /full/path/to/file/name

Please contact the maintainer of that package on their public bug tracker.

---

JasonJAyalaP

2017-07-04 21:11:09 UTC

Reported but to app armor:
Bug #1702360 “abstractions/user-tmp doesn't include /run/user” : Bugs : AppArmor

I will also add to the FP template information about uncommenting the # /run/user line.

---

JasonJAyalaP

2017-07-04 21:14:00 UTC

@Patrick
the FP template says “Tor Browser will soon ship with sandboxing on an opt-in basis.” Wasn’t this rejected?

---

Patrick

2017-07-06 12:09:52 UTC

JasonJAyalaP (Jason J. Ayala P.):

the FP template says “Tor Browser will soon ship with sandboxing on an opt-in basis.” Wasn’t this rejected?

Not that I know.

---

Patrick

2017-07-06 12:12:11 UTC

JasonJAyalaP (Jason J. Ayala P.):

JasonJAyalaP added a comment.

@Patrick
the FP template says “Tor Browser will soon ship with sandboxing on an opt-in basis.” Wasn’t this rejected?

The problem is, that sandboxing isn’t a hyperlink. Please make it one.
It’s not referring to apparmor. It’s referring to :

Tor Browser Advanced Topics

• Linux · Wiki · The Tor Project / Applications / Tor Browser · GitLab

---

Patrick

2017-07-06 12:13:39 UTC

After FoxyProxy is installed, you may see an app-armory warning you
about the denied creation of dconf/user. The current Debian profile for
Firefox does not yet include the modern temporary file location /run/user.

Please add a footnote with the link to the bug report. Otherwise it’s
really hard to substantiate that claim in a year from now.

---

JasonJAyalaP

2017-07-06 16:14:05 UTC

According to their wiki that you linked to: “Active development is on indefinite hiatus.” Do you still want FP to talk about and link to that?

---

Patrick

2017-07-06 16:21:39 UTC

Thanks for updating me! No, then this needs to be removed. And the sandboxed tor browser chanter moved to Outdated, Deprecated, Archived Whonix Documentation..