Apparmor enforce mode not enforcing all profiles
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apparmor (Ubuntu) |
New
|
Undecided
|
Unassigned |
Bug Description
I'm having difficulties transferring over all my apparmor profiles into enforcing mode, (sudo aa-enforce /etc/apparmor.d/*) For some reason, when I enter them in manually one at a time it works however its still buggy with certain profiles that are listed in complain mode. Any help would be appreciated. I've copied over the terminal error messages with codes. See below.
netuser-
Profile for /etc/apparmor.
Traceback (most recent call last):
File "/usr/sbin/
tool.
File "/usr/lib/
apparmor.
File "/usr/lib/
read_
File "/usr/lib/
profile_data = parse_profile_
File "/usr/lib/
store_
File "/usr/lib/
raise AppArmorExcepti
apparmor.
Copy of 20 profiles in complain mode that need to be altered to enforce. See below.
20 profiles are in complain mode.
/sbin/klogd
/sbin/syslog-ng
/sbin/syslogd
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/sbin/identd
/usr/sbin/mdnsd
/usr/sbin/nscd
/usr/
/{usr/,}bin/ping
Any ideas?
-Newaye
A fix for this issue is in progress: https:/ /bugs.launchpad .net/ubuntu/ +source/ apparmor/ +bug/1449769
In the meantime you can hand-edit the policies to remove the complain flag and reload them with apparmor_parser --replace /etc/apparmor.d/...
Sorry for the inconvenience.