Whonix AppArmor Profiles Development Discussion

Patrick · August 14, 2014, 1:08pm

Got various denied messages for the Tor Browser profile.

Aug 14 13:10:11 host kernel: [57667.819999] audit_printk_skb: 27 callbacks suppressed
Aug 14 13:10:11 host kernel: [57667.820035] type=1400 audit(1408021811.590:686): apparmor="DENIED" operation="open" parent=1 profile="/home/user/tor-browser_*/Browser/firefox" name="/etc/resolv.conf.anondist" pid=27385 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 14 13:10:11 host kernel: [57667.820546] type=1400 audit(1408021811.594:687): apparmor="DENIED" operation="open" parent=1 profile="/home/user/tor-browser_*/Browser/firefox" name="/etc/resolv.conf.anondist" pid=27385 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 14 13:10:11 host kernel: [57667.820658] type=1400 audit(1408021811.594:688): apparmor="DENIED" operation="open" parent=1 profile="/home/user/tor-browser_*/Browser/firefox" name="/etc/hosts.anondist" pid=27385 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 14 13:10:11 host kernel: [57667.885530] type=1400 audit(1408021811.658:689): apparmor="DENIED" operation="open" parent=27385 profile="/home/user/tor-browser_*/Browser/firefox" name="/usr/share/open-link-confirmation/share/config/kdeglobals" pid=27396 comm="kde4-config" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 14 13:10:11 host kernel: [57667.885590] type=1400 audit(1408021811.658:690): apparmor="DENIED" operation="open" parent=27385 profile="/home/user/tor-browser_*/Browser/firefox" name="/usr/share/kde-lowfat/share/config/kdeglobals" pid=27396 comm="kde4-config" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 14 13:10:11 host kernel: [57667.885624] type=1400 audit(1408021811.658:691): apparmor="DENIED" operation="open" parent=27385 profile="/home/user/tor-browser_*/Browser/firefox" name="/usr/share/kde-mouse-doubleclick/share/config/kdeglobals" pid=27396 comm="kde4-config" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 14 13:10:11 host kernel: [57667.885664] type=1400 audit(1408021811.658:692): apparmor="DENIED" operation="open" parent=27385 profile="/home/user/tor-browser_*/Browser/firefox" name="/usr/share/torbrowser-default-browser/share/config/kdeglobals" pid=27396 comm="kde4-config" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 14 13:10:11 host kernel: [57667.891448] type=1400 audit(1408021811.662:693): apparmor="DENIED" operation="open" parent=1 profile="/home/user/tor-browser_*/Browser/firefox" name="/usr/share/open-link-confirmation/share/config/kdeglobals" pid=27385 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 14 13:10:11 host kernel: [57667.891460] type=1400 audit(1408021811.662:694): apparmor="DENIED" operation="open" parent=1 profile="/home/user/tor-browser_*/Browser/firefox" name="/usr/share/open-link-confirmation/share/config/kdeglobals" pid=27385 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 14 13:10:11 host kernel: [57667.891508] type=1400 audit(1408021811.662:695): apparmor="DENIED" operation="open" parent=1 profile="/home/user/tor-browser_*/Browser/firefox" name="/usr/share/kde-lowfat/share/config/kdeglobals" pid=27385 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Already purged and reinstalled it. I am wondering why it rules by apparmor-profile-anondist are not in effect. Can you reproduce this?

troubadour · August 14, 2014, 8:09pm

Already purged and reinstalled it. I am wondering why it rules by apparmor-profile-anondist are not in effect. Can you reproduce this?

No. Far fetched, but may be there was a problem with you revert. I have pushed apparmor-profile-anondist with dh-apparmor back. If you merge it…

troubadour · August 14, 2014, 9:13pm

It depends on what we're up to here. Putting them into a profile we would like to see getting merged into Debian is eventually counter productive to get them merged into Debian? Would confuse Debian maintainers? I guess having them in base.anondist is better as long as kde-lowfat [...] does not enter Debian. I have no idea! What is the usual thing to do in such cases if there is such a thing as a usual thing here?
On the other hand, Debian maintainers may not care about an extra “/usr/share/kde-lowfat/share/config/kdeglobals r,” if there is no such file in Debian. Doesn’t worsen security and even if there is such a file one day in Debian, it would be required. So while I am very unsure about this, I tend to put them into the profile.

I don’t think there is yet such a thing as a usual thing in Debian where it concerns AppArmor, but may be there is a slight upturn (intrigeri is there and apparently the only one really active). See AppArmor/Progress - Debian Wiki.

So, for our little problem, we say “back in the profile”? That cannot harm in any way the functioning of the package (on the contrary) or the security.

What timesync does is using "sudo service sdwdate" restart and then monitoring it. Or somehow tell the timesync apparmor profile to run sdwdate using sdwdate's profile?
As per http://wiki.apparmor.net/index.php/QuickProfileLanguage#Execute_permissions.

cx - the new process should run under a child profile that matches the name of the executable px - the new process should run under another profile that matches the name of the executable

Using either cx or px.

I believe you’ll agree that it is certainly neater to use a child profile instead of a new abstraction, so I assume I can start in that direction.

I am using a child profile in the Icedove profile.

	@{HOME}/tor-browser_*/Browser/firefox Px,

That is why we cannot start Iceweasel from Icedove when the packages are confined. Only Torbrowser is available to open the links in messages. Whonix Forum

Patrick · August 14, 2014, 11:01pm

Yes.

No. Far fetched, but may be there was a problem with you revert. I have pushed apparmor-profile-anondist with dh-apparmor back. If you merge it…[/quote]
No problem with the revert. This was the revert commit:

Git records changesets. So you can easily add/remove/re-add changes.

I just checked, the abstractions/base and the torbrowser profile exactly matches the versions on github and I even rebooted. No idea why I am still getting these errors. Any idea? Perhaps it is because this was an Whonix-Workstation build version 8.2 that was upgraded to 8.6.x.

Nevertheless I would like to debug and fix this. Is there some way to tell AppArmor to show me how a profile is looking that is currently load in memory? To show me how the profile looks like after it actually sourced the abstractions?

Patrick · August 14, 2014, 11:13pm

Have you subscribed to torbrowser-launcher using github’s “watch” button? I did.
If yes, there is no need for me to mirrors things here.
Just wanted to say, intrigeri just wrote a bigger comment on the AppArmor profile.
Just saying. Keep your time.

Patrick · August 15, 2014, 11:55am

[quote=“Patrick, post:324, topic:108”]Yes.

No problem with the revert. This was the revert commit:

Git records changesets. So you can easily add/remove/re-add changes.

I just checked, the abstractions/base and the torbrowser profile exactly matches the versions on github and I even rebooted. No idea why I am still getting these errors. Any idea? Perhaps it is because this was an Whonix-Workstation build version 8.2 that was upgraded to 8.6.x.

Nevertheless I would like to debug and fix this. Is there some way to tell AppArmor to show me how a profile is looking that is currently load in memory? To show me how the profile looks like after it actually sourced the abstractions?[/quote]
Figured it out. Seems to be a bug in AppArmor.

Steps to reach that conclusion were.

sudo apt-get purge apparmor-profile-torbrowser
cd /etc/apparmor.d
sudo grep -r firefox *
sudo rm "cache/home.*.tor-browser_*.Browser.firefox"
sudo reboot
## install latest apparmor-profile-torbrowser from source using make deb-icup

No more denied messages by the apparmor-profile-torbrowser package.

Are you aware of an upstream bug report, should we document this or just keep it in mind?

troubadour · August 15, 2014, 8:24pm

Have you subscribed to torbrowser-launcher using github's "watch" button?

Yes.

Just wanted to say, intrigeri just wrote a bigger comment on the AppArmor profile.

I replied. Many new issues introduced with recent changes to the AppArmor profiles · Issue #124 · torproject/torbrowser-launcher · GitHub

Patrick · August 18, 2014, 2:48am

Got a new denied message.

troubadour · August 18, 2014, 7:17pm

Got a new denied message.

Had it too, a couple of times. Forgot it. I pushed the update.

Patrick · August 18, 2014, 10:14pm

Got some XChat denied messages.

Aug 18 22:13:02 host kernel: [  432.541293] type=1400 audit(1408399982.047:44): apparmor="DENIED" operation="open" parent=8696 profile="/usr/bin/xchat" name="/usr/share/tcltk/tcl8.5/init.tcl" pid=8697 comm="xchat" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 18 22:13:02 host kernel: [  432.553180] type=1400 audit(1408399982.059:45): apparmor="DENIED" operation="open" parent=8696 profile="/usr/bin/xchat" name="/usr/local/lib/python2.7/dist-packages/" pid=8697 comm="xchat" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 18 22:13:02 host kernel: [  432.553441] type=1400 audit(1408399982.059:46): apparmor="DENIED" operation="open" parent=8696 profile="/usr/bin/xchat" name="/usr/share/pyshared/pygst.pth" pid=8697 comm="xchat" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 18 22:13:02 host kernel: [  432.553461] type=1400 audit(1408399982.059:47): apparmor="DENIED" operation="open" parent=8696 profile="/usr/bin/xchat" name="/usr/share/pyshared/pygtk.pth" pid=8697 comm="xchat" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 18 22:13:02 host kernel: [  432.553523] type=1400 audit(1408399982.059:48): apparmor="DENIED" operation="open" parent=8696 profile="/usr/bin/xchat" name="/usr/share/pyshared/setuptools.pth" pid=8697 comm="xchat" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 18 22:13:02 host kernel: [  432.553542] type=1400 audit(1408399982.059:49): apparmor="DENIED" operation="open" parent=8696 profile="/usr/bin/xchat" name="/usr/share/pyshared/zope.interface-3.6.1-nspkg.pth" pid=8697 comm="xchat" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 18 22:13:02 host kernel: [  432.553610] type=1400 audit(1408399982.059:50): apparmor="DENIED" operation="open" parent=8696 profile="/usr/bin/xchat" name="/etc/python2.7/sitecustomize.py" pid=8697 comm="xchat" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 18 22:13:02 host kernel: [  432.567959] type=1400 audit(1408399982.071:51): apparmor="DENIED" operation="open" parent=8696 profile="/usr/bin/xchat" name="/usr/local/lib/python2.7/dist-packages/" pid=8697 comm="xchat" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 18 22:13:02 host kernel: [  432.568345] type=1400 audit(1408399982.075:52): apparmor="DENIED" operation="open" parent=8696 profile="/usr/bin/xchat" name="/usr/share/pyshared/pygst.pth" pid=8697 comm="xchat" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 18 22:13:02 host kernel: [  432.568366] type=1400 audit(1408399982.075:53): apparmor="DENIED" operation="open" parent=8696 profile="/usr/bin/xchat" name="/usr/share/pyshared/pygtk.pth" pid=8697 comm="xchat" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Patrick · August 18, 2014, 10:22pm

Had it too, a couple of times. Forgot it. I pushed the update.[/quote]
Merged into Whonix/apparmor-profile-torbrowser master.
Merged into Whonix/Whonix master.

Patrick · August 20, 2014, 2:40am

Got a Tor Browser apparmor denied message.

troubadour · August 20, 2014, 8:42pm

Got some XChat denied messages.

I have added the lines at the end of the profile. Not committed yet. For the message in the commit, did you get those messages after you started packaging Python applications?

Patrick · August 20, 2014, 10:23pm

No.

whonix-user32 · August 21, 2014, 11:02am

Hello,

i get a ‘failed’ during boot and manual restart of apparmor at Whonix 8.6.6.0.

Gateway:

root@host:~# /etc/init.d/apparmor restart
[....] Reloading AppArmor profiles:Warning from /etc/apparmor.d/bin.ping (/etc/apparmor.d/bin.ping line 28): profile /bin/ping network rules not enforced
Warning from /etc/apparmor.d/sbin.klogd (/etc/apparmor.d/sbin.klogd line 36): profile /sbin/klogd network rules not enforced
Warning from /etc/apparmor.d/sbin.syslogd (/etc/apparmor.d/sbin.syslogd line 41): profile /sbin/syslogd network rules not enforced
Warning from /etc/apparmor.d/sbin.syslog-ng (/etc/apparmor.d/sbin.syslog-ng line 55): profile /sbin/syslog-ng network rules not enforced
Warning from /etc/apparmor.d/system_tor (/etc/apparmor.d/system_tor line 18): profile system_tor network rules not enforced
profile has merged rule with conflicting x modifiers
ERROR processing regexs for profile sanitized_helper, failed to load
Warning from /etc/apparmor.d/usr.lib.dovecot.deliver (/etc/apparmor.d/usr.lib.dovecot.deliver line 29): profile /usr/lib/dovecot/deliver network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.dovecot-auth (/etc/apparmor.d/usr.lib.dovecot.dovecot-auth line 23): profile /usr/lib/dovecot/dovecot-auth network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.imap (/etc/apparmor.d/usr.lib.dovecot.imap line 27): profile /usr/lib/dovecot/imap network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.imap-login (/etc/apparmor.d/usr.lib.dovecot.imap-login line 23): profile /usr/lib/dovecot/imap-login network rules not enforced                                                                                                                  
Warning from /etc/apparmor.d/usr.lib.dovecot.managesieve-login (/etc/apparmor.d/usr.lib.dovecot.managesieve-login line 22): profile /usr/lib/dovecot/managesieve-login network rules not enforced                                                                                             
Warning from /etc/apparmor.d/usr.lib.dovecot.pop3 (/etc/apparmor.d/usr.lib.dovecot.pop3 line 23): profile /usr/lib/dovecot/pop3 network rules not enforced                                                                                                                                    
Warning from /etc/apparmor.d/usr.lib.dovecot.pop3-login (/etc/apparmor.d/usr.lib.dovecot.pop3-login line 21): profile /usr/lib/dovecot/pop3-login network rules not enforced                                                                                                                  
Warning from /etc/apparmor.d/usr.sbin.avahi-daemon (/etc/apparmor.d/usr.sbin.avahi-daemon line 31): profile /usr/sbin/avahi-daemon network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.dnsmasq (/etc/apparmor.d/usr.sbin.dnsmasq line 61): profile /usr/sbin/dnsmasq network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.dovecot (/etc/apparmor.d/usr.sbin.dovecot line 42): profile /usr/sbin/dovecot network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.identd (/etc/apparmor.d/usr.sbin.identd line 31): profile /usr/sbin/identd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.mdnsd (/etc/apparmor.d/usr.sbin.mdnsd line 35): profile /usr/sbin/mdnsd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.nmbd (/etc/apparmor.d/usr.sbin.nmbd line 27): profile /usr/sbin/nmbd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.nscd (/etc/apparmor.d/usr.sbin.nscd line 48): profile /usr/sbin/nscd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.smbd (/etc/apparmor.d/usr.sbin.smbd line 52): profile /usr/sbin/smbd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.traceroute (/etc/apparmor.d/usr.sbin.traceroute line 29): profile /usr/{sbin/traceroute,bin/traceroute.db} network rules not enforced
 failed!

Workstation:

root@host:~# /etc/init.d/apparmor restart
[....] Reloading AppArmor profiles:Warning from /etc/apparmor.d/bin.ping (/etc/apparmor.d/bin.ping line 28): profile /bin/ping network rules not enforced
Warning from /etc/apparmor.d/sbin.klogd (/etc/apparmor.d/sbin.klogd line 36): profile /sbin/klogd network rules not enforced
Warning from /etc/apparmor.d/sbin.syslogd (/etc/apparmor.d/sbin.syslogd line 41): profile /sbin/syslogd network rules not enforced
Warning from /etc/apparmor.d/sbin.syslog-ng (/etc/apparmor.d/sbin.syslog-ng line 55): profile /sbin/syslog-ng network rules not enforced
profile has merged rule with conflicting x modifiers
ERROR processing regexs for profile sanitized_helper, failed to load
Warning from /etc/apparmor.d/usr.bin.freshclam (/etc/apparmor.d/usr.bin.freshclam line 44): profile /usr/bin/freshclam network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.deliver (/etc/apparmor.d/usr.lib.dovecot.deliver line 29): profile /usr/lib/dovecot/deliver network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.dovecot-auth (/etc/apparmor.d/usr.lib.dovecot.dovecot-auth line 23): profile /usr/lib/dovecot/dovecot-auth network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.imap (/etc/apparmor.d/usr.lib.dovecot.imap line 27): profile /usr/lib/dovecot/imap network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.imap-login (/etc/apparmor.d/usr.lib.dovecot.imap-login line 23): profile /usr/lib/dovecot/imap-login network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.managesieve-login (/etc/apparmor.d/usr.lib.dovecot.managesieve-login line 22): profile /usr/lib/dovecot/managesieve-login network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.pop3 (/etc/apparmor.d/usr.lib.dovecot.pop3 line 23): profile /usr/lib/dovecot/pop3 network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.pop3-login (/etc/apparmor.d/usr.lib.dovecot.pop3-login line 21): profile /usr/lib/dovecot/pop3-login network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.avahi-daemon (/etc/apparmor.d/usr.sbin.avahi-daemon line 31): profile /usr/sbin/avahi-daemon network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.dnsmasq (/etc/apparmor.d/usr.sbin.dnsmasq line 61): profile /usr/sbin/dnsmasq network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.dovecot (/etc/apparmor.d/usr.sbin.dovecot line 42): profile /usr/sbin/dovecot network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.identd (/etc/apparmor.d/usr.sbin.identd line 31): profile /usr/sbin/identd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.mdnsd (/etc/apparmor.d/usr.sbin.mdnsd line 35): profile /usr/sbin/mdnsd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.nmbd (/etc/apparmor.d/usr.sbin.nmbd line 27): profile /usr/sbin/nmbd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.nscd (/etc/apparmor.d/usr.sbin.nscd line 48): profile /usr/sbin/nscd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.smbd (/etc/apparmor.d/usr.sbin.smbd line 52): profile /usr/sbin/smbd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.traceroute (/etc/apparmor.d/usr.sbin.traceroute line 29): profile /usr/{sbin/traceroute,bin/traceroute.db} network rules not enforced
 failed!

Great to see the new ‘freshclam’ profile. Thanks a lot. As i have absolute no knowledge about apparmor, so i’m unfortunately not able to provide a solution.

troubadour · August 21, 2014, 6:39pm

This is due to the AppArmor profiles installed by Debian. They are not useful here. To remove them, run

The other profiles (from Whonix, yours…) will be left.

troubadour · August 21, 2014, 6:50pm

Patrick, may be the default Debian profiles should not be installed in Whonix.

Patrick · August 21, 2014, 6:52pm

Purging them at the moment as long as we have them set as dependency (may change in later version or not) as an end user is not advices due to dependencies.

apt-get purge apparmor-profiles Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: anon-banned-packages anon-iceweasel-warning anon-shared-build-inst-tb apparmor-profile-virtualbox gpl-sources-download knetattach-hide power-savings-disable-in-vms poweroff-passwordless rads scurl shared-folder-help swap-file-creator swappiness-lowest tor-ctrl uwt virt-what whonixcheck Use 'apt-get autoremove' to remove them. The following packages will be REMOVED: anon-shared-packages-recommended* apparmor-profiles* whonix-shared-packages-recommended* 0 upgraded, 0 newly installed, 3 to remove and 99 not upgraded. After this operation, 306 kB disk space will be freed. Do you want to continue [Y/n]?

troubadour · August 21, 2014, 6:56pm

Sorry, big mistake. I have tested it in the host.

Patrick · August 21, 2014, 7:00pm

[quote=“whonix-user32, post:335, topic:108”]Hello,

i get a ‘failed’ during boot and manual restart of apparmor at Whonix 8.6.6.0.

Gateway:

root@host:~# /etc/init.d/apparmor restart
[....] Reloading AppArmor profiles:Warning from /etc/apparmor.d/bin.ping (/etc/apparmor.d/bin.ping line 28): profile /bin/ping network rules not enforced
Warning from /etc/apparmor.d/sbin.klogd (/etc/apparmor.d/sbin.klogd line 36): profile /sbin/klogd network rules not enforced
Warning from /etc/apparmor.d/sbin.syslogd (/etc/apparmor.d/sbin.syslogd line 41): profile /sbin/syslogd network rules not enforced
Warning from /etc/apparmor.d/sbin.syslog-ng (/etc/apparmor.d/sbin.syslog-ng line 55): profile /sbin/syslog-ng network rules not enforced
Warning from /etc/apparmor.d/system_tor (/etc/apparmor.d/system_tor line 18): profile system_tor network rules not enforced
profile has merged rule with conflicting x modifiers
ERROR processing regexs for profile sanitized_helper, failed to load
Warning from /etc/apparmor.d/usr.lib.dovecot.deliver (/etc/apparmor.d/usr.lib.dovecot.deliver line 29): profile /usr/lib/dovecot/deliver network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.dovecot-auth (/etc/apparmor.d/usr.lib.dovecot.dovecot-auth line 23): profile /usr/lib/dovecot/dovecot-auth network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.imap (/etc/apparmor.d/usr.lib.dovecot.imap line 27): profile /usr/lib/dovecot/imap network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.imap-login (/etc/apparmor.d/usr.lib.dovecot.imap-login line 23): profile /usr/lib/dovecot/imap-login network rules not enforced                                                                                                                  
Warning from /etc/apparmor.d/usr.lib.dovecot.managesieve-login (/etc/apparmor.d/usr.lib.dovecot.managesieve-login line 22): profile /usr/lib/dovecot/managesieve-login network rules not enforced                                                                                             
Warning from /etc/apparmor.d/usr.lib.dovecot.pop3 (/etc/apparmor.d/usr.lib.dovecot.pop3 line 23): profile /usr/lib/dovecot/pop3 network rules not enforced                                                                                                                                    
Warning from /etc/apparmor.d/usr.lib.dovecot.pop3-login (/etc/apparmor.d/usr.lib.dovecot.pop3-login line 21): profile /usr/lib/dovecot/pop3-login network rules not enforced                                                                                                                  
Warning from /etc/apparmor.d/usr.sbin.avahi-daemon (/etc/apparmor.d/usr.sbin.avahi-daemon line 31): profile /usr/sbin/avahi-daemon network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.dnsmasq (/etc/apparmor.d/usr.sbin.dnsmasq line 61): profile /usr/sbin/dnsmasq network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.dovecot (/etc/apparmor.d/usr.sbin.dovecot line 42): profile /usr/sbin/dovecot network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.identd (/etc/apparmor.d/usr.sbin.identd line 31): profile /usr/sbin/identd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.mdnsd (/etc/apparmor.d/usr.sbin.mdnsd line 35): profile /usr/sbin/mdnsd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.nmbd (/etc/apparmor.d/usr.sbin.nmbd line 27): profile /usr/sbin/nmbd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.nscd (/etc/apparmor.d/usr.sbin.nscd line 48): profile /usr/sbin/nscd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.smbd (/etc/apparmor.d/usr.sbin.smbd line 52): profile /usr/sbin/smbd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.traceroute (/etc/apparmor.d/usr.sbin.traceroute line 29): profile /usr/{sbin/traceroute,bin/traceroute.db} network rules not enforced
 failed!

Workstation:

root@host:~# /etc/init.d/apparmor restart
[....] Reloading AppArmor profiles:Warning from /etc/apparmor.d/bin.ping (/etc/apparmor.d/bin.ping line 28): profile /bin/ping network rules not enforced
Warning from /etc/apparmor.d/sbin.klogd (/etc/apparmor.d/sbin.klogd line 36): profile /sbin/klogd network rules not enforced
Warning from /etc/apparmor.d/sbin.syslogd (/etc/apparmor.d/sbin.syslogd line 41): profile /sbin/syslogd network rules not enforced
Warning from /etc/apparmor.d/sbin.syslog-ng (/etc/apparmor.d/sbin.syslog-ng line 55): profile /sbin/syslog-ng network rules not enforced
profile has merged rule with conflicting x modifiers
ERROR processing regexs for profile sanitized_helper, failed to load
Warning from /etc/apparmor.d/usr.bin.freshclam (/etc/apparmor.d/usr.bin.freshclam line 44): profile /usr/bin/freshclam network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.deliver (/etc/apparmor.d/usr.lib.dovecot.deliver line 29): profile /usr/lib/dovecot/deliver network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.dovecot-auth (/etc/apparmor.d/usr.lib.dovecot.dovecot-auth line 23): profile /usr/lib/dovecot/dovecot-auth network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.imap (/etc/apparmor.d/usr.lib.dovecot.imap line 27): profile /usr/lib/dovecot/imap network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.imap-login (/etc/apparmor.d/usr.lib.dovecot.imap-login line 23): profile /usr/lib/dovecot/imap-login network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.managesieve-login (/etc/apparmor.d/usr.lib.dovecot.managesieve-login line 22): profile /usr/lib/dovecot/managesieve-login network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.pop3 (/etc/apparmor.d/usr.lib.dovecot.pop3 line 23): profile /usr/lib/dovecot/pop3 network rules not enforced
Warning from /etc/apparmor.d/usr.lib.dovecot.pop3-login (/etc/apparmor.d/usr.lib.dovecot.pop3-login line 21): profile /usr/lib/dovecot/pop3-login network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.avahi-daemon (/etc/apparmor.d/usr.sbin.avahi-daemon line 31): profile /usr/sbin/avahi-daemon network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.dnsmasq (/etc/apparmor.d/usr.sbin.dnsmasq line 61): profile /usr/sbin/dnsmasq network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.dovecot (/etc/apparmor.d/usr.sbin.dovecot line 42): profile /usr/sbin/dovecot network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.identd (/etc/apparmor.d/usr.sbin.identd line 31): profile /usr/sbin/identd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.mdnsd (/etc/apparmor.d/usr.sbin.mdnsd line 35): profile /usr/sbin/mdnsd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.nmbd (/etc/apparmor.d/usr.sbin.nmbd line 27): profile /usr/sbin/nmbd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.nscd (/etc/apparmor.d/usr.sbin.nscd line 48): profile /usr/sbin/nscd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.smbd (/etc/apparmor.d/usr.sbin.smbd line 52): profile /usr/sbin/smbd network rules not enforced
Warning from /etc/apparmor.d/usr.sbin.traceroute (/etc/apparmor.d/usr.sbin.traceroute line 29): profile /usr/{sbin/traceroute,bin/traceroute.db} network rules not enforced
 failed!

Great to see the new ‘freshclam’ profile. Thanks a lot. As i have absolute no knowledge about apparmor, so i’m unfortunately not able to provide a solution.[/quote]

Not really errors just warnings. They’re just not enforced by default.

Except for.

profile has merged rule with conflicting x modifiers ERROR processing regexs for profile sanitized_helper, failed to load

Which seems to be an issue with the AppArmor profile that Tor developers are shipping. They’re using quite some non-standard way to confine Tor. Nevertheless, the profile is enforced when you run “sudo aa-status”. Since it works and they would ask for a patch, I think we better don’t spend energy on fixing that message.

We could consider this. On the other hand I find it quite useful to have them installed by default so you can simply enforce them by just using one command. This all needs documentation so we can refer to it.