Page MenuHomeSolus

Possible Apparmor/Firejail profile bug
Open, Needs TriagePublic

Description

was asked to file this per @stalebrim at the forum.

On this thread https://discuss.getsol.us/d/6600-still-got-that-nagging-apparmor-problem/17, I provide anecdotal log evidence that soon after (minutes) an eopkg firejail install, my apparmor profiles became corrupt, thereby failing to load apparmor profiles for a week and leaving me vulnerable.

The last two log entries of that thread (

journalctl -xe
``` and

eopkg history

) is where we think we put 2 an 2 together..Since an eopkg rm firejail has cured this problem, I can no longer replicate, but thought it might be prudent to bring to your attention. Thank you.

Event Timeline

brent created this task.Tue, Apr 6, 1:01 PM
brent added a comment.Tue, Apr 6, 1:03 PM

my formatting went to heck, sorry

just to confirm that brent isnt crazy (not regarding this issue anyway), i had the same issue, removing firejail fixes it

This bug can be fixed by editing /etc/apparmor.d/firejail-default.

Just add:

#include if exists <tunables/run>

to the top of the file. Then run "sudo usysconf run -f" and "sudo systemctl start apparmor".

I hope this fix will be added to the next release.

brent added a comment.Fri, Apr 16, 5:49 PM

This bug can be fixed by editing /etc/apparmor.d/firejail-default.
Just add:

#include if exists <tunables/run>

to the top of the file. Then run "sudo usysconf run -f" and "sudo systemctl start apparmor".
I hope this fix will be added to the next release.

Thanks for furnishing this. If this is not updated, I cut an paste your directions if I use firejail again down the road.