roddhjav / apparmor.d Goto Github PK

View Code? Open in Web Editor NEW

365.0 13.0 29.0 6.92 MB

Full set of AppArmor profiles (~ 1500 profiles)

Home Page: https://apparmor.pujol.io

License: GNU General Public License v2.0

Shell 7.24% Go 77.56% Makefile 3.12% HCL 8.42% Jinja 3.67%

apparmor mandatory-access-control security hardening apparmor-profiles linux apparmor-profile

apparmor.d's Introduction

Hi there 👋

Just a French living in Ireland. Security researcher at The Collaboratory. Ph.D from University College Dublin. My area of work includes user privacy, secret management and system security.

If you like my work and want me to be able to keep improving it, please sponsor me on GitHub.

Generally you can find me on many places as roddhjav: Mastodon | Twitter | Gitlab | Keybase

My projects

Pass

pass-audit: A pass extension for auditing your password repository. (python)
pass-import: A pass extension for importing data from most existing password managers. (python)
pass-tomb: A pass extension that helps you keep the whole tree of passwords encrypted inside a Tomb. (bash)
pass-update: A pass extension that provides an easy flow for updating passwords. (bash)

System Security

apparmor.d: Full set of AppArmor profiles (~ 1400 profiles). (go)

apparmor.d's People

Contributors

Stargazers

Watchers

apparmor.d's Issues

Bluez5 HSP/HFP profile error

I can't use my BT earphone mic as there are no HSP/HFP profiles present to select while AppArmor is enabled
AppArmor is in default Complain Mode

$ systemctl status bluetooth

Wireplumber falling back to use Bluez5 legacy API
A2DP sink profiles are working fine

$ systemctl status --user wireplumber

I ran aa-log but found nothing related to Bluez or Bluetooth there

`pulseaudio` tries to create `@{run}/user/@{uid}/dconf/`

Hi. The pulseaudio profile tries to create the directory @{run}/user/@{uid}/dconf/, but this operation isn't allowed or denied. Should it be allowed?

type=AVC msg=audit(1640736194.447:2538): apparmor="DENIED" operation="mkdir" profile="pulseaudio" name="/run/user/1001/dconf/" pid=12848 comm="gsettings-helpe" requested_mask="c" denied_mask="c" fsuid=1001 ouid=1001FSUID="user" OUID="user"

[Feature] Desktop Entry Specification (Grouping)

Is there an easy way to parse the .desktop file for each application?
If yes, we could create a tree based on their categories.

https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html

All profiles would be in the same location as in the GNOME / KDE menu.

Examples:
firefox.desktop=Network/WebBrowser
libreoffice-base.desktop=Office/Database
libreoffice-impress.desktop=Office/Presentation
libreoffice-calc.desktop=Office/Spreadsheet
libreoffice-writer.desktop=Office/WordProcessor
kmail2.desktop=Office/Network/Email
gparted.desktop=System/Filesystem

aa-logprof partially broken even when installing specific profiles

As discussed in #76 installing the profiles presented here breaks the AppArmor userspace tools as @{exec_path} is not supported. As I don't want to go without aa-logprof I only install specific profiles with pick and remove @{exec_path}.

Unfortunately, even this approach breaks aa-logprof partially! That tool now only presents network- and ptrace-related rules but no longer path-related rules. Which means that creating new profiles becomes rather laborious as it's no longer possible to interactively add path rules. aa-log is unfortunately no proper substitute.

I've sifted through the code of pick but couldn't find anything. So something else must be the culprit. What am I missing?

Debian 11 default abstractions lack drop-in directives

On Ubuntu it's not the case.
After installation of the package:

debian11$ grep '\.d>' /etc/apparmor.d/abstractions/* 2> /dev/null
/etc/apparmor.d/abstractions/X-strict:  include if exists <abstractions/X-strict.d>
/etc/apparmor.d/abstractions/app-launcher-root:  include if exists <abstractions/app-launcher-root.d>
/etc/apparmor.d/abstractions/app-launcher-user:  include if exists <abstractions/app-launcher-user.d>
/etc/apparmor.d/abstractions/apt-common:  include if exists <abstractions/apt-common.d>
/etc/apparmor.d/abstractions/chromium-common:  include if exists <abstractions/chromium-common.d>
/etc/apparmor.d/abstractions/dbus-network-manager-strict:  #include if exists <abstractions/dbus-network-manager-strict.d>
/etc/apparmor.d/abstractions/dconf-write:  include if exists <abstractions/dconf-write.d>
/etc/apparmor.d/abstractions/devices-usb:  include if exists <abstractions/devices-usb.d>
/etc/apparmor.d/abstractions/disks-read:  include if exists <abstractions/disks-read.d>
/etc/apparmor.d/abstractions/disks-write:  include if exists <abstractions/disks-write.d>
/etc/apparmor.d/abstractions/exo-open:  #include if exists <abstractions/exo-open.d>
/etc/apparmor.d/abstractions/file-browsing-strict:  include if exists <abstractions/file-browsing-strict.d>
/etc/apparmor.d/abstractions/flatpak-snap:  include if exists <abstractions/flatpak-snap.d>
/etc/apparmor.d/abstractions/fontconfig-cache-read:  include if exists <abstractions/fontconfig-cache-read.d>
/etc/apparmor.d/abstractions/fontconfig-cache-write:  include if exists <abstractions/fontconfig-cache-write.d>
/etc/apparmor.d/abstractions/fzf:  include if exists <abstractions/fzf.d>
/etc/apparmor.d/abstractions/gio-open:  #include if exists <abstractions/gio-open.d>
/etc/apparmor.d/abstractions/gstreamer:  include if exists <abstractions/gstreamer.d>
/etc/apparmor.d/abstractions/gtk:  include if exists <abstractions/gtk.d>
/etc/apparmor.d/abstractions/gvfs-open:  #include if exists <abstractions/gvfs-open.d>
/etc/apparmor.d/abstractions/kde-open5:  #include if exists <abstractions/kde-open5.d>
/etc/apparmor.d/abstractions/kde4:  include if exists <abstractions/kde4.d>
/etc/apparmor.d/abstractions/kde5-plasma5:  include if exists <abstractions/kde5-plasma5.d>
/etc/apparmor.d/abstractions/libvirt-lxc:  include if exists <abstractions/libvirt-lxc.d>
/etc/apparmor.d/abstractions/libvirt-qemu:  include if exists <abstractions/libvirt-qemu.d>
/etc/apparmor.d/abstractions/nameservice-strict:  include if exists <abstractions/nameservice-strict.d>
/etc/apparmor.d/abstractions/systemd-common:  include if exists <abstractions/systemd-common.d>
/etc/apparmor.d/abstractions/thumbnails-cache-read:  include if exists <abstractions/thumbnails-cache-read.d>
/etc/apparmor.d/abstractions/thumbnails-cache-write:  include if exists <abstractions/thumbnails-cache-write.d>
/etc/apparmor.d/abstractions/totem:  include if exists <abstractions/totem.d>
/etc/apparmor.d/abstractions/trash:  include if exists <abstractions/trash.d>
/etc/apparmor.d/abstractions/user-download-strict:  include if exists <abstractions/user-download-strict.d>
/etc/apparmor.d/abstractions/user-read:  include if exists <abstractions/user-read.d>
/etc/apparmor.d/abstractions/vlc-art-cache-write:  include if exists <abstractions/vlc-art-cache-write.d>
/etc/apparmor.d/abstractions/xdg-open:  #include if exists <abstractions/xdg-open.d>
/etc/apparmor.d/abstractions/zsh:  include if exists <abstractions/zsh.d>

Arch linux conflict

git clone https://aur.archlinux.org/apparmor.d-git.git
cd apparmor.d-git
makepkg -s
sudo pacman -U apparmor.d-git-0.813-1-x86_64.pkg.tar.zst
--overwrite etc/apparmor.d/tunables/global
--overwrite etc/apparmor.d/tunables/xdg-user-dirs
--overwrite etc/apparmor.d/abstractions/trash

Pacman output:

apparmor.d-git: /etc/apparmor.d/abstractions/lxc/container-base exists in filesystem (owned by lxc)
apparmor.d-git: /etc/apparmor.d/abstractions/lxc/start-container exists in filesystem (owned by lxc)
apparmor.d-git: /etc/apparmor.d/lxc-containers exists in filesystem (owned by lxc)
apparmor.d-git: /etc/apparmor.d/lxc/lxc-default exists in filesystem (owned by lxc)
apparmor.d-git: /etc/apparmor.d/lxc/lxc-default-cgns exists in filesystem (owned by lxc)
apparmor.d-git: /etc/apparmor.d/lxc/lxc-default-with-mounting exists in filesystem (owned by lxc)
apparmor.d-git: /etc/apparmor.d/lxc/lxc-default-with-nesting exists in filesystem (owned by lxc)
apparmor.d-git: /etc/apparmor.d/usr.bin.lxc-start exists in filesystem (owned by lxc)

gpg decryption fails with apparmor enabled - no pinentry, no secret key

Hi! Thank you for this excellent repo! I'm curious if there might be something that I'm doing wrong when it comes to using gpg and these apparmor profiles. I find that with these profiles enabled gpg fails to decrypt files, and errors out with the following error:

gpg: public key decryption failed: No pinentry
gpg: decryption failed: No secret key

This is able to be done successfully without apparmor enabled. GPG has its directory at ~/.gnupg with regular file permissions, all binaries are located where expected.

I tried adding execute permission for pinentry to all gpg profiles in this repo as

  /{usr/,}bin/pinentry{,-*}     rPx,

truthfully not entirely sure about the proper arguements(? rPx, rix, etc?)

Any help is greatly appreciated, thank you again!

edit: seeing the following in aa-log
DENIED pinentry file_mmap /usr/bin/bash comm=pinentry requested_mask=r denied_mask=r

Feature-Request: Minimal Installation

Is there a way to create a minimal installation?
A software package that only includes the AppArmor profiles.

I would like to avoid installations in /root.

evince profile and abstraction

Hi. Why does profiles-a-f/evince not include abstractions/evince? I discovered that profiles-a-f/evince can't view DjVu and PostScript files without particular permissions which are present in abstractions/evince. Or these permissions may be added to profiles-a-f/evince since they are 3 lines.

systemd sandboxing

Recently systemd acquired a capability to isolate its services using kernel namespaces. An example is service file /usr/lib/systemd/system/tor.service shipped with Arch Linux. AFAIK, kernel namespaces are strictly more powerful than AppArmor. For example, we can give a separate /tmp directory to every process using kernel namespaces.

What is the interaction between AppArmor profiles and systemd service files with sandboxing? Does systemd sandboxing obsolete AppArmor profiles? Should we use AppArmor profiles and systemd sandboxing together?

Deprecating `trash` broke Ubuntu/Debian

688a62e

ubuntu2204# dpkg -S /etc/apparmor.d/abstractions/trash
dpkg-query: no path found matching pattern /etc/apparmor.d/abstractions/trash

debian11# dpkg -S /etc/apparmor.d/abstractions/trash
dpkg-query: no path found matching pattern /etc/apparmor.d/abstractions/trash

AppArmor parser error for /etc/apparmor.d/nautilus in /etc/apparmor.d/nautilus at line 18: Could not open 'abstractions/trash'

Should we move trash back with configure on Ubuntu/Debian?

Ubuntu 22.04 support

Hi,

Below is a list of audit events for a default Ubuntu 22.04 installation (on ZFS), after running the following Ansible playbook: https://github.com/ansible-lockdown/UBUNTU20-CIS. Maybe I can contribute a bit myself, but my experience with writing Apparmor profiles is a bit lacking.

ALLOWED journalctl connect /run/systemd/journal/io.systemd.journal comm=journalctl requested_mask=wr denied_mask=wr
ALLOWED fsck file_inherit /run/systemd/fsck.progress comm=fsck requested_mask=r denied_mask=r
ALLOWED systemd-makefs open /proc/sys/kernel/osrelease comm=systemd-makefs requested_mask=r denied_mask=r
ALLOWED systemd-makefs open /proc/1/environ comm=systemd-makefs requested_mask=r denied_mask=r
ALLOWED systemd-makefs ptrace comm=systemd-makefs requested_mask=read denied_mask=read peer=unconfined
ALLOWED systemd-makefs open /proc/cmdline comm=systemd-makefs requested_mask=r denied_mask=r
ALLOWED systemd-makefs open /dev/dm-1 comm=systemd-makefs requested_mask=r denied_mask=r
ALLOWED systemd-makefs file_lock /dev/dm-1 comm=systemd-makefs requested_mask=wk denied_mask=wk
ALLOWED systemd-makefs open /sys/devices/virtual/block/dm-1/ comm=systemd-makefs requested_mask=r denied_mask=r
ALLOWED systemd-makefs open /sys/devices/virtual/block/dm-1/dm/uuid comm=systemd-makefs requested_mask=r denied_mask=r
ALLOWED mount exec /usr/sbin/mount.zfs info="profile transition not found" comm=mount requested_mask=x denied_mask=x error=-13

ALLOWED accounts-daemon exec /usr/share/language-tools/language-validate comm=accounts-daemon requested_mask=x denied_mask=x
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate file_inherit /dev/null comm=language-valida requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate file_mmap /usr/bin/dash comm=language-valida requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=language-valida requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate open /etc/ld.so.cache comm=language-valida requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=language-valida requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=language-valida requested_mask=rm denied_mask=rm
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate open /usr/share/language-tools/language-validate comm=language-valida requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate exec /usr/share/language-tools/language-options comm=language-valida requested_mask=x denied_mask=x
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options file_inherit /dev/null comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options file_mmap /usr/bin/perl comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /etc/ld.so.cache comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /usr/lib/x86_64-linux-gnu/libm.so.6 comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options file_mmap /usr/lib/x86_64-linux-gnu/libm.so.6 comm=language-option requested_mask=rm denied_mask=rm
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=language-option requested_mask=rm denied_mask=rm
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /usr/lib/x86_64-linux-gnu/libcrypt.so.1.1.0 comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options file_mmap /usr/lib/x86_64-linux-gnu/libcrypt.so.1.1.0 comm=language-option requested_mask=rm denied_mask=rm
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /dev/urandom comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /usr/lib/locale/locale-archive comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /usr/share/language-tools/language-options comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /usr/lib/x86_64-linux-gnu/perl-base/strict.pm comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /usr/lib/x86_64-linux-gnu/perl-base/warnings.pm comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options exec /usr/bin/dash comm=language-option requested_mask=x denied_mask=x
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash file_inherit /dev/null comm=sh requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash file_mmap /usr/bin/dash comm=sh requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=sh requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash open /etc/ld.so.cache comm=sh requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=sh requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=sh requested_mask=rm denied_mask=rm
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash capable comm=sh capability=6 capname=setgid
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash exec /usr/bin/locale comm=sh requested_mask=x denied_mask=x
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash exec /usr/bin/grep comm=sh requested_mask=x denied_mask=x
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/locale file_inherit /dev/null comm=locale requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/grep file_mmap /usr/bin/grep comm=grep requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/locale file_mmap /usr/bin/locale comm=locale requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/locale file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=locale requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/grep file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=grep requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/locale open /etc/ld.so.cache comm=locale requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/grep open /etc/ld.so.cache comm=grep requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/grep open /usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3 comm=grep requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/locale open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=locale requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/locale file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=locale requested_mask=rm denied_mask=rm
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/grep file_mmap /usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3 comm=grep requested_mask=rm denied_mask=rm
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/grep open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=grep requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/locale open /usr/lib/locale/locale-archive comm=locale requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/grep file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=grep requested_mask=rm denied_mask=rm
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/grep open /usr/lib/locale/locale-archive comm=grep requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/locale open /usr/lib/locale/ comm=locale requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/grep open /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache comm=grep requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/locale open /etc/locale.alias comm=locale requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/grep open /etc/locale.alias comm=grep requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options//null-/usr/bin/dash//null-/usr/bin/grep open /proc/2478/maps comm=grep requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /usr/share/locale-langpack/ comm=language-option requested_mask=r denied_mask=r
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /usr/share/locale/ comm=language-option requested_mask=r denied_mask=r

ALLOWED switcheroo-control open /sys/devices/pci0000:00/0000:00:02.0/uevent comm=switcheroo-cont requested_mask=r denied_mask=r
ALLOWED switcheroo-control open /run/udev/data/+pci:0000:00:02.0 comm=switcheroo-cont requested_mask=r denied_mask=r
ALLOWED switcheroo-control open /sys/devices/pci0000:00/0000:00:02.0/boot_vga comm=switcheroo-cont requested_mask=r denied_mask=r
ALLOWED switcheroo-control connect run/dbus/system_bus_socket info="Failed name lookup - disconnected path" comm=pool-switcheroo requested_mask=wr denied_mask=wr error=-13
ALLOWED accounts-daemon//null-/usr/share/language-tools/language-validate//null-/usr/share/language-tools/language-options open /usr/share/language-tools/main-countries comm=language-option requested_mask=r denied_mask=r
ALLOWED systemd-logind sendmsg run/systemd/journal/socket info="Failed name lookup - disconnected path" comm=systemd-logind requested_mask=w denied_mask=w error=-13
ALLOWED systemd-logind sendmsg run/systemd/notify info="Failed name lookup - disconnected path" comm=systemd-logind requested_mask=w denied_mask=w error=-13
ALLOWED systemd-logind connect run/dbus/system_bus_socket info="Failed name lookup - disconnected path" comm=systemd-logind requested_mask=wr denied_mask=wr error=-13
ALLOWED udisksd open /sys/devices/virtual/block/zd0/uevent comm=udisksd requested_mask=r denied_mask=r
ALLOWED udisksd open /run/udev/data/b230:0 comm=udisksd requested_mask=r denied_mask=r
ALLOWED udisksd open /sys/devices/virtual/block/zd0/slaves/ comm=udisksd requested_mask=r denied_mask=r
ALLOWED nm-dispatcher dbus_method_call org.freedesktop.DBus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=RequestName peer_label=dbus-daemon
ALLOWED udisksd open /etc/ssl/openssl.cnf comm=udisksd requested_mask=r denied_mask=r

ALLOWED run-parts open /etc/network/if-up.d/ comm=run-parts requested_mask=r denied_mask=r
ALLOWED run-parts exec /etc/network/if-up.d/avahi-autoipd comm=run-parts requested_mask=x denied_mask=x
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd file_inherit /dev/null comm=avahi-autoipd requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd file_mmap /usr/bin/dash comm=avahi-autoipd requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=avahi-autoipd requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd open /etc/ld.so.cache comm=avahi-autoipd requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=avahi-autoipd requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=avahi-autoipd requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd open /etc/network/if-up.d/avahi-autoipd comm=avahi-autoipd requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd exec /usr/bin/ip comm=avahi-autoipd requested_mask=x denied_mask=x
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd exec /usr/bin/grep comm=avahi-autoipd requested_mask=x denied_mask=x
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/grep file_mmap /usr/bin/grep comm=grep requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/grep file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=grep requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/grep open /etc/ld.so.cache comm=grep requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/grep open /usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3 comm=grep requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/grep file_mmap /usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3 comm=grep requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/grep open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=grep requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/grep file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=grep requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/grep open /proc/2644/maps comm=grep requested_mask=r denied_mask=r
ALLOWED udisksd open /sys/devices/virtual/block/zd0/removable comm=udisksd requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip file_inherit /dev/null comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip file_mmap /usr/bin/ip comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip open /etc/ld.so.cache comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip open /usr/lib/x86_64-linux-gnu/libbpf.so.0.5.0 comm=ip requested_mask=r denied_mask=r
ALLOWED udisksd open /sys/devices/virtual/block/zd0/size comm=udisksd requested_mask=r denied_mask=r
ALLOWED udisksd open /sys/devices/virtual/block/zd0/ro comm=udisksd requested_mask=r denied_mask=r
ALLOWED udisksd open /dev/zd0 comm=udisksd requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip file_mmap /usr/lib/x86_64-linux-gnu/libbpf.so.0.5.0 comm=ip requested_mask=rm denied_mask=rm
ALLOWED udisksd open /sys/devices/virtual/block/zd0/ comm=udisksd requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip open /usr/lib/x86_64-linux-gnu/libelf-0.186.so comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip file_mmap /usr/lib/x86_64-linux-gnu/libelf-0.186.so comm=ip requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip open /usr/lib/x86_64-linux-gnu/libmnl.so.0.2.0 comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip file_mmap /usr/lib/x86_64-linux-gnu/libmnl.so.0.2.0 comm=ip requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip open /usr/lib/x86_64-linux-gnu/libbsd.so.0.11.5 comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip file_mmap /usr/lib/x86_64-linux-gnu/libbsd.so.0.11.5 comm=ip requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip open /usr/lib/x86_64-linux-gnu/libcap.so.2.44 comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip file_mmap /usr/lib/x86_64-linux-gnu/libcap.so.2.44 comm=ip requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=ip requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip open /usr/lib/x86_64-linux-gnu/libz.so.1.2.11 comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip file_mmap /usr/lib/x86_64-linux-gnu/libz.so.1.2.11 comm=ip requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip open /usr/lib/x86_64-linux-gnu/libmd.so.0.0.5 comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip file_mmap /usr/lib/x86_64-linux-gnu/libmd.so.0.0.5 comm=ip requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip open /etc/iproute2/rt_scopes comm=ip requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/avahi-autoipd//null-/usr/bin/ip capable comm=ip capability=12 capname=net_admin
ALLOWED run-parts exec /etc/network/if-up.d/openvpn comm=run-parts requested_mask=x denied_mask=x
ALLOWED run-parts//null-/etc/network/if-up.d/openvpn file_inherit /dev/null comm=openvpn requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/openvpn file_mmap /usr/bin/dash comm=openvpn requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/openvpn file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=openvpn requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/openvpn open /etc/ld.so.cache comm=openvpn requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/openvpn open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=openvpn requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/openvpn file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=openvpn requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/openvpn open /etc/network/if-up.d/openvpn comm=openvpn requested_mask=r denied_mask=r
ALLOWED run-parts exec /etc/network/if-up.d/postfix comm=run-parts requested_mask=x denied_mask=x
ALLOWED run-parts//null-/etc/network/if-up.d/postfix file_inherit /dev/null comm=postfix requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix file_mmap /usr/bin/dash comm=postfix requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=postfix requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix open /etc/ld.so.cache comm=postfix requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=postfix requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=postfix requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix open /etc/network/if-up.d/postfix comm=postfix requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix exec /usr/bin/sed comm=postfix requested_mask=x denied_mask=x
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed file_inherit /dev/null comm=sed requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed file_mmap /usr/bin/sed comm=sed requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=sed requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed open /etc/ld.so.cache comm=sed requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed open /usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301 comm=sed requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed file_mmap /usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301 comm=sed requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed open /usr/lib/x86_64-linux-gnu/libselinux.so.1 comm=sed requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed file_mmap /usr/lib/x86_64-linux-gnu/libselinux.so.1 comm=sed requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=sed requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=sed requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed open /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4 comm=sed requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed file_mmap /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4 comm=sed requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed open /proc/filesystems comm=sed requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/sed open /var/spool/postfix/pid/master.pid comm=sed requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix open /dev/null comm=postfix requested_mask=wc denied_mask=wc
ALLOWED run-parts//null-/etc/network/if-up.d/postfix exec /usr/bin/ls comm=postfix requested_mask=x denied_mask=x
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls file_inherit /dev/null comm=ls requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls file_inherit /dev/null comm=ls requested_mask=w denied_mask=w
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls file_mmap /usr/bin/ls comm=ls requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=ls requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls open /etc/ld.so.cache comm=ls requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls open /usr/lib/x86_64-linux-gnu/libselinux.so.1 comm=ls requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls file_mmap /usr/lib/x86_64-linux-gnu/libselinux.so.1 comm=ls requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=ls requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=ls requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls open /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4 comm=ls requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls file_mmap /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4 comm=ls requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/ls open /proc/filesystems comm=ls requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix exec /usr/sbin/postconf comm=postfix requested_mask=x denied_mask=x
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_inherit /dev/null comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/sbin/postconf comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/postfix/libpostfix-tls.so comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/postfix/libpostfix-tls.so comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/postfix/libpostfix-dns.so comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/postfix/libpostfix-dns.so comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/postfix/libpostfix-global.so comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/postfix/libpostfix-global.so comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/postfix/libpostfix-util.so comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/postfix/libpostfix-util.so comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /etc/ld.so.cache comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libsasl2.so.2.0.25 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libsasl2.so.2.0.25 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libssl.so.3 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libssl.so.3 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libcrypto.so.3 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libcrypto.so.3 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libdb-5.3.so comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libdb-5.3.so comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libnsl.so.2.0.1 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libnsl.so.2.0.1 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libicuuc.so.70.1 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libicuuc.so.70.1 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libtirpc.so.3.0.0 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libtirpc.so.3.0.0 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libicudata.so.70.1 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libicudata.so.70.1 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libm.so.6 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libm.so.6 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libgcc_s.so.1 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libgcc_s.so.1 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libkrb5.so.3.3 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libkrb5.so.3.3 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libcom_err.so.2.1 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libcom_err.so.2.1 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libkeyutils.so.1.9 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libkeyutils.so.1.9 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /usr/lib/x86_64-linux-gnu/libresolv.so.2 comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf file_mmap /usr/lib/x86_64-linux-gnu/libresolv.so.2 comm=postconf requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /etc/postfix/main.cf comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/sbin/postconf open /etc/postfix/master.cf comm=postconf requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix exec /usr/bin/cp comm=postfix requested_mask=x denied_mask=x
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp file_inherit /dev/null comm=cp requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp file_inherit /dev/null comm=cp requested_mask=w denied_mask=w
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp file_mmap /usr/bin/cp comm=cp requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=cp requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp open /etc/ld.so.cache comm=cp requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp open /usr/lib/x86_64-linux-gnu/libselinux.so.1 comm=cp requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp file_mmap /usr/lib/x86_64-linux-gnu/libselinux.so.1 comm=cp requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp open /usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301 comm=cp requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp file_mmap /usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301 comm=cp requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp open /usr/lib/x86_64-linux-gnu/libattr.so.1.1.2501 comm=cp requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp file_mmap /usr/lib/x86_64-linux-gnu/libattr.so.1.1.2501 comm=cp requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=cp requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=cp requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp open /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4 comm=cp requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp file_mmap /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4 comm=cp requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp open /proc/filesystems comm=cp requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp open /run/systemd/resolve/stub-resolv.conf comm=cp requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp open /var/spool/postfix/etc/resolv.conf comm=cp requested_mask=w denied_mask=w
ALLOWED run-parts//null-/etc/network/if-up.d/postfix//null-/usr/bin/cp truncate /var/spool/postfix/etc/resolv.conf comm=cp requested_mask=w denied_mask=w

ALLOWED run-parts exec /etc/wpa_supplicant/ifupdown.sh comm=run-parts requested_mask=x denied_mask=x
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh file_inherit /dev/null comm=wpasupplicant requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh file_mmap /usr/bin/dash comm=wpasupplicant requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=wpasupplicant requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh open /etc/ld.so.cache comm=wpasupplicant requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=wpasupplicant requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=wpasupplicant requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh open /etc/wpa_supplicant/ifupdown.sh comm=wpasupplicant requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh open /etc/wpa_supplicant/functions.sh comm=wpasupplicant requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh exec /usr/bin/grep comm=wpasupplicant requested_mask=x denied_mask=x
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh//null-/usr/bin/grep file_mmap /usr/bin/grep comm=grep requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh//null-/usr/bin/grep file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=grep requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh//null-/usr/bin/grep open /etc/ld.so.cache comm=grep requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh//null-/usr/bin/grep open /usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3 comm=grep requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh//null-/usr/bin/grep file_mmap /usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3 comm=grep requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh//null-/usr/bin/grep open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=grep requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh//null-/usr/bin/grep file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=grep requested_mask=rm denied_mask=rm
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh//null-/usr/bin/grep open /proc/2688/maps comm=grep requested_mask=r denied_mask=r
ALLOWED run-parts//null-/etc/wpa_supplicant/ifupdown.sh//null-/usr/bin/grep open /proc/2711/maps comm=grep requested_mask=r denied_mask=r

ALLOWED nm-dispatcher dbus_method_call org.freedesktop.DBus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=ReleaseName peer_label=dbus-daemon
ALLOWED sshd open /etc/issue.net comm=sshd requested_mask=r denied_mask=r
ALLOWED run-parts//motd open /etc/lsb-release comm=00-header requested_mask=r denied_mask=r
ALLOWED run-parts//motd open /etc/lsb-release comm=91-release-upgr requested_mask=r denied_mask=r
ALLOWED run-parts//motd exec /usr/bin/cut comm=91-release-upgr requested_mask=x denied_mask=x
ALLOWED run-parts//motd//null-/usr/bin/cut file_inherit /dev/null comm=cut requested_mask=wr denied_mask=wr
ALLOWED run-parts//motd//null-/usr/bin/cut file_mmap /usr/bin/cut comm=cut requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/bin/cut file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=cut requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/bin/cut open /etc/ld.so.cache comm=cut requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/bin/cut open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=cut requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/bin/cut file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=cut requested_mask=rm denied_mask=rm
ALLOWED run-parts//motd exec /usr/bin/id comm=91-release-upgr requested_mask=x denied_mask=x
ALLOWED run-parts//motd//null-/usr/bin/id file_inherit /dev/null comm=id requested_mask=wr denied_mask=wr
ALLOWED run-parts//motd//null-/usr/bin/id file_mmap /usr/bin/id comm=id requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/bin/id file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=id requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/bin/id open /etc/ld.so.cache comm=id requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/bin/id open /usr/lib/x86_64-linux-gnu/libselinux.so.1 comm=id requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/bin/id file_mmap /usr/lib/x86_64-linux-gnu/libselinux.so.1 comm=id requested_mask=rm denied_mask=rm
ALLOWED run-parts//motd//null-/usr/bin/id open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=id requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/bin/id file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=id requested_mask=rm denied_mask=rm
ALLOWED run-parts//motd//null-/usr/bin/id open /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4 comm=id requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/bin/id file_mmap /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4 comm=id requested_mask=rm denied_mask=rm
ALLOWED run-parts//motd//null-/usr/bin/id open /proc/filesystems comm=id requested_mask=r denied_mask=r

ALLOWED run-parts//motd exec /usr/lib/ubuntu-release-upgrader/release-upgrade-motd comm=91-release-upgr requested_mask=x denied_mask=x
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd file_inherit /dev/null comm=release-upgrade requested_mask=wr denied_mask=wr
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd file_mmap /usr/bin/dash comm=release-upgrade requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=release-upgrade requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd open /etc/ld.so.cache comm=release-upgrade requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=release-upgrade requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=release-upgrade requested_mask=rm denied_mask=rm
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd open /usr/lib/ubuntu-release-upgrader/release-upgrade-motd comm=release-upgrade requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd exec /usr/bin/date comm=release-upgrade requested_mask=x denied_mask=x
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/date file_inherit /dev/null comm=date requested_mask=wr denied_mask=wr
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/date file_mmap /usr/bin/date comm=date requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/date file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=date requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/date open /etc/ld.so.cache comm=date requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/date open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=date requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/date file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=date requested_mask=rm denied_mask=rm
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/date open /usr/share/zoneinfo/Europe/Amsterdam comm=date requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd open /dev/null comm=release-upgrade requested_mask=wc denied_mask=wc
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd exec /usr/bin/stat comm=release-upgrade requested_mask=x denied_mask=x
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat file_inherit /dev/null comm=stat requested_mask=wr denied_mask=wr
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat file_inherit /dev/null comm=stat requested_mask=w denied_mask=w
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat file_mmap /usr/bin/stat comm=stat requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=stat requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat open /etc/ld.so.cache comm=stat requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat open /usr/lib/x86_64-linux-gnu/libselinux.so.1 comm=stat requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat file_mmap /usr/lib/x86_64-linux-gnu/libselinux.so.1 comm=stat requested_mask=rm denied_mask=rm
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=stat requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=stat requested_mask=rm denied_mask=rm
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat open /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4 comm=stat requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat file_mmap /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4 comm=stat requested_mask=rm denied_mask=rm
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/stat open /proc/filesystems comm=stat requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd exec /usr/bin/expr comm=release-upgrade requested_mask=x denied_mask=x
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/expr file_inherit /dev/null comm=expr requested_mask=wr denied_mask=wr
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/expr file_mmap /usr/bin/expr comm=expr requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/expr file_mmap /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 comm=expr requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/expr open /etc/ld.so.cache comm=expr requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/expr open /usr/lib/x86_64-linux-gnu/libgmp.so.10.4.1 comm=expr requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/expr file_mmap /usr/lib/x86_64-linux-gnu/libgmp.so.10.4.1 comm=expr requested_mask=rm denied_mask=rm
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/expr open /usr/lib/x86_64-linux-gnu/libc.so.6 comm=expr requested_mask=r denied_mask=r
ALLOWED run-parts//motd//null-/usr/lib/ubuntu-release-upgrader/release-upgrade-motd//null-/usr/bin/expr file_mmap /usr/lib/x86_64-linux-gnu/libc.so.6 comm=expr requested_mask=rm denied_mask=rm

ALLOWED sshd open /etc/security/limits.d/99_zero_core.conf comm=sshd requested_mask=r denied_mask=r

Manjaro install issue

pacman:

==> Extraction des sources…
-> Création d’une copie de travail du dépot apparmor.d-git git…
Clonage dans 'apparmor.d-git'...
fait.
==> Lancement de prepare()…
Set the configuration for manjarolinux.

Ignore profiles/files in dists/ignore/main.ignore
Ignore profiles/files in dists/ignore/manjarolinux.ignore
./configure: ligne 34: dists/ignore/manjarolinux.ignore: Aucun fichier ou dossier de ce type
Error: removing ignored profiles
==> ERREUR : Une erreur s’est produite dans prepare().
Abandon…

regard

Error message regarding @{exec_path}

I had installed the keepasscx-proxy profile (I'm using Arch btw.) with pick and it worked well. Now I installed the systemd-journald profile and tried to set it into complain mode but got the error:

ERROR: Profile for @{exec_path} exists in /etc/apparmor.d/systemd-journald and /etc/apparmor.d/keepassxc-proxy

Sure, @{exec_path} exists in both profiles (actually in all of your profiles) but that shouldn't cause a conflict. What am I missing?

EDIT: Restarting apparmor as mentioned in #6 didn't help.

Install/Update not working anymore

After updating the system pacman or yay giving errors on app update/install.

$ sudo pacman -S pdftk

looking for conflicting packages...

Packages (3) bcprov-1.72-1  java-commons-lang-3.12.0-1  pdftk-3.3.3-2

Total Installed Size:  10.09 MiB

:: Proceed with installation? [Y/n] y 
(3/3) checking keys in keyring                               [################################] 100%
(3/3) checking package integrity                             [################################] 100%
(3/3) loading package files                                  [################################] 100%
(3/3) checking for file conflicts                            [################################] 100%
(3/3) checking available disk space                          [################################] 100%
:: Running pre-transaction hooks...
(1/1) Performing snapper pre snapshots for the following configurations...
error: could not get current working directory
call to execv failed (Permission denied)
error: command failed to execute correctly
error: failed to commit transaction (failed to run transaction hooks)
Errors occurred, no packages were upgraded.

$ sudo aa-log pacman

ALLOWED pacman exec /usr/share/libalpm/scripts/snap-pac info="profile transition not found" comm=pacman requested_mask=x denied_mask=x error=-13

full output of aa-log is here

Unloading profiles using aa-teardown fixes the error

Hashless `include` is not supported on Debian

include is not supported on any Debian, not even bullseye. #include, however, is supported.
AFAIK, these were deprecated on Ubuntu (old one still works), but what about Arch? Maybe, #include should be used for better compatibility?

systemd-journald unconfined

I noticed that systemd-journald is unconfined in my Arch Linux system. The profile is in enforce mode here but it doesn't show up among the "processes are in enforce mode" in aa-status. And ps auxZ reports:

unconfined root 314 0.0 0.0 111156 10508 ? Ss 13:23 0:00 /usr/lib/systemd/systemd-journald

I added the following override.conf to /etc/systemd/system/systemd-journald:

[Service]
AppArmorProfile=/etc/apparmor.d/systemd-journald

but that didn't help after a reboot.

What am I missing?

EDIT: The same observation with systemd-udevd:
unconfined root 382 0.0 0.0 34412 11492 ? Ss 17:27 0:00 /usr/lib/systemd/systemd-udevd

while systemd-timesyncd and systemd-logind are confined.

Separate sudoedit profile required

Hi,

With the latest commit from 2 days ago, here are some issues I've encountered:

# Plymouth needs some fixes
ALLOWED plymouthd bind comm=plymouthd family=unix sock_type=stream protocol=0 requested_mask=bind denied_mask=bind addr=@/org/freedesktop/plymouthd
ALLOWED plymouthd listen comm=plymouthd family=unix sock_type=stream protocol=0 requested_mask=listen denied_mask=listen addr=@/org/freedesktop/plymouthd
ALLOWED plymouthd open /sys/devices/pci0000:00/0000:00:02.0/drm/renderD128/uevent comm=plymouthd requested_mask=r denied_mask=r
ALLOWED plymouthd open /sys/devices/pci0000:00/0000:00:02.0/drm/card0/uevent comm=plymouthd requested_mask=r denied_mask=r
ALLOWED plymouthd open /dev/dri/renderD128 comm=plymouthd requested_mask=wr denied_mask=wr
ALLOWED plymouthd open /dev/ptmx comm=plymouthd requested_mask=wr denied_mask=wr
ALLOWED plymouthd open /sys/devices/pci0000:00/0000:00:02.0/drm/renderD128/uevent comm=plymouthd requested_mask=r denied_mask=r
ALLOWED plymouthd open /run/udev/data/c226:128 comm=plymouthd requested_mask=r denied_mask=r
ALLOWED plymouthd open /sys/devices/pci0000:00/0000:00:02.0/drm/card0/uevent comm=plymouthd requested_mask=r denied_mask=r
ALLOWED plymouthd open /run/udev/data/c226:0 comm=plymouthd requested_mask=r denied_mask=r
ALLOWED plymouthd connect comm=plymouth family=unix sock_type=stream protocol=0 requested_mask="send receive accept" denied_mask="send receive accept" peer=plymouth peer_addr=@00080 addr=@/org/freedesktop/plymouthd
ALLOWED plymouthd file_perm comm=plymouth family=unix sock_type=stream protocol=0 requested_mask="send receive" denied_mask="send receive" peer=plymouth addr=@/org/freedesktop/plymouthd peer_addr=@00080
ALLOWED plymouthd open /dev/tty63 comm=plymouthd requested_mask=wr denied_mask=wr
ALLOWED plymouthd open /dev/dri/renderD128 comm=plymouthd requested_mask=wr denied_mask=wr
ALLOWED plymouthd file_perm comm=plymouthd family=unix sock_type=stream protocol=0 requested_mask="send receive" denied_mask="send receive" peer=plymouth addr=@/org/freedesktop/plymouthd peer_addr=@00080
ALLOWED plymouthd connect comm=systemd family=unix sock_type=stream protocol=0 requested_mask="send receive accept" denied_mask="send accept" peer=unconfined addr=@/org/freedesktop/plymouthd peer_addr=none
ALLOWED plymouthd file_perm comm=plymouthd family=unix sock_type=stream protocol=0 requested_mask="send receive" denied_mask=send peer=unconfined addr=@/org/freedesktop/plymouthd peer_addr=none
ALLOWED plymouthd open /sys/devices/pci0000:00/0000:00:02.0/drm/renderD128/uevent comm=plymouthd requested_mask=r denied_mask=r
ALLOWED plymouthd open /sys/devices/pci0000:00/0000:00:02.0/drm/card0/uevent comm=plymouthd requested_mask=r denied_mask=r
ALLOWED plymouthd open /dev/dri/renderD128 comm=plymouthd requested_mask=wr denied_mask=wr

# Containerd
ALLOWED containerd sendmsg /run/systemd/notify comm=containerd requested_mask=w denied_mask=w
ALLOWED containerd file_perm /run/systemd/notify comm=containerd requested_mask=w denied_mask=w

# sudo
ALLOWED sudo signal comm=sudo requested_mask=send denied_mask=send signal=term peer=unconfined
ALLOWED sudo signal comm=sudo requested_mask=send denied_mask=send signal=hup peer=unconfined
ALLOWED sudo signal comm=sudo requested_mask=send denied_mask=send signal=winch peer=unconfined

# sudoedit needs access to everything, maybe make a separate unconfined profile for sudoedit?
ALLOWED sudo open /var/tmp/ comm=sudoedit requested_mask=r denied_mask=r
ALLOWED sudo open /etc/default/grub comm=sudoedit requested_mask=r denied_mask=r
ALLOWED sudo mknod /var/tmp/grub.XXGpPHMa comm=sudoedit requested_mask=c denied_mask=c
ALLOWED sudo open /var/tmp/grub.XXGpPHMa comm=sudoedit requested_mask=wrc denied_mask=wrc
ALLOWED sudo capable comm=sudoedit capability=3 capname=fowner
ALLOWED sudo open /var/tmp/grub.XXGpPHMa comm=sudoedit requested_mask=r denied_mask=r
ALLOWED sudo open /etc/default/grub comm=sudoedit requested_mask=wc denied_mask=wc
ALLOWED sudo truncate /etc/default/grub comm=sudoedit requested_mask=w denied_mask=w
ALLOWED sudo unlink /var/tmp/grub.XXGpPHMa comm=sudoedit requested_mask=d denied_mask=d

# ModemManager
ALLOWED ModemManager dbus_signal :1.9 receive bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=SessionRemoved peer_label=systemd-logind
ALLOWED systemd-logind dbus_method_call org.freedesktop.systemd1 send bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=StopUnit peer_label=unconfined
ALLOWED NetworkManager dbus_signal :1.9 receive bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=UserRemoved peer_label=systemd-logind
ALLOWED ModemManager dbus_signal :1.9 receive bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=UserRemoved peer_label=systemd-logind

ALLOWED ip capable comm=ip capability=21 capname=sys_admin

ALLOWED do-release-upgrade file_inherit /var/lib/ubuntu-release-upgrader/release-upgrade-available comm=check-new-relea requested_mask=w denied_mask=w
ALLOWED do-release-upgrade mknod /var/cache/apt/pkgcache.bin.wgM8zT comm=check-new-relea requested_mask=c denied_mask=c
ALLOWED do-release-upgrade open /var/cache/apt/pkgcache.bin.wgM8zT comm=check-new-relea requested_mask=wrc denied_mask=wrc
ALLOWED do-release-upgrade chmod /var/cache/apt/pkgcache.bin.wgM8zT comm=check-new-relea requested_mask=w denied_mask=w
ALLOWED do-release-upgrade rename_src /var/cache/apt/pkgcache.bin.wgM8zT comm=check-new-relea requested_mask=wrd denied_mask=wrd
ALLOWED do-release-upgrade rename_dest /var/cache/apt/pkgcache.bin comm=check-new-relea requested_mask=wc denied_mask=wc
DENIED  lsb_release open /etc/nsswitch.conf comm=lsb_release requested_mask=r denied_mask=r
DENIED  lsb_release open /etc/passwd comm=lsb_release requested_mask=r denied_mask=r
ALLOWED do-release-upgrade create comm=check-new-relea family=inet sock_type=dgram protocol=0 requested_mask=create denied_mask=create
ALLOWED do-release-upgrade setsockopt comm=check-new-relea family=inet sock_type=dgram protocol=17 requested_mask=setopt denied_mask=setopt
ALLOWED do-release-upgrade connect comm=check-new-relea family=inet sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade sendmsg comm=check-new-relea laddr=127.0.0.1 lport=48516 faddr=127.0.0.53 fport=53 family=inet sock_type=dgram protocol=17 requested_mask=send denied_mask=send
ALLOWED do-release-upgrade recvmsg comm=check-new-relea laddr=127.0.0.1 lport=48516 faddr=127.0.0.53 fport=53 family=inet sock_type=dgram protocol=17 requested_mask=receive denied_mask=receive
ALLOWED do-release-upgrade create comm=check-new-relea family=netlink sock_type=raw protocol=0 requested_mask=create denied_mask=create
ALLOWED do-release-upgrade bind comm=check-new-relea family=netlink sock_type=raw protocol=0 requested_mask=bind denied_mask=bind
ALLOWED do-release-upgrade getsockname comm=check-new-relea family=netlink sock_type=raw protocol=0 requested_mask=getattr denied_mask=getattr
ALLOWED do-release-upgrade sendmsg comm=check-new-relea family=netlink sock_type=raw protocol=0 requested_mask=send denied_mask=send
ALLOWED do-release-upgrade recvmsg comm=check-new-relea family=netlink sock_type=raw protocol=0 requested_mask=receive denied_mask=receive
ALLOWED do-release-upgrade create comm=check-new-relea family=inet6 sock_type=dgram protocol=0 requested_mask=create denied_mask=create
ALLOWED do-release-upgrade connect comm=check-new-relea family=inet6 sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade getsockname comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=57046 faddr=2620:2d:4000:1::2a fport=443 family=inet6 sock_type=dgram protocol=17 requested_mask=getattr denied_mask=getattr
ALLOWED do-release-upgrade connect comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=57046 faddr=2620:2d:4000:1::2a fport=443 family=inet6 sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade connect comm=check-new-relea faddr=2620:2d:4000:1::2a family=inet6 sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade getsockname comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=37575 faddr=2620:2d:4000:1::2b fport=443 family=inet6 sock_type=dgram protocol=17 requested_mask=getattr denied_mask=getattr
ALLOWED do-release-upgrade connect comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=37575 faddr=2620:2d:4000:1::2b fport=443 family=inet6 sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade connect comm=check-new-relea faddr=2620:2d:4000:1::2b family=inet6 sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade getsockname comm=check-new-relea laddr=::ffff:192.168.178.26 lport=49837 faddr=::ffff:91.189.91.48 fport=443 family=inet6 sock_type=dgram protocol=17 requested_mask=getattr denied_mask=getattr
ALLOWED do-release-upgrade connect comm=check-new-relea laddr=::ffff:192.168.178.26 lport=49837 faddr=::ffff:91.189.91.48 fport=443 family=inet6 sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade connect comm=check-new-relea faddr=::ffff:91.189.91.48 family=inet6 sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade getsockname comm=check-new-relea laddr=::ffff:192.168.178.26 lport=38885 faddr=::ffff:91.189.91.49 fport=443 family=inet6 sock_type=dgram protocol=17 requested_mask=getattr denied_mask=getattr
ALLOWED do-release-upgrade connect comm=check-new-relea laddr=::ffff:192.168.178.26 lport=38885 faddr=::ffff:91.189.91.49 fport=443 family=inet6 sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade connect comm=check-new-relea faddr=::ffff:91.189.91.49 family=inet6 sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade getsockname comm=check-new-relea laddr=::ffff:192.168.178.26 lport=56534 faddr=::ffff:185.125.190.17 fport=443 family=inet6 sock_type=dgram protocol=17 requested_mask=getattr denied_mask=getattr
ALLOWED do-release-upgrade connect comm=check-new-relea laddr=::ffff:192.168.178.26 lport=56534 faddr=::ffff:185.125.190.17 fport=443 family=inet6 sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade connect comm=check-new-relea faddr=::ffff:185.125.190.17 family=inet6 sock_type=dgram protocol=17 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade getsockname comm=check-new-relea laddr=::ffff:192.168.178.26 lport=36898 faddr=::ffff:185.125.190.18 fport=443 family=inet6 sock_type=dgram protocol=17 requested_mask=getattr denied_mask=getattr
ALLOWED do-release-upgrade create comm=check-new-relea family=inet6 sock_type=stream protocol=6 requested_mask=create denied_mask=create
ALLOWED do-release-upgrade connect comm=check-new-relea family=inet6 sock_type=stream protocol=6 requested_mask=connect denied_mask=connect
ALLOWED do-release-upgrade getsockopt comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=34704 faddr=2620:2d:4000:1::2a fport=443 family=inet6 sock_type=stream protocol=6 requested_mask=getopt denied_mask=getopt
ALLOWED do-release-upgrade setsockopt comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=34704 faddr=2620:2d:4000:1::2a fport=443 family=inet6 sock_type=stream protocol=6 requested_mask=setopt denied_mask=setopt
ALLOWED do-release-upgrade getsockname comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=34704 faddr=2620:2d:4000:1::2a fport=443 family=inet6 sock_type=stream protocol=6 requested_mask=getattr denied_mask=getattr
ALLOWED do-release-upgrade getpeername comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=34704 faddr=2620:2d:4000:1::2a fport=443 family=inet6 sock_type=stream protocol=6 requested_mask=getattr denied_mask=getattr
ALLOWED do-release-upgrade capable comm=check-new-relea capability=12 capname=net_admin
ALLOWED do-release-upgrade file_perm comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=34704 faddr=2620:2d:4000:1::2a fport=443 family=inet6 sock_type=stream protocol=6 requested_mask=send denied_mask=send
ALLOWED do-release-upgrade sendmsg comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=34704 faddr=2620:2d:4000:1::2a fport=443 family=inet6 sock_type=stream protocol=6 requested_mask=send denied_mask=send
ALLOWED do-release-upgrade file_perm comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=34704 faddr=2620:2d:4000:1::2a fport=443 family=inet6 sock_type=stream protocol=6 requested_mask=receive denied_mask=receive
ALLOWED do-release-upgrade recvmsg comm=check-new-relea laddr=2a02:a464:15e9:1:a196:2dbc:942b:7b9f lport=34704 faddr=2620:2d:4000:1::2a fport=443 family=inet6 sock_type=stream protocol=6 requested_mask=receive denied_mask=receive

ALLOWED systemd-machine-id-setup file_inherit /dev/pts/2 comm=systemd-machine requested_mask=wr denied_mask=wr

All processes require `owner /dev/tty[0-9]* rw,` when invoked from local console (Ctrl+Alt+F#)

Possible solutions:

Do nothing. This cripples troubleshooting in case of DE issues.
Add a line to consoles abstraction, since all such processes also require it. (consoles does not have local include)
Add this line to every console-related profile.

pick should install profiles for called helper applications as well

The instructions for "Partial install" says that pick "will also install required abstractions and tunables". It does that, indeed, but it does not install profiles for helper applications called from the main application.

Example: I installed the profile for zram-generatorwhich contains the following lines:

/{usr/,}bin/systemd-detect-virt     rPx,
/{usr/,}lib/systemd/systemd-makefs  rPx,

and the latter one is calling:

/{usr/,}{s,}bin/mkswap     rPx,
/{usr/,}bin/mkfs.*         rPx,

Unfortunately, those profiles were not installed by pick. I think that's a bug as those missing profiles will probably lead to errors.

Can't install on ArchLinux

Packages (1) apparmor.d-0.390-1

Total Installed Size:  2.71 MiB

:: Proceed with installation? [Y/n] 
(1/1) checking keys in keyring                       [----------------------------] 100%
(1/1) checking package integrity                     [----------------------------] 100%
(1/1) loading package files                          [----------------------------] 100%
(1/1) checking for file conflicts                    [----------------------------] 100%
error: failed to commit transaction (conflicting files)
apparmor.d: /etc/apparmor.d/tunables/global exists in filesystem (owned by apparmor)
apparmor.d: /etc/apparmor.d/tunables/xdg-user-dirs exists in filesystem (owned by apparmor)
Errors occurred, no packages were upgraded.
==> WARNING: Failed to install built package(s).
==> Cleaning up...

This conflicts with already existing files from the apparmor package.

aa-log

Is it possible to use aa-log to generate a complete profile?
The official aa-genprof is asking too many questions.

aa-log -genprof firefox > firefox.profile

The profile can then be optimized later with a text editor.

Incompatibility with large number of disks

https://github.com/torvalds/linux/blob/master/Documentation/admin-guide/devices.txt

...
 135 block       SCSI disk devices (240-255)
		   0 = /dev/sdig         241st SCSI disk whole disk
		  16 = /dev/sdih         242nd SCSI disk whole disk
		  32 = /dev/sdih         243rd SCSI disk whole disk
		    ...
		 240 = /dev/sdiv         256th SCSI disk whole disk

Nautilus trash showing error

After applying Apparmor profiles nautilus trash showed "This location couldn't be displayed."
Trashing files and folders are working fine but I can't access them through Trash tab.
I'm on Arch, installed profiles by following this repo's guide.

How `lightdm` spawns sessions?

Before the login:

xubuntu2204# pstree -Zl
systemd(`unconfined')
 ├─lightdm(`lightdm (enforce)')
 │  ├─Xorg(`xorg (enforce)')
 │  │  └─{Xorg}(`xorg (enforce)')
 │  ├─lightdm(`lightdm (enforce)')
 │  │  ├─lightdm-greeter(`unconfined')
 │  │  │  └─lightdm-gtk-gre(`lightdm-gtk-greeter (enforce)')
 │  │  │     └─2*[{lightdm-gtk-gre}(`lightdm-gtk-greeter (enforce)')]
 │  │  └─2*[{lightdm}(`lightdm (enforce)')]
 │  ├─lightdm(`lightdm (enforce)')
 │  │  └─2*[{lightdm}(`lightdm (enforce)')]
 │  └─2*[{lightdm}(`lightdm (enforce)')]

debian11# pstree -Zl
systemd(`unconfined')
 |-lightdm(`lightdm (enforce)')
 |  |-Xorg(`xorg (enforce)')
 |  |  `-9*[{Xorg}(`xorg (enforce)')]
 |  |-lightdm(`lightdm (enforce)')
 |  |  |-lightdm-gtk-gre(`lightdm-gtk-greeter (enforce)')
 |  |  |  `-13*[{lightdm-gtk-gre}(`lightdm-gtk-greeter (enforce)')]
 |  |  `-2*[{lightdm}(`lightdm (enforce)')]
 |  |-lightdm(`lightdm (enforce)')
 |  `-2*[{lightdm}(`lightdm (enforce)')]

After the login:

xubuntu2204# pstree -Zl
systemd(`unconfined')
 ├─lightdm(`lightdm (enforce)')
 │  ├─Xorg(`xorg (enforce)')
 │  │  └─{Xorg}(`xorg (enforce)')
 │  ├─lightdm(`lightdm (enforce)')
 │  │  ├─xfce4-session(`unconfined')

debian11# pstree -Zl
systemd(`unconfined')
 |-lightdm(`lightdm (enforce)')
 |  |-Xorg(`xorg (enforce)')
 |  |  `-9*[{Xorg}(`xorg (enforce)')]
 |  |-lightdm(`lightdm (enforce)')
 |  |  |-xfce4-session(`unconfined')

Any thoughts on how xfce4-session becomes unconfined?

Every process on Armbian require `@{exec_path} mr,` in order to run

This is not an issue on DietPi however. Maybe it's related to some debugging compilation?
I don't know how m affects the security. What will be the course of action?

Common DBus rules on Ubuntu?

Following DBus rules are required by many apps:

  dbus send
    bus=session
    path=/org/gtk/vfs/mounttracker
    interface=org.gtk.vfs.MountTracker
    member=ListMountableInfo,

  dbus send
    bus=session
    path=/org/gtk/vfs/Daemon
    interface=org.gtk.vfs.Daemon
    member=ListMonitorImplementations,

  dbus send
    bus=system
    path=/org/freedesktop/UPower
    interface=org.freedesktop.UPower
    member=EnumerateDevices
    peer=(name=org.freedesktop.UPower),

I notice ListMountableInfo requirement on almost every desktop application (Gnome), following by ListMonitorImplementations. Additionally, there is org.freedesktop.UPower, but it's not very common. I see this only on Ubuntu and derivatives. This happens outside of file chooser dialog.
What do we do? Deny? Move into separate abstraction? Or include into ubuntu-unity7-base.d drop-in?

dconf policy?

What do we do with dconf?
Allow write when requested? Allow read? Deny and silence?

KeepassXC crashing in Enforce Mode

KeepassXC crashing every time when I open the database
AppArmor is updated and set to the Enforce Mode

$ sudo aa-log keepassxc

DENIED  keepassxc file_inherit /home/mystik/.local/share/gvfs-metadata/root-9c234de1.log comm=keepassxc requested_mask=r denied_mask=r
DENIED  keepassxc open /dev/tty comm=keepassxc requested_mask=r denied_mask=r
DENIED  keepassxc open /usr/share/glib-2.0/schemas/gschemas.compiled comm=keepassxc requested_mask=r denied_mask=r
DENIED  keepassxc open /usr/share/qt/translations/qtbase_en.qm comm=keepassxc requested_mask=r denied_mask=r
DENIED  keepassxc open /usr/bin/ comm=keepassxc requested_mask=r denied_mask=r
DENIED  keepassxc mkdir /run/user/1000/app/org.keepassxc.KeePassXC/ comm=keepassxc requested_mask=c denied_mask=c

aa-log output

allow backlight:amdgpu

ALLOWED systemd-logind open /run/udev/data/+backlight:amdgpu_bl0 comm=systemd-logind requested_mask=r denied_mask=r

I can pull request, but am not sure if bl0 part should be wildcarded or leaved as it is.

tor

There was abstractions/tor which I used to create my profile. It was deleted from this project. What are plans for Tor?

KDE support

I'm working on some profiles as a starting point to support KDE. Before continuing this work and submitting PRs I would like to coordinate with you how to precede. This is what I'm planning:

Creation of a new kde group.
Creation of a new akonadi abstraction which makes things a lot easier:

# vim:syntax=apparmor

  abi <abi/3.0>,

  include <abstractions/kde>
  include <abstractions/kde-icon-cache-write>
  include <abstractions/mesa>
  include <abstractions/vulkan>
  
  /dev/tty r,
  @{etc_ro}/machine-id r,
  @{etc_ro}/nsswitch.conf r,
  @{etc_ro}/passwd r,
  @{PROC}/sys/dev/i915/perf_stream_paranoid r,
  @{PROC}/sys/kernel/core_pattern r,
  @{sys}/devices/pci[0-9]*/**/{device,revision,subsystem_device,subsystem_vendor,uevent,vendor} r,
  @{system_share_dirs}/qt/translations/{qt,qtbase,qtmultimedia,qtscript,qtxmlpatterns}_*.qm r,
  @{system_share_dirs}/icons/breeze/index.theme r,
  @{system_share_dirs}/mime/generic-icons r,
  
  owner @{HOME}/.config/kdedefaults/kdeglobals r,
  owner @{HOME}/.config/kdedefaults/kwinrc r,
  owner @{HOME}/.config/kdeglobals r,
  owner @{HOME}/.config/kwinrc r,
  owner @{HOME}/.config/akonadi/akonadiconnectionrc r,

  # Include additions to the abstraction
  include if exists <abstractions/akonadi.d>

I'm aware that some rules are already in other abstractions but adding those would make the profiles too permissive, IMO.

The profiles I'm working on are the following:

akonadi_control, akonadiserver, various akonadi_*_resource and akonadi_*_agent profiles, kioslave5, ksysguardd, mariadbd, mariadbd_akonadi, startplasma_wayland

Would creating the suggested group and abstraction be okay for you?

Sidenote: I've also created a new sddm profile which works on my Arch KDE system. The available profile broke my system even in complain mode - that's why I'm still only installing specific profiles. I still have to synchronize both versions. I've also created a sddm-helper profile btw.

Long delay in starting gtk applications

Nothing appears in aa-log unfortunately, however we can see some errors when starting a gtk application

Firefox errors:

[1336000, Main Thread] WARNING: Error creating proxy: Error calling StartServiceByName for org.gtk.vfs.Daemon: Timeout was reached (g-io-error-quark, 24)
: 'glib warning', file /build/firefox/src/firefox-105.0.1/toolkit/xre/nsSigHandlers.cpp:167

(firefox:1336000): GVFS-WARNING **: 22:34:42.204: Error creating proxy: Error calling StartServiceByName for org.gtk.vfs.Daemon: Timeout was reached (g-io-error-quark, 24)

Pcmanfm:

(pcmanfm:1485805): GVFS-WARNING **: 22:51:15.444: Error creating proxy: Error calling StartServiceByName for org.gtk.vfs.Daemon: Timeout was reached (g-io-error-quark, 24)

Emacs (regular toolkit, not pgtk):

(emacs:1506491): GVFS-WARNING **: 22:53:45.774: Error creating proxy: Error calling StartServiceByName for org.gtk.vfs.Daemon: Timeout was reached (g-io-error-quark, 24)

(emacs:1494791): dbind-WARNING **: 22:52:45.724: AT-SPI: Error retrieving accessibility bus address: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.

I'm not positive these are due to the apparmor profiles, however these delays don't occur without them enabled

System info (arch):

core/linux 5.19.12.arch1-1 [installed]
aur/apparmor.d-git 0.794-1 (+3 2.28) (Installed: 0.814-1)
extra/apparmor 3.1.1-1 (1.1 MiB 3.9 MiB) (Installed)
core/dbus 1.14.2-1 [installed]
extra/gvfs 1.50.2-1 (gnome) [installed]

Thank you for this excellent library! Please let me know if there's any additional information I can provide

aa-log mistakes `peer=(name=...)` for `name=...`

 lightdm dbus_method_call org.freedesktop.Accounts send bus=system path=/org/freedesktop/Accounts/User1000 interface=org.freedesktop.DBus.Properties member=GetAll type=1107 peer_label=accounts-daemon auid=4294967295 ses=4294967295 subj=? uid=102 msg='apparmor
 lightdm dbus_signal :1.6 receive bus=system path=/org/freedesktop/Accounts/User1000 interface=org.freedesktop.Accounts.User member=Changed subj=? type=1107 uid=102 auid=4294967295 msg='apparmor peer_label=accounts-daemon ses=4294967295

Sep  6 11:23:47 xubuntu-lts kernel: [   31.024982] audit: type=1107 audit(1662459827.500:1420): pid=1567 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/Accounts/User1000" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.Accounts" pid=1693 label="lightdm" peer_pid=1559 peer_label="accounts-daemon"
Sep  6 11:26:12 xubuntu-lts kernel: [  175.272924] audit: type=1107 audit(1662459972.826:4277): pid=1567 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_signal"  bus="system" path="/org/freedesktop/Accounts/User1000" interface="org.freedesktop.Accounts.User" member="Changed" name=":1.6" mask="receive" pid=1693 label="lightdm" peer_pid=1559 peer_label="accounts-daemon"

Known Bugs

A meta issue to list and present the current set of known issues.

Current

systemd-udevd: is not configured to load early, as it breaks the system on some hardware. See b3a28da and #60
Some profiles will need a future version of AppArmor to really work as designed. For example:
- AppArmor supports change profile from pivot_root is required in most profile that launch a sandbox.
- AppArmor supports for {*^} regex is needed in steam.

Fixed

Gnome can be very slow to start. See #80, #235
aa-logprof (but also aa-enforce, aa-complain) do not work (yet) with this project. See #76, #87 and the upstream issue: https://gitlab.com/apparmor/apparmor/-/issues/90

error: could not get current working directory

There is error while updating the package:

:: Processing package changes...
error: could not get current working directory

Is it ok?

OS: arch linux
Aur manager: paru

systemd-udevd running unconfined after fresh boot

Hi,

Like the title, the apparmor profile is not applied during boot. If I restart the service, the apparmor profile is applied:

jeroen@jeroen-VirtualBox:~$ ps auxZ | grep udev
unconfined                      root        1111  0.2  0.1  26084  5012 ?        Ss   11:03   0:00 /lib/systemd/systemd-udevd
unconfined                      jeroen     10182  0.0  0.0  17868  1512 pts/0    S+   11:05   0:00 grep --color=auto udev
jeroen@jeroen-VirtualBox:~$ sudo systemctl restart systemd-udevd
[sudo] password for jeroen: 
jeroen@jeroen-VirtualBox:~$ ps auxZ | grep udev
systemd-udevd (complain)        root       10382  2.5  0.1  25348  5104 ?        Ss   11:06   0:00 /lib/systemd/systemd-udevd
unconfined                      jeroen     10384  0.0  0.0  17868  1480 pts/0    S+   11:06   0:00 grep --color=auto udev
jeroen@jeroen-VirtualBox:~$

Maybe we need to update the AppArmor service to load before systemd-udevd is loaded?

`@{run}/systemd/sessions/` could be alphanumeric

apparmor="ALLOWED" operation="open" profile="systemd-logind" name="/run/systemd/sessions/c1.ref" pid=530 comm="systemd-logind" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
apparmor="ALLOWED" operation="open" profile="systemd-logind" name="/run/systemd/sessions/c1.ref" pid=530 comm="systemd-logind" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
apparmor="ALLOWED" operation="rename_dest" profile="systemd-logind" name="/run/systemd/sessions/c1" pid=530 comm="systemd-logind" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
apparmor="DENIED" operation="file_receive" profile="dbus-daemon" name="/run/systemd/sessions/c1.ref" pid=525 comm="dbus-daemon" requested_mask="w" denied_mask="w" fsuid=104 ouid=0
apparmor="ALLOWED" operation="open" profile="systemd-logind" name="/run/systemd/sessions/c1" pid=572 comm="systemd-logind" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
apparmor="ALLOWED" operation="rename_dest" profile="systemd-logind" name="/run/systemd/sessions/c1" pid=531 comm="systemd-logind" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
apparmor="ALLOWED" operation="mknod" profile="systemd-logind" name="/run/systemd/sessions/c1.ref" pid=531 comm="systemd-logind" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
apparmor="ALLOWED" operation="open" profile="systemd-logind" name="/run/systemd/sessions/c1.ref" pid=531 comm="systemd-logind" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
apparmor="ALLOWED" operation="open" profile="systemd-logind" name="/run/systemd/sessions/c1.ref" pid=531 comm="systemd-logind" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
apparmor="ALLOWED" operation="rename_dest" profile="systemd-logind" name="/run/systemd/sessions/c1" pid=531 comm="systemd-logind" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
apparmor="DENIED" operation="file_receive" profile="dbus-daemon" name="/run/systemd/sessions/c1.ref" pid=526 comm="dbus-daemon" requested_mask="w" denied_mask="w" fsuid=104 ouid=0
apparmor="ALLOWED" operation="rename_dest" profile="systemd-logind" name="/run/systemd/sessions/c1" pid=531 comm="systemd-logind" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
apparmor="ALLOWED" operation="open" profile="systemd-logind" name="/run/systemd/sessions/c1" pid=572 comm="systemd-logind" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
apparmor="DENIED" operation="file_receive" info="Failed name lookup - disconnected path" error=-13 profile="su" name="run/systemd/sessions/c1.ref" pid=555 comm="su" requested_mask="w" denied_mask="w" fsuid=0 ouid=0

another-system$ ll /run/systemd/sessions/
total 8
drwxr-xr-x  2 root root 120 may 23 22:15 ./
drwxr-xr-x 23 root root 540 may 23 18:56 ../
-rw-r--r--  1 root root 327 may 23 22:15 9
prw-------  1 root root   0 may 23 22:15 9.ref|
-rw-r--r--  1 root root 317 may 23 22:15 c2
prw-------  1 root root   0 may 23 18:54 c2.ref|

Allow by wildcard in all related profiles?
Allow only in mentioned profiles?
Allow only c[0-9]*?

allow read $HOME/.terminfo

I think common programs that are expected to be run by user should be allowed to:

owner @{HOME}/.terminfo/[0-9]*/* r,

That's already a case for example for:

apparmor.d/apparmor.d/groups/children/child-pager

Line 35 in 1f16025

owner @{HOME}/.terminfo/[0-9]*/* r,

but not for git:

❯ aa-log git
ALLOWED git open /home/vbauer/.terminfo/74/tmux-256color comm=sh requested_mask=r denied_mask=r

What about mentioning `Tested on` systems in profile's header?

We might not commit to whole support in README, but at least mention where this single profile have been tested.
e.g.
# Tested on: Arch Linux, Debian 11, Ubuntu 20.04, Armbian Bullseye

exec_path marco collision at top level

debian11# wget https://raw.githubusercontent.com/roddhjav/apparmor.d/master/apparmor.d/profiles-s-z/uname -O /etc/apparmor.d/uname
# wget https://raw.githubusercontent.com/roddhjav/apparmor.d/master/apparmor.d/profiles-g-l/id -O /etc/apparmor.d/id
# vi id uname      # edit the includes to working ones
# aa-enforce id

ERROR: Profile for @{exec_path} exists in /etc/apparmor.d/id and /etc/apparmor.d/uname
# aa-enforce uname

ERROR: Profile for @{exec_path} exists in /etc/apparmor.d/id and /etc/apparmor.d/uname

Processes are not confined at this point. On reboot, however, they appear to be confined. There are no overlapping of rules observed so far.

evince needs SSL

type=AVC msg=audit(1642886179.352:857): apparmor="DENIED" operation="open" profile="evince" name="/etc/ssl/openssl.cnf" pid=62266 comm="evince" requested_mask="r" denied_mask="r" fsuid=1001 ouid=0�FSUID="user" OUID="root"

I added

include <abstractions/openssl>

xauth: timeout in locking authority file /Xauthority

First I want to apologize, I am just a hobby nerd without IT background who just likes to experiment. And I'm sorry if this is the wrong place to go to for this..

I did a basic arch install with LUKS/lvm in a VM, disabled VT switch/zap, disabled root

sed -i "s|root:/bin/bash|root:/usr/sbin/nologin|" /etc/passwd
passwd -l root

Enabled rootless X needs_root_rights = no
I use xinit and the system runs without problems like that.

Now Apparmor install, service start, kernel params: apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf
Reboot.
Apparmor works.

Now apparmor.d-git install: Go is there, rsync too

cd .cache/yay
git clone https://aur.archlinux.org/apparmor.d-git.git
cd apparmor.d-git
makepkg -s
sudo pacman -U apparmor.d-*.pkg.tar.zst \
  --overwrite etc/apparmor.d/tunables/global \
  --overwrite etc/apparmor.d/tunables/xdg-user-dirs \
  --overwrite etc/apparmor.d/abstractions/trash

Reboot.
Xorg doesn't start anymore.

screenshot

.local/share/xorg/Xorg.0.log:

[   126.729] 
X.Org X Server 1.21.1.6
X Protocol Version 11, Revision 0
[   126.729] Current Operating System: Linux machine 5.15.87-1-lts #1 SMP Thu, 12 Jan 2023 15:51:39 +0000 x86_64
[   126.729] Kernel command line: initrd=\intel-ucode.img initrd=\initramfs-linux-lts.img cryptdevice=UUID="cf6cc1ad-47a5-4702-a514-2d3e321fa8c2":vg0 root=/dev/mapper/vg0-root rw quiet nowatchdog apparmor=1 lsm=lockdown,yama,integrity,apparmor,bpf
[   126.729]  
[   126.729] Current version of pixman: 0.42.2
[   126.729] 	Before reporting problems, check http://wiki.x.org
	to make sure that you have the latest version.
[   126.729] Markers: (--) probed, (**) from config file, (==) default setting,
	(++) from command line, (!!) notice, (II) informational,
	(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
[   126.729] (==) Log file: "/home/me/.local/share/xorg/Xorg.0.log", Time: Tue Jan 17 14:03:40 2023
[   126.734] (==) Using config directory: "/etc/X11/xorg.conf.d"
[   126.734] (==) Using system config directory "/usr/share/X11/xorg.conf.d"
[   126.736] (==) No Layout section.  Using the first Screen section.
[   126.736] (==) No screen section available. Using defaults.
[   126.736] (**) |-->Screen "Default Screen Section" (0)
[   126.736] (**) |   |-->Monitor "<default monitor>"
[   126.737] (==) No monitor specified for screen "Default Screen Section".
	Using a default monitor configuration.
[   126.737] (**) Option "DontVTSwitch" "True"
[   126.737] (**) Option "DontZap" "True"
[   126.737] (==) Automatically adding devices
[   126.737] (==) Automatically enabling devices
[   126.737] (==) Automatically adding GPU devices
[   126.737] (==) Automatically binding GPU devices
[   126.737] (==) Max clients allowed: 256, resource mask: 0x1fffff
[   126.738] (WW) The directory "/usr/share/fonts/misc" does not exist.
[   126.738] 	Entry deleted from font path.
[   126.738] (WW) The directory "/usr/share/fonts/TTF" does not exist.
[   126.738] 	Entry deleted from font path.
[   126.738] (WW) The directory "/usr/share/fonts/OTF" does not exist.
[   126.738] 	Entry deleted from font path.
[   126.738] (WW) The directory "/usr/share/fonts/Type1" does not exist.
[   126.738] 	Entry deleted from font path.
[   126.738] (WW) The directory "/usr/share/fonts/100dpi" does not exist.
[   126.738] 	Entry deleted from font path.
[   126.738] (WW) The directory "/usr/share/fonts/75dpi" does not exist.
[   126.738] 	Entry deleted from font path.
[   126.738] (==) FontPath set to:
	
[   126.738] (==) ModulePath set to "/usr/lib/xorg/modules"
[   126.738] (II) The server relies on udev to provide the list of input devices.
	If no devices become available, reconfigure udev or disable AutoAddDevices.
[   126.738] (II) Module ABI versions:
[   126.738] 	X.Org ANSI C Emulation: 0.4
[   126.738] 	X.Org Video Driver: 25.2
[   126.738] 	X.Org XInput driver : 24.4
[   126.738] 	X.Org Server Extension : 10.0
[   126.739] (++) using VT number 1

[   126.740] (II) systemd-logind: took control of session /org/freedesktop/login1/session/_31
[   126.741] (II) xfree86: Adding drm device (/dev/dri/card0)
[   126.741] (II) Platform probe for /sys/devices/pci0000:00/0000:00:02.0/drm/card0
[   126.742] (EE) systemd-logind: failed to take device /dev/dri/card0: Connection was disconnected before a reply was received
[   126.747] (--) PCI:*(0@0:2:0) 15ad:0405:15ad:0405 rev 0, Mem @ 0xe0000000/134217728, 0xe8400000/2097152, I/O @ 0x0000c170/16, BIOS @ 0x????????/131072
[   126.747] (WW) Open ACPI failed (/var/run/acpid.socket) (No such file or directory)
[   126.747] (II) LoadModule: "glx"
[   126.750] (II) Loading /usr/lib/xorg/modules/extensions/libglx.so
[   126.764] (II) Module glx: vendor="X.Org Foundation"
[   126.764] 	compiled for 1.21.1.6, module version = 1.0.0
[   126.764] 	ABI class: X.Org Server Extension, version 10.0
[   126.764] (==) Matched vmware as autoconfigured driver 0
[   126.764] (==) Matched modesetting as autoconfigured driver 1
[   126.764] (==) Matched fbdev as autoconfigured driver 2
[   126.764] (==) Matched vesa as autoconfigured driver 3
[   126.765] (==) Assigned the driver to the xf86ConfigLayout
[   126.765] (II) LoadModule: "vmware"
[   126.765] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
[   127.055] (II) Module vmware: vendor="X.Org Foundation"
[   127.055] 	compiled for 1.21.1.4, module version = 13.3.0
[   127.055] 	Module class: X.Org Video Driver
[   127.055] 	ABI class: X.Org Video Driver, version 25.2
[   127.055] (II) LoadModule: "modesetting"
[   127.055] (II) Loading /usr/lib/xorg/modules/drivers/modesetting_drv.so
[   127.060] (II) Module modesetting: vendor="X.Org Foundation"
[   127.060] 	compiled for 1.21.1.6, module version = 1.21.1
[   127.060] 	Module class: X.Org Video Driver
[   127.060] 	ABI class: X.Org Video Driver, version 25.2
[   127.060] (II) LoadModule: "fbdev"
[   127.060] (WW) Warning, couldn't open module fbdev
[   127.060] (EE) Failed to load module "fbdev" (module does not exist, 0)
[   127.060] (II) LoadModule: "vesa"
[   127.061] (WW) Warning, couldn't open module vesa
[   127.061] (EE) Failed to load module "vesa" (module does not exist, 0)
[   127.061] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
[   127.061] (II) modesetting: Driver for Modesetting Kernel Drivers: kms
[   127.061] (EE) 
Fatal server error:
[   127.061] (EE) xf86OpenConsole: Cannot open virtual console 1 (Permission denied)
[   127.061] (EE) 
[   127.061] (EE) 
Please consult the The X.Org Foundation support 
	 at http://wiki.x.org
 for help. 
[   127.061] (EE) Please also check the log file at "/home/me/.local/share/xorg/Xorg.0.log" for additional information.
[   127.061] (EE) 
[   127.061] (WW) xf86CloseConsole: KDSETMODE failed: Bad file descriptor
[   127.061] (WW) xf86CloseConsole: VT_GETMODE failed: Bad file descriptor
[   127.061] (EE) systemd-logind: ReleaseControl failed: Connection is closed
[   127.061] (EE) Server terminated with error (1). Closing log file.

systemd-journald lot of denied_mask

❯ aa-log systemd-journald
ALLOWED systemd-journald mknod /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#system@0fa5f0a40a104646b934c5403dfb401e-0000000002a847db-0005f2287945c97b.journalaf15cfafb9677a52 comm=journal-offline requested_mask=c denied_mask=c
ALLOWED systemd-journald open /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#system@0fa5f0a40a104646b934c5403dfb401e-0000000002a847db-0005f2287945c97b.journalaf15cfafb9677a52 comm=journal-offline requested_mask=wc denied_mask=wc
ALLOWED systemd-journald truncate /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#system@0fa5f0a40a104646b934c5403dfb401e-0000000002a847db-0005f2287945c97b.journalaf15cfafb9677a52 comm=journal-offline requested_mask=w denied_mask=w
ALLOWED systemd-journald chmod /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#system@0fa5f0a40a104646b934c5403dfb401e-0000000002a847db-0005f2287945c97b.journalaf15cfafb9677a52 comm=journal-offline requested_mask=w denied_mask=w
ALLOWED systemd-journald rename_src /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#system@0fa5f0a40a104646b934c5403dfb401e-0000000002a847db-0005f2287945c97b.journalaf15cfafb9677a52 comm=journal-offline requested_mask=wrd denied_mask=wrd
ALLOWED systemd-journald mknod /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002a8531d-0005f228794a00d6.journale23a225c88296fe3 comm=journal-offline requested_mask=c denied_mask=c
ALLOWED systemd-journald open /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002a8531d-0005f228794a00d6.journale23a225c88296fe3 comm=journal-offline requested_mask=wc denied_mask=wc
ALLOWED systemd-journald chmod /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002a8531d-0005f228794a00d6.journale23a225c88296fe3 comm=journal-offline requested_mask=w denied_mask=w
ALLOWED systemd-journald rename_src /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002a8531d-0005f228794a00d6.journale23a225c88296fe3 comm=journal-offline requested_mask=wrd denied_mask=wrd
ALLOWED systemd-journald mknod /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#system@0fa5f0a40a104646b934c5403dfb401e-0000000002ab6d67-0005f2298f9fc264.journal6da35573c115a750 comm=journal-offline requested_mask=c denied_mask=c
ALLOWED systemd-journald open /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#system@0fa5f0a40a104646b934c5403dfb401e-0000000002ab6d67-0005f2298f9fc264.journal6da35573c115a750 comm=journal-offline requested_mask=wc denied_mask=wc
ALLOWED systemd-journald truncate /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#system@0fa5f0a40a104646b934c5403dfb401e-0000000002ab6d67-0005f2298f9fc264.journal6da35573c115a750 comm=journal-offline requested_mask=w denied_mask=w
ALLOWED systemd-journald chmod /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#system@0fa5f0a40a104646b934c5403dfb401e-0000000002ab6d67-0005f2298f9fc264.journal6da35573c115a750 comm=journal-offline requested_mask=w denied_mask=w
ALLOWED systemd-journald rename_src /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#system@0fa5f0a40a104646b934c5403dfb401e-0000000002ab6d67-0005f2298f9fc264.journal6da35573c115a750 comm=journal-offline requested_mask=wrd denied_mask=wrd
ALLOWED systemd-journald mknod /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002ab9e49-0005f2299c85a906.journal0ee1dacfe857fd66 comm=journal-offline requested_mask=c denied_mask=c
ALLOWED systemd-journald open /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002ab9e49-0005f2299c85a906.journal0ee1dacfe857fd66 comm=journal-offline requested_mask=wc denied_mask=wc
ALLOWED systemd-journald chmod /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002ab9e49-0005f2299c85a906.journal0ee1dacfe857fd66 comm=journal-offline requested_mask=w denied_mask=w
ALLOWED systemd-journald rename_src /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002ab9e49-0005f2299c85a906.journal0ee1dacfe857fd66 comm=journal-offline requested_mask=wrd denied_mask=wrd
ALLOWED systemd-journald mknod /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002ab9e49-0005f2299c85a906.journaleec016fa729cab76 comm=journal-offline requested_mask=c denied_mask=c
ALLOWED systemd-journald open /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002ab9e49-0005f2299c85a906.journaleec016fa729cab76 comm=journal-offline requested_mask=wc denied_mask=wc
ALLOWED systemd-journald chmod /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002ab9e49-0005f2299c85a906.journaleec016fa729cab76 comm=journal-offline requested_mask=w denied_mask=w
ALLOWED systemd-journald rename_src /var/log/journal/9293dd9ca4a5484ba3bdcd0767b08621/.#user-1000@e5662d6bc04849df855dfd608795328e-0000000002ab9e49-0005f2299c85a906.journaleec016fa729cab76 comm=journal-offline requested_mask=wrd denied_mask=wrd

Distribution I use is arch linux + gnome.

Maybe it's because I set limit in journald.conf:

[Journal]
SystemMaxUse=512M

Debian 10 have no `@{run}` tunable

debian11$ grep -rI '@{run}' /etc/apparmor.d/tunables/
/etc/apparmor.d/tunables/run:@{run}=/run/ /var/run/
debian11$ grep -rI 'tunables/run' /etc/apparmor.d/tunables/
/etc/apparmor.d/tunables/global:#include <tunables/run>

Close if Buster support is dropped. It's still very much around however.

git profile is probably too restrictive

git status in any repo populates an audit log.

aa-log git

ALLOWED git file_perm /home/vbauer/tmp/aur/apparmor.d-git/src/apparmor.d-git/.git/FETCH_HEAD comm=git requested_mask=w denied_mask=w
ALLOWED git mknod /home/vbauer/tmp/aur/apparmor.d-git/src/apparmor.d-git/.git/objects/maintenance.lock comm=git requested_mask=c denied_mask=c
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/src/apparmor.d-git/.git/objects/maintenance.lock comm=git requested_mask=wrc denied_mask=wrc
ALLOWED git unlink /home/vbauer/tmp/aur/apparmor.d-git/src/apparmor.d-git/.git/objects/maintenance.lock comm=git requested_mask=d denied_mask=d
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/src/apparmor.d-git/.git/logs/HEAD comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/.git/HEAD comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/.git/config comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/.git/refs/heads/master comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/.git/packed-refs comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/.git/index comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/.git/refs/ comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/.git/objects/pack/ comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/.git/objects/pack/pack-d89dbb867e0b50c418b2c667467cd2c97937567f.idx comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/.git/objects/pack/pack-d89dbb867e0b50c418b2c667467cd2c97937567f.pack comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/tmp/aur/apparmor.d-git/PKGBUILD comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/HEAD comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/config comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/refs/heads/master comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/packed-refs comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/index comm=git requested_mask=r denied_mask=r
ALLOWED git mknod /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/index.lock comm=git requested_mask=c denied_mask=c
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/index.lock comm=git requested_mask=wrc denied_mask=wrc
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/refs/ comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/refs/stash comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/objects/pack/ comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/objects/cc/999a1953cc648ba2339c7a6ff96ae89329032c comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/objects/58/56d49e5fc50164529b94bb51763cd4ac8d44fa comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/info/exclude comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/ comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.gitignore comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.github/ comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.github/workflows/ comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/cache_dir/ comm=git requested_mask=r denied_mask=r
ALLOWED git open "/home/vbauer/go/src/github.com/vbauerster/kampliment/dir with space/" comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/scripts/ comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/src/ comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/src/kamp/ comm=git requested_mask=r denied_mask=r
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/src/kamp/cmd/ comm=git requested_mask=r denied_mask=r
ALLOWED git unlink /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/index.lock comm=git requested_mask=d denied_mask=d
ALLOWED git open /home/vbauer/go/src/github.com/vbauerster/kampliment/.git/refs/remotes/origin/master comm=git requested_mask=r denied_mask=r

mount: squashfs

%boot%
ubuntu-lts kernel: [   24.162652] audit: type=1400 audit(1640302096.784:101): apparmor="ALLOWED" operation="open" profile="mount" name="/tmp/sanity-squashfs-369083739" pid=793 comm="mount" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0
%reboot%
ubuntu-lts kernel: [    6.592516] audit: type=1400 audit(1640302181.264:103): apparmor="ALLOWED" operation="open" profile="mount" name="/tmp/sanity-squashfs-425838928" pid=898 comm="mount" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

Not sure where it should go.

common policy

Hi. I'm new to AppArmor. Writing a profile surely requires profound knowledge of Linux internals. Reading your profiles was of great help to me. Is there a written approach of dealing with permissions (what is acceptable and what is not) adopted by this repository? Examples of what I mean:

/etc/machine-id. On one hand, it can be used to track a computer. On the other hand, I believe, there are plenty of ways to track using writing access to common cache directories.
Consoles. AFAIK, a program having access to consoles can read from all consoles, not just its own stdin. Hence it will be able to read a password, for example.
dconf. I see many GUI programs require it. This is a configuration server like Windows Registry. Does the access to dconf gives a way to modify other programs' settings? That would be unacceptable. Configuration files don't have this vulnerability.

Knowing your policy will be useful if I ever contribute to your repository and for writing my own profiles.

How `mono-sgen` is suppose to work?

It seems that C# programs are executed in the same context as the main profile ($ mono-sgen some.exe). Is there a way around it?
If that's by design, we have number of problems:

As C# programs are generally third-party and untrusted, line /{usr/,}bin/* rPUx, poses a significant threat to the system. Surely we won't have profile for everything such as killall and shred?
/usr/share/.mono/{,**} rw, Aren't /usr immutable for everything besides package manager? Moreover, this path is a place for a trust chain.

PS: maybe open up the Discussion section?

general complains by profile

I decided to sort | uniq by profile after a few days of usage, to have an idea like what profiles need attention.
If you're interested in details (log sample) I'm happy to provide one.
Following have been generated after apparmor.d-git-0.923-1-x86_64.pkg.tar.zst installation.

❯ aa-log | cut -f2 -d' ' | sort | uniq

aa-notify
btrfs
child-pager
chromium
dbus-daemon
dbus-daemon//null-/usr/lib/telepathy/mission-control-5
git
gnome-characters
gnome-contacts-search-provider
gnome-session-binary
gnome-session-binary//null-/usr/bin/snapshot-detect
gnome-session-binary//null-/usr/bin/snapshot-detect//null-/usr/bin/grep
gnome-session-binary//null-/usr/lib/xapps/sn-watcher/xapp-sn-watcher
gnome-shell
gpg
gpgconf
gvfsd-smb-browse
htop
id
kmod
libvirtd
nautilus
nautilus//null-/usr/bin/bwrap
pipewire
pkexec
power-profiles-daemon
run-parts
systemd-coredump
systemd-journald
systemd-sleep
systemd-sleep//null-/usr/lib/systemd/system-sleep/sysstat.sleep
systemd-sleep//null-/usr/lib/systemd/system-sleep/sysstat.sleep//null-/usr/lib/sa/sa1
systemd-sleep//null-/usr/lib/systemd/system-sleep/sysstat.sleep//null-/usr/lib/sa/sa1//null-/usr/lib/sa/sadc
tracker-extract
wireplumber
wpa-supplicant
xdg-settings
xhost
xrdb
xrdb//null-/usr/bin/cpp
xrdb//null-/usr/bin/cpp//null-/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/cc1