Whonix AppArmor Profiles Development Discussion

[Patrick]

HulaHoop via Whonix Forum:

@Patrick

Do you use gwenview?

Yeah, but I’m open to better alternatives

We already install ristretto by default.

[Patrick]

@Patrick

I am considering to remove the following apparmor profiles from Whonix source folder /packages , mark these profiles as deprecated…

This was done.

[HulaHoop]

@Patrick

We already install ristretto by default.

OK great then pull the trigger on gwenview. An image viewer is a pretty big deal for a default app selection.

[Patrick]

add missing apparmor profile line to log or apparmor messages to apparmor...

[Patrick]

aa-logprof might be a superb time saver. See:
Fix Profiles

[Patrick]

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=951331#23

[Patrick]

Hexchat doesnt open clickable links inside TBB

if there is a link inside IRC chat and clicked on it , it doesnt open in the browser and user needs to copy/paste into the browser. is this Hexchat or TBB issue ? (i think most likely hexchat)

[Patrick]

harden profile

[Patrick]

The hexchat profile is now rather minimal.

Kicksecure/apparmor-profile-hexchat/blob/master/etc/apparmor.d/usr.bin.hexchat

[Patrick]

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=951331#44

[nurmagoz]

Current TB Apparmor profile show this:

root@host:~# /usr/sbin/apparmor-info -b
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/sys/bus/pci/devices/" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/1510/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/1595/cgroup" comm=46532042726F6B65722031353935 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/sys/bus/" comm=4950444C204261636B67726F756E64 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/sys/class/" comm=4950444C204261636B67726F756E64 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/2969/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/3032/cgroup" comm=46532042726F6B65722033303332 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/3740/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/3790/cgroup" comm=46532042726F6B65722033373930 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/4834/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/4886/cgroup" comm=46532042726F6B65722034383836 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/5690/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/5741/cgroup" comm=46532042726F6B65722035373431 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/6982/cgroup" comm=46532042726F6B65722036393832 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/7151/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/7202/cgroup" comm=46532042726F6B65722037323032 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/8126/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/8224/cgroup" comm=46532042726F6B65722038323234 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/8795/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/8845/cgroup" comm=46532042726F6B65722038383435 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/9628/cgroup" comm=46532042726F6B65722039363238 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/9807/cgroup" comm=46532042726F6B65722039383037 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/10148/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/10222/cgroup" comm=46532042726F6B6572203130323232 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/10618/cgroup" comm=46532042726F6B6572203130363138 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/10844/cgroup" comm=46532042726F6B6572203130383434 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/11662/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/11733/cgroup" comm=46532042726F6B6572203131373333 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/13758/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/13822/cgroup" comm=46532042726F6B6572203133383232 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/15356/cgroup" comm=46532042726F6B6572203135333536 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/15401/cgroup" comm=46532042726F6B6572203135343031 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/15462/cgroup" comm=46532042726F6B6572203135343632 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/22540/cgroup" comm=46532042726F6B6572203232353430 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/22859/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/22934/cgroup" comm=46532042726F6B6572203232393334 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/23224/cgroup" comm=46532042726F6B6572203233323234 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/23742/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/23794/cgroup" comm=46532042726F6B6572203233373934 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/52008/cgroup" comm=46532042726F6B6572203532303038 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/52842/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/52914/cgroup" comm=46532042726F6B6572203532393134 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/55673/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/55734/cgroup" comm=46532042726F6B6572203535373334 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/55996/cgroup" comm=46532042726F6B6572203535393936 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/57663/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/57712/cgroup" comm=46532042726F6B6572203537373132 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/58295/cgroup" comm=46532042726F6B6572203538323935 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/58705/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/58755/cgroup" comm=46532042726F6B6572203538373535 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/59049/cgroup" comm=46532042726F6B6572203539303439 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/61692/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/61763/cgroup" comm=46532042726F6B6572203631373633 requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/62397/cgroup" comm="firefox.real" requested_mask="r" denied_mask="r"
AVC apparmor="DENIED" operation="open" profile="/**/*-browser/Browser/firefox" name="/proc/62446/cgroup" comm=46532042726F6B6572203632343436 requested_mask="r" denied_mask="r"
root@host:~#

similar to this:

Full System AppArmor Policy - Testers Wanted!

We are getting closer to a working OS, however sdwdate is broken still on boot. The sdwdate-gui is looping. When you go to status in the gui it displays - Time fetching in progress. When you try to stop or restart sdwdate-gui, it does not work and when you open the log, a terminal shows up but is blank. sudo apt dist-upgrade && sudo apt update && sudo apt upgrade Reading package lists… Done Building dependency tree Reading state information… Done Calculating upgrade… Done 0 upgraded, 0 ne…

[nurmagoz]

Following:

AppArmor

This is the Apparmor profile after changes:

# Last Modified: Sun Jun  5 17:30:59 2022
#include <tunables/global>

## Copyright (C) 2014 troubadour <trobador@riseup.net>
## Copyright (C) 2014 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.


/**/*-browser/Browser/firefox flags=(attach_disconnected) {
  #include <abstractions/X>
  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/fonts>
  #include <abstractions/gnome>
  #include <abstractions/kde>
  #include <abstractions/totem>
  #include <abstractions/user-download>
  #include <abstractions/user-tmp>
  #include <local/home.tor-browser.firefox>

  capability sys_admin,
  capability sys_chroot,
  capability sys_ptrace,

  deny /etc/fstab r,
  deny /etc/group r,
  deny /etc/host.conf r,
  deny /etc/hosts r,
  deny /etc/mailcap r,
  deny /etc/nsswitch.conf r,
  deny /etc/passwd r,
  deny /etc/resolv.conf r,
  deny /etc/udev/udev.conf r,
  deny /run/udev/** r,
  deny /sys/devices/** r,
  deny /var/lib/dbus/machine-id r,
  deny @{PROC}/@{pid}/cmdline r,
  deny @{PROC}/@{pid}/mountinfo r,
  deny @{PROC}/@{pid}/net/arp r,
  deny @{PROC}/@{pid}/net/route r,
  deny @{PROC}/@{pid}/stat r,
  deny @{PROC}/@{pid}/task/ r,
  deny @{PROC}/@{pid}/task/** r,
  deny @{PROC}/sys/kernel/random/uuid r,
  deny @{PROC}/sys/vm/overcommit_memory r,

  /bin/dash rix,
  /bin/ps rix,
  /dev/dri/** r,
  /dev/shm/org.chromium.* rwk,
  /dev/shm/org.mozilla.ipc.* rwk,
  /dev/vboxuser rw,
  /etc/dconf/** r,
  /etc/debian_version r,
  /etc/ld.so.conf r,
  /etc/ld.so.conf.d/* r,
  /etc/mime.types r,
  /etc/wildmidi/wildmidi.cfg r, # gstreamer
  /etc/xfce4/defaults.list r,
  /run/**/**/dconf/ rw,
  /run/**/**/dconf/** rw,
  /run/anon-ws-disable-stacked-tor/127.0.0.1_9150.sock rw,
  /run/anon-ws-disable-stacked-tor/127.0.0.1_9151.sock rw,
  /run/firejail/lib/libpostexecseccomp.so mr,
  /run/resolvconf/resolv.conf r,
  /tmp/MozUpdater/bgupdate/updater rix,
  /usr/bin/apt-cache rix,
  /usr/bin/dash rix,
  /usr/bin/dirname rix,
  /usr/bin/kde4-config rix,
  /usr/bin/lsb_release rix,
  /usr/bin/ps rix,
  /usr/bin/pulseaudio rix,
  /usr/lib/*-linux-gnu/** mrix,
  /usr/lib/python*/lib-dynload/* mr,
  /usr/local/lib/python*/dist-packages/ r,
  /usr/local/lib/python*/dist-packages/** r,
  /usr/share/applications/** rk,
  /usr/share/doc/homepage/** r,
  /usr/share/fontconfig/conf.avail/* r,
  /usr/share/libthai/** r,
  /usr/share/mime/** r,
  /usr/share/poppler/cMap/** r,
  /usr/share/tb-profile-i2p/** r,
  /usr/share/themes/** r,
  /usr/share/xul-ext/foxyproxy-standard/** r,
  /var/cache/fontconfig/ rk,
  @{HOME}/ r,
  @{HOME}/* r,
  @{HOME}/.kde/share/config/* r,
  @{PROC}/*/environ r,
  @{PROC}/@{pid}/fd/ r,
  @{PROC}/@{pid}/gid_map rw,
  @{PROC}/@{pid}/setgroups rw,
  @{PROC}/@{pid}/status r,
  @{PROC}/@{pid}/uid_map rw,
  owner /**/*-browser/** mrwlkix,
  owner /proc/*/cgroup r,

}

[Patrick]

Update home.tor-browser.firefox

[Patrick]

install apparmor-profiles apparmor-profiles-extra apparmor-profiles-kicksecure by default

Installing apparmor-profiles apparmor-profiles-extra kicksecure-profiles by default wont loose anything, Been using these packages as default since like 2 years or more no real/major/dysfunctional problem came out of it. So i think its a good idea to have them installed.

[Patrick]

torbrowser aa profile breaks Qubes split-browser and vm shutdown

Disclaimer: QubesOS-related issue After installing apparmor-profile-torbrowser in a whonix-ws-16 template dedicated to split-browser*, the latter ceases to function properly: keyboard shortcuts no longer work (and I can’t access nor create new bookmarks), and instead normal TorBrowser/Firefox bindings resume. Furthermore, after closing TB the dispvm no longer shuts down. Instead it remains running. * github[dot]com/rustybird/qubes-app-split-browser

add qubes split-browser

[Patrick]

Whonix and AppArmor

[Patrick]

@Patrick

add qubes split-browser by fyqwbdzsfjh · Pull Request #11 · Kicksecure/apparmor-profile-torbrowser · GitHub

Now merged.

[0x1f]

I am going to give this a try, will report if i encounter any problem

[0x1f]

So far, absolutely no problems! everything works as expected