apparmor issues Whonix 11 / jessie

[phabricator-migrator]

Information

ID: 313
PHID: PHID-TASK-gupv7l3rovgledra24ib
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

(As per Whonix Forum)

This ticket is a reminder to check sudo apt-get install apparmor-profiles-whonix and to fix any eventual issues before the release of Whonix 11.

Comments

---

Patrick

2015-05-26 14:11:17 UTC

user@host:~$ sudo aa-enforce /etc/apparmor.d/usr.bin.timesync 
Traceback (most recent call last):
  File "/usr/sbin/aa-enforce", line 30, in <module>
    tool.cmd_enforce()
  File "/usr/lib/python3/dist-packages/apparmor/tools.py", line 153, in cmd_enforce
    apparmor.read_profiles()
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 2572, in read_profiles
    read_profile(profile_dir + '/' + file, True)
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 2598, in read_profile
    profile_data = parse_profile_data(data, file, 0)
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 2922, in parse_profile_data
    raise AppArmorException(_('Invalid mode %(mode)s in file: %(file)s line: %(line)s') % {'mode': mode, 'file': file, 'line': lineno + 1 })
apparmor.common.AppArmorException: 'Invalid mode mrcux in file: /etc/apparmor.d/usr.lib.virtualbox.VirtualBox line: 49'

Problematic line in /etc/apparmor.d/usr.lib.virtualbox.VirtualBox.

/usr/lib/virtualbox/** mrcux,

---

Patrick

2015-06-03 13:31:14 UTC

Somehow I don’t get cux to work. Using /usr/lib/virtualbox/** mrux, now. Non-ideal, but it at least fixes the bigger issue.

fix - https://phabricator.whonix.org/T313:
https://github.com/Whonix/apparmor-profile-virtualbox/commit/d5b72fab6414be8649fa238ef24387bb77442b07

I leave the final fix to @troubadour.

---

troubadour

2015-06-11 19:42:46 UTC

Had the same issue. The mrux or mrix permissions fix the parsing issue, but I’ll have to check if that works in the host. I have not used the VirtualBox profile for a long time, and I’m not sure it’s working as is in jessie. Not sure either if we should keep this profile in Whonix.

For the time being, we could close this task, and I’ll put the VirtualBox profile check in the todo llist.

---

Patrick

2015-06-11 20:21:08 UTC

Alright.