I generated an apparmor profile for the tor binary that comes bundled in Ricochet:
# Last Modified: Sun Apr 2 2017
#include <tunables/global>
/ricochet/*-ricochet/tor {
#include <abstractions/base>
deny /etc/ld.so.preload r,
deny /proc/sys/kernel/random/uuid r,
/ricochet/*-ricochet/config/tor/ rwk,
/ricochet/*-ricochet/config/tor/ r,
/ricochet/*-ricochet/config/tor/cached-certs r,
/ricochet/*-ricochet/config/tor/cached-microdesc-consensus r,
/ricochet/*-ricochet/config/tor/cached-microdescs r,
/ricochet/*-ricochet/config/tor/cached-microdescs.new r,
/ricochet/*-ricochet/config/tor/control-port w,
/ricochet/*-ricochet/config/tor/control-port.tmp rw,
/ricochet/*-ricochet/config/tor/default_torrc r,
/ricochet/*-ricochet/config/tor/lock rwk,
/ricochet/*-ricochet/config/tor/state rw,
/ricochet/*-ricochet/config/tor/state.tmp rw,
/ricochet/*-ricochet/config/tor/torrc r,
/ricochet/*-ricochet/tor mr,
deny /sys/devices/system/cpu/ r,
/usr/share/tor/geoip r,
/usr/share/tor/geoip6 r,
}
Not sure how sensitive /proc/sys/kernel/random/uuid
and /proc/sys/kernel/random/uuid
are so I denied them. Ricochet opens fine with them denied. Tell me if I should allow them though...
My biggest concern is /usr/share/tor/geoip
. I have it set to read-only
but I'm still getting journalctl complaints:
$ journalctl -af
Apr 02 <uname removed> kernel: audit: type=1400 audit(1491170231.720:200): apparmor="DENIED" operation="open" profile="/ricochet/<removed>-ricochet/tor" name="/usr/share/tor/geoip" pid=2563 comm="tor" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Apr 02 <uname removed> kernel: audit: type=1400 audit(1491170231.720:201): apparmor="DENIED" operation="open" profile="/ricochet/<removed>-ricochet/tor" name="/usr/share/tor/geoip6" pid=2563 comm="tor" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Can anyone help me debug this? Why is apparmor denying r
access?