Whonix AppArmor Profiles Development Discussion

Yay, this is coming.

You’ll probably like how fast we implemented your wish - it’s done since 8 months :wink: Nearly all abstractions in git master have a line like

#include if exists <abstractions/base.d>

This will be part of the next major release (2.14 or 3.0), therefore I’ll close this ticket as already implemented. If you think we should backport this to 2.12 and 2.13, please reopen and provide a good reason :wink:

port to /etc/apparmor.d/abstractions.d in Debian 11 bullseye

Sep 07 03:42:10 host kernel: audit: type=1400 audit(1567827730.866:126): apparmor=“DENIED” operation=“exec” profile="/**/*-browser/Browser/firefox" name="/usr/local/bin/dirname" pid=15407 comm=“firefox” requested_mask=“x” denied_mask=“x” fsuid=1000 ouid=0

Not fixed. Created for it:

1 Like
1 Like
1 Like

Nov 19 15:25:57 host audit[3273]: AVC apparmor=“DENIED” operation=“chmod” profile="/usr/bin/whonixcheck" name="/var/cache/fontconfig/" pid=3273 comm=“zenity” requested_mask=“w” denied_mask=“w” fsuid=110 ouid=0
Nov 19 15:22:44 host audit[4274]: AVC apparmor=“DENIED” operation=“chmod” profile="/usr/bin/whonixcheck" name="/var/cache/fontconfig/" pid=4274 comm=“zenity” requested_mask=“w” denied_mask=“w” fsuid=110 ouid=0

A post was merged into an existing topic: Current State of Kloak?

HexChat profile https://github.com/Whonix/apparmor-profile-xchat upstreaming to either Debian and/or HexChat upstream failed as neither upstream uses AppArmor. References:

I noticed hexchat is having trouble with current profiles. Wouldn’t make any connections without a rule added to abstractions/xchat-based for /etc/resolv.conf.anondist r,.

There’s also some DENIED entries for /etc/hosts, but didn’t seem to effect functionality yet. Not sure if this one is intentional since not explicitly denied.

Is there a better place to report these? Phabricator? Not familiar with it, but I made an account that’s waiting on approval.


https://github.com/Whonix/apparmor-profile-xchat/blob/master/etc/apparmor.d/abstractions/xchat-based should only need the references without .anondist because of:

https://github.com/Whonix/apparmor-profile-xchat/blob/master/etc/apparmor.d/abstractions/xchat-based is missing:

  • /etc/resolv.conf r,
  • /etc/hosts r,

Could you try please and send a pull request?

Got extensive feedback for hexchat apparmor profile.

Message #23 received at 951331@bugs.debian.org (full text, mbox, reply):

From: Seth Arnold seth.arnold@canonical.com
To: 951331@bugs.debian.org
Subject: hexchat apparmor profile
Date: Sat, 29 Feb 2020 04:30:59 +0000
[Message part 1 (text/plain, inline)]

Hello Mattia, Patrick,

Thanks so much for proposing an AppArmor profile for HexChat.

I’ve got a few comments; I’ll paste in the entire ‘main’ block of the
profile, and add my comments inline.:

## Copyright (C) 2014 troubadour <trobador@riseup.net>
## Copyright (C) 2014 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

   #include <abstractions/base>
   #include <abstractions/bash>
   #include <abstractions/fonts>
   #include <abstractions/kde>
   #include <abstractions/gnome>
   #include <abstractions/X>
   #include <abstractions/audio>

This should also #include <abstractions/nameservice>

   deny @{PROC}/** r,

   @{HOME}/ r,
   @{HOME}/.config/** rwk,
   @{HOME}/.xchat2/ r,
   @{HOME}/.xchat2/** rwixk,
   @{HOME}/.config/ r,
   @{HOME}/.config/hexchat/ r,
   @{HOME}/.config/hexchat/** rwixk,
   @{HOME}/.kde/share/config/gtkrc-2.0 r,
   @{HOME}/.kde/share/config/oxygenrc r,
   @{HOME}/.*/lib/python*/** r,

   /bin/grep rix,
   /bin/uname rix,
   /bin/mkdir rix,
   /bin/rm rix,

   /usr/bin/grep rix,
   /usr/bin/uname rix,
   /usr/bin/mkdir rix,
   /usr/bin/rm rix,

   /dev/tty rwix,
   /dev/null rw,

   /etc/passwd r,
   /etc/group r,
   /etc/host.conf r,
   /etc/hosts r,
   /etc/resolv.conf r,
   /etc/gai.conf r,
   /etc/nsswitch.conf r,

The lines between /etc/passwd and /etc/nsswitch.conf could be removed with
abstractions/nameservice added.

   /etc/ld.so.cache r,
   /etc/machine-id r,
   /etc/os-release r,
   /etc/xdg/xfce4/helpers.rc r,
   /etc/xfce4/defaults.list r,
   /etc/python*/sitecustomize.py r,

   /lib/*-linux-gnu/** mr,

This line is very broad – and overlaps with a lot of the libraries listed
in abstractions/base – if you found any libraries that are DENIED because
they don’t match a rule already in abstractions/base, it would be best to
list them with a specific rule.

   /usr/bin/xchat rix,
   /usr/bin/xdg-open rix,
   /usr/bin/dbus-send rix,
   /usr/bin/xprop  rix,
   /usr/bin/exo-open rix,
   /usr/bin/sensible-browser rix,
   /usr/bin/zenity rix,
   /usr/bin/torbrowser rix,
   /usr/bin/basename rix,
   /usr/bin/kde4-config rix,
   /usr/bin/aplay rix,

I’m really worried about these. I can appreciate trying to provide a
profile that lets people click on links as usual, but actually running
these applications in hexchat’s profile will lead to bugs.

This also means the hexchat profile may need to be much wider, just to
accomodate these other programs.

   /usr/lib/*-linux-gnu/** mrix,

This line is also very broad – and shouldn’t be needed with

   /usr/lib/xchat/plugins/* mr,
   /usr/lib/perl*/** mr,
   /var/lib/snapd/desktop/applications/ r,

Granting permission to read this directory without permission to read the
*.desktop files is a bit wasted. What happens if this is denied?

   ## The Ux permission is too dangerous to be enabled by default.
   #/usr/lib/firefox-esr/firefox* Ux,

   /usr/lib/python*/lib-dynload/*.so mr,

   /usr/local/lib/python*/dist-packages/ r,
   /usr/local/lib/python*/dist-packages/* r,

   /usr/share/icons/** r,
   /usr/share/enchant/* r,
   /usr/share/myspell/dicts/ r,
   /usr/share/hunspell/ r,
   /usr/share/hunspell/* r,
   /usr/share/ca-certificates/** r,
   /usr/share/xfce4/helpers/* r,
   /usr/share/xfce4/applications/ r,
   /usr/share/xfce4/applications/mimeinfo.cache r,
   /usr/share/zenity/* r,
   /usr/share/fontconfig/** r,
   /usr/share/poppler/cMap/ r,
   /usr/share/poppler/cMap/** r,
   /usr/share/perl*/** mr,
   /usr/share/tcltk/tcl8.5/* r,
   /usr/share/pyshared/* r,
   /usr/share/aspell/ r,
   /usr/share/aspell/** r,

   /var/lib/aspell/* r,

   /run/*/resolv.conf r,

This shouldn’t be needed with abstractions/nameservice added.

I know that the helper applications is a difficult point here. The more
secure option is to prevent them from being used. The friendliest option
is to use PUx execution rules to either launch them confined, if the user
has profiles for them, or unconfined, if the user doesn’t have profiles.

But having an unconfined way out of the profile drastically reduces the
value of the profile.

Desktop applications are difficult to confine because many users want to
use them to do everything. Other users don’t mind some restrictions for
security gains. And it’s very hard to provide one profile for both.

It may not make sense to enable the profile by default. I’d rather have
the tighter profile, without helper applications, but that may not reflect
what most users would actually want.


Help welcome!

I am considering to remove the following apparmor profiles from Whonix source folder /packages, mark these profiles as deprecated…


  • image viewer
  • we don’t ship it for a long time anymore



  • I don’t think apparmor can do much to confine a kernel module / virtualizer.
  • It was never really ready.
  • Doubt many / any are using it.

No one really up to maintain any of these as far as I know.

Do you use gwenview?

Anyone using gwenview?

Yeah, but I’m open to better alternatives

1 Like

HulaHoop via Whonix Forum:

Yeah, but I’m open to better alternatives

We already install ristretto by default.

1 Like

This was done.

OK great then pull the trigger on gwenview. An image viewer is a pretty big deal for a default app selection.

[Imprint] [Privacy Policy] [Cookie Policy] [Terms of Use] [E-Sign Consent] [DMCA] [Investors] [Priority Support] [Professional Support]