2

I generated an apparmor profile for the tor binary that comes bundled in Ricochet:

# Last Modified: Sun Apr  2 2017
#include <tunables/global>

/ricochet/*-ricochet/tor {
  #include <abstractions/base>

  deny /etc/ld.so.preload r,

  deny /proc/sys/kernel/random/uuid r,
  /ricochet/*-ricochet/config/tor/ rwk,
  /ricochet/*-ricochet/config/tor/ r,
  /ricochet/*-ricochet/config/tor/cached-certs r,
  /ricochet/*-ricochet/config/tor/cached-microdesc-consensus r,
  /ricochet/*-ricochet/config/tor/cached-microdescs r,
  /ricochet/*-ricochet/config/tor/cached-microdescs.new r,
  /ricochet/*-ricochet/config/tor/control-port w,
  /ricochet/*-ricochet/config/tor/control-port.tmp rw,
  /ricochet/*-ricochet/config/tor/default_torrc r,
  /ricochet/*-ricochet/config/tor/lock rwk,
  /ricochet/*-ricochet/config/tor/state rw,
  /ricochet/*-ricochet/config/tor/state.tmp rw,
  /ricochet/*-ricochet/config/tor/torrc r,
  /ricochet/*-ricochet/tor mr,
  deny /sys/devices/system/cpu/ r,
  /usr/share/tor/geoip r,
  /usr/share/tor/geoip6 r,

}

Not sure how sensitive /proc/sys/kernel/random/uuid and /proc/sys/kernel/random/uuid are so I denied them. Ricochet opens fine with them denied. Tell me if I should allow them though...

My biggest concern is /usr/share/tor/geoip. I have it set to read-only but I'm still getting journalctl complaints:

$ journalctl -af
Apr 02 <uname removed> kernel: audit: type=1400 audit(1491170231.720:200): apparmor="DENIED" operation="open" profile="/ricochet/<removed>-ricochet/tor" name="/usr/share/tor/geoip" pid=2563 comm="tor" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Apr 02 <uname removed> kernel: audit: type=1400 audit(1491170231.720:201): apparmor="DENIED" operation="open" profile="/ricochet/<removed>-ricochet/tor" name="/usr/share/tor/geoip6" pid=2563 comm="tor" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Can anyone help me debug this? Why is apparmor denying r access?

  • 1
    Hey, it's great that you're trying to make an AppArmor profile for Ricochet (it'd be extra great if you could make it generic to the debian ricochet package too) and also we're probably not the best place to give apparmor advice, infosec might be a better SE site to ask. Someone may have the answer here, I guess that's fine but it might be worth asking there too. – cacahuatl Apr 3 '17 at 2:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.