I'm trying to use AppArmor on a remote hosted Xen server with a custom built kernel.
AppArmor appears to be running, but not correctly. For example if I run the following command as root:
# aa-status
apparmor module is loaded.
You do not have enough privilege to read the profile set.
Any ideas what's going on would be helpful. Thank you!
Here's my kernel options:
# grep -i APPARMOR /boot/config-3.6.11-xen
CONFIG_SECURITY_APPARMOR=y
CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
CONFIG_DEFAULT_SECURITY_APPARMOR=y
CONFIG_DEFAULT_SECURITY="apparmor"
dmesg showing AppArmor started:
# dmesg | grep AppArmor
AppArmor: AppArmor initialized
AppArmor: AppArmor Filesystem Enabled
AppArmor hooks in /sys and their corresponding values:
(Note: no /sys/kernel/security/apparmor/profiles)
# for x in $(find /sys -type f | grep apparmor) ; do echo -n "$x - "; cat $x ; done
/sys/kernel/security/apparmor/features/rlimit/mask - cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
/sys/kernel/security/apparmor/features/capability - 0xffffff
/sys/kernel/security/apparmor/features/file/mask - create read write exec append mmap_exec link lock
/sys/kernel/security/apparmor/features/domain/change_profile - yes
/sys/kernel/security/apparmor/features/domain/change_onexec - yes
/sys/kernel/security/apparmor/features/domain/change_hatv - yes
/sys/kernel/security/apparmor/features/domain/change_hat - yes
/sys/kernel/security/apparmor/.remove - cat: /sys/kernel/security/apparmor/.remove: Invalid argument
/sys/kernel/security/apparmor/.replace - cat: /sys/kernel/security/apparmor/.replace: Invalid argument
/sys/kernel/security/apparmor/.load - cat: /sys/kernel/security/apparmor/.load: Invalid argument
/sys/module/apparmor/parameters/mode - enforce
/sys/module/apparmor/parameters/audit - normal
/sys/module/apparmor/parameters/debug - N
/sys/module/apparmor/parameters/paranoid_load - Y
/sys/module/apparmor/parameters/enabled - Y
/sys/module/apparmor/parameters/path_max - 8192
/sys/module/apparmor/parameters/logsyscall - N
/sys/module/apparmor/parameters/lock_policy - N
/sys/module/apparmor/parameters/audit_header - Y
The user-land packages I have installed:
# dpkg -l apparmor*
Version Description
+++-===============================================-===============================================-==============================================================================================================
ii apparmor 2.7.102-0ubuntu3.7 User-space parser utility for AppArmor
ii apparmor-notify 2.7.102-0ubuntu3.7 AppArmor notification system
ii apparmor-profiles 2.7.102-0ubuntu3.7 Profiles for AppArmor Security policies
ii apparmor-utils 2.7.102-0ubuntu3.7 Utilities for controlling AppArmor
Again, if anyone has any idea why it's not operating correctly, including user-error, let me know. As far as I can see it looks like it should be working.
Thanks again for any guidance.
Best Answer
I had the same problem ;)
Just download a apparmor package from: http://launchpad.net/apparmor/2.7/2.7.2/+download/apparmor-2.7.2.tar.gz
navigate to: /apparmor-2.7.2/kernel-patches/3.1 < Here you have a patches for the kernel. Don't worry - they are working with 3.2.x version ;)
patch the kernel, select the option "Enable AppArmor 2.4 compatability" (eg. from make nconfig/make menuconfig).
Compile and be happy with fully working apparmor
Hope it helps!
PS. Sorry for my lame english - It's not my primary language :)