Profile: /usr/bin/whonixcheck Operation: Open DENIED Name: /usr/local/lib/python2.7/dist/package/protobut-2.6.1-nspkg.pth

AppArmor
1

Hi,
lately I always get this warning from AppArmor :

Profile: /usr/bin/whonixcheck
Operation: Open
DENIED: r
Name: /usr/local/lib/python2.7/dist/package/protobut-2.6.1-nspkg.pth
Logfile: /var/log/kern.log

Maybe, is it a python installation error?
Thanks

2

ramon:

Maybe, is it a python installation error?

Unlikely.

Gateway or workstation?

Steps to reproduce?

3

Whonix -Workstation.
How can I do to fix it?

4

Good day,

Like Patrick said, it would be interesting to know what you did before receiving that error.

Have a nice day,

Ego

1 Like
5

Yes, because I failed to reproduce this issue. I have no idea how this /usr/local/lib/python2.7/dist/package/protobut-2.6.1-nspkg.pth file got into place.

6

Sorry but the fact is that I don’t know how I did it.
I only downloaded the new whonix 13 and installed various tools that I needed, including python.
[ sudo apt-get install python-qt4 python-pip ]

Can I remove the file [/usr/local/lib/python2.7/dist/package/protobut-2.6.1-nspkg.pth]? If so, how?
Thanks for your help…every day I get 7-8 warning messages from AppArmor.

7

ramon:

Can I remove the file [/usr/local/lib/python2.7/dist/package/protobut-2.6.1-nspkg.pth]? If so, how?
Thanks for your help…every day I get 7-8 warning messages from AppArmor.

Deleting random files will cause random issues. Don’t.

8

It would be better to fix the apparmor issues or as crude hack to
disable apparmor notifications than deleting random files.

/etc/apparmor/notify.conf

9

I still do not know how to reproduce this…

sudo apt-get install python-pip golang-gogoprotobuf-dev

…does not work.

Do you know how to reproduce this? @entr0py

10

Assuming OP made a typo:
/usr/local/lib/python2.7/dist/package/protobut-2.6.1-nspkg.pth
should have been
/usr/local/lib/python2.7/dist-packages/protobuf-2.6.1-nspkg.pth

To reproduce,

sudo apt-get install python-pip
sudo pip install protobuf

Why does Whonixcheck need read access?

11

Relevant line in /etc/apparmor.d/usr.bin.whonixcheck:

/usr/local/lib/python2.7/dist-packages/ r,

Adding:

/usr/local/lib/python2.7/dist-packages/* r,

fixes errors but not sure what Whonix-related operation is happening there to begin with.

12

Has something to do with

/usr/lib/msgcollector/striphtml
/usr/lib/msgcollector/br_add

being written in Python.

13

Not tested yet. If you like, please emulate and test these changes.

https://github.com/Whonix/whonixcheck/commit/926c2a0667f99a4d90d536066dd6bdac946d41e3

Dunno. Looks harmless, though. I speculate some python initialization stuff such as “let’s look what kind of libs are available”.

14

thank you all for your interest.

1 Like