| 2017-05-18 13:35:45 |
Mikhail Kurinnoi |
description |
I play around confined init (disabled SECURITY_APPARMOR_UNCONFINED_INIT kernel config option). And faced one issue connected to apparmor utils.
apparmor utils v 2.11.0
1) Kernel configured with disabled SECURITY_APPARMOR_UNCONFINED_INIT.
2) default profile not reloaded by user's default profile.
3) # ps aux -Z | grep "default"
...
default (-) root 2 0.0 0.0 0 0 ? S 16:16 0:00 [kthreadd]
default (-) root 3 0.0 0.0 0 0 ? S 16:16 0:00 [ksoftirqd/0]
...
4) # aa-status
Traceback (most recent call last):
File "/usr/lib/python-exec/python3.4/aa-status", line 255, in <module>
commands[cmd]()
File "/usr/lib/python-exec/python3.4/aa-status", line 59, in cmd_verbose
profiles = get_profiles()
File "/usr/lib/python-exec/python3.4/aa-status", line 149, in get_profiles
profiles[match.group(1)] = match.group(2)
AttributeError: 'NoneType' object has no attribute 'group'
1) Kernel configured with disabled SECURITY_APPARMOR_UNCONFINED_INIT.
2) default profile reloaded by user's default profile, for example:
profile default flags=(complain) {}
3) # ps aux -Z | grep "default"
...
default (complain) root 2 0.0 0.0 0 0 ? S 16:16 0:00 [kthreadd]
default (complain) root 3 0.0 0.0 0 0 ? S 16:16 0:00 [ksoftirqd/0]
...
4) # aa-status
...
142 processes are in complain mode.
default (2)
default (3)
... |
I play around confined init (disabled SECURITY_APPARMOR_UNCONFINED_INIT kernel config option). And faced one issue connected to apparmor utils.
apparmor utils v 2.11.0
---------------------------------------------------------------------
1) Kernel configured with disabled SECURITY_APPARMOR_UNCONFINED_INIT.
2) default profile not reloaded by user's default profile.
3) # ps aux -Z | grep "default"
...
default (-) root 2 0.0 0.0 0 0 ? S 16:16 0:00 [kthreadd]
default (-) root 3 0.0 0.0 0 0 ? S 16:16 0:00 [ksoftirqd/0]
...
4) # aa-status
Traceback (most recent call last):
File "/usr/lib/python-exec/python3.4/aa-status", line 255, in <module>
commands[cmd]()
File "/usr/lib/python-exec/python3.4/aa-status", line 59, in cmd_verbose
profiles = get_profiles()
File "/usr/lib/python-exec/python3.4/aa-status", line 149, in get_profiles
profiles[match.group(1)] = match.group(2)
AttributeError: 'NoneType' object has no attribute 'group'
---------------------------------------------------------------------
1) Kernel configured with disabled SECURITY_APPARMOR_UNCONFINED_INIT.
2) default profile reloaded by user's default profile, for example:
profile default flags=(complain) {}
3) # ps aux -Z | grep "default"
...
default (complain) root 2 0.0 0.0 0 0 ? S 16:16 0:00 [kthreadd]
default (complain) root 3 0.0 0.0 0 0 ? S 16:16 0:00 [ksoftirqd/0]
...
4) # aa-status
...
142 processes are in complain mode.
default (2)
default (3)
... |
|
