I am on Debian buster, running tbb 7.0.11 . This is a clean profile and everything. I wanted to upload a few pictures from /home/shirish/Pictures but when I tried to, it says/said the following -
Could not read the contents of shirish
Error opening directory '/home/shirish': Permission denied
I have no idea why this is so, hunting on the board/forum gave me the following query and answer.
Directory Cannot be Readed: Permission Denied after update to 0.3.0
I do have apparmor installed but it seems it is like a dependency on something rather than something that I explicitly installed.
While the answer has been given therein, saying -
[Service]
AppArmorProfile=
It didn't explain the rationale or what that line does or do, no explanation.
Could somebody throw some more light on the matter. I do see the following after seeing Could not launch managed proxy executable at '/usr/bin/obfs4proxy' ('Operation not permitted')
but do not have any undertanding of apparmor except what I could make from the description of it.
shirish@debian:/etc/systemd/system$ cat /lib/systemd/system/tor@default.service
[Unit]
Description=Anonymizing overlay network for TCP
After=network.target nss-lookup.target
PartOf=tor.service
ReloadPropagatedFrom=tor.service
[Service]
Type=notify
NotifyAccess=all
PIDFile=/var/run/tor/tor.pid
PermissionsStartOnly=yes
ExecStartPre=/usr/bin/install -Z -m 02755 -o debian-tor -g debian-tor -d /var/run/tor
ExecStartPre=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0 --verify-config
ExecStart=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0
ExecReload=/bin/kill -HUP ${MAINPID}
KillSignal=SIGINT
TimeoutStartSec=300
TimeoutStopSec=60
Restart=on-failure
LimitNOFILE=65536
# Hardening
AppArmorProfile=-system_tor
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/proc
ReadWriteDirectories=-/var/lib/tor
ReadWriteDirectories=-/var/log/tor
ReadWriteDirectories=-/var/run
CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH
I have no idea if I'm barking up the wrong tree altogether.
Any help/guidance in the matter would be appreciated.
torbrowser-launcher
? If so, it has its own apparmor profile that might be the source of this issue. Also if it is apparmor you should have a corresponding output in your logs, if you run likedmesg | grep -i apparmor
or similar and see if it has anything related to access to that folder being denied and which profile caused it.torbrowser-launcher
profile, which is installed with it. Do you need anything specifically about it trying to access ~/Pictures? I don't see it allowing that anywhere: github.com/micahflee/torbrowser-launcher/blob/master/apparmor/…