Hi,
Am 23.08.20 um 09:50 schrieb intrigeri:
> Control: tag -1 + moreinfo
>
> Hi,
>
> Karsten (2020-08-23):
>> Yes. But the interesting thing is the output when trying to use cups.
>>
>> Aug 23 00:59:15 pc kernel: audit: type=1400 audit(1598137155.941:58):
>> apparmor="DENIED" operation="mknod"
>> profile="/usr/sbin/cupsd" name="/srv/ssd3/var/spool/cups/00000000" pid=612
>> comm="cupsd" requested_mask="c"
>> denied_mask="c" fsuid=0 ouid=0
> It seems you have symlinks from /var/{log,spool} to
> /srv/ssd3/{log,spool}, or similar. Could you please confirm?
Yes - that's true, because /var and /home are on an HDD and the OS is on an SSD.
> AppArmor resolves symlinks before applying policy. This is necessary
> to avoid anyone bypassing the policy merely by creating a symlink to
> a confined program. There's of course no way the default policy
> shipped in Debian knows about all the symlinks users may choose to set
> up, so some local adjustment will be needed to cope with this
> non-standard setup. I consider this as a general usability problem of
> AppArmor vs. non-standard setup, rather than a bug in this specific
> AppArmor profile.
>
> I think your options are:
>
> A) Use bind-mounts instead of symlinks; I believe this is the cheapest
> option, both in terms of initial setup and in terms of maintenance.
> This avoids AppArmor having to do anything special, because the
> canonical path of /var/{log,spool}/cups will be the one that's
> already supported in the default AppArmor policy.
Thanks a lot. This could be a solution.
> B) Use the AppArmor "alias" functionality in
> /etc/apparmor.d/tunables/alias, so that AppArmor knows the mapping
> between standard canonical paths and your custom local ones.
>
> For example, something like this:
>
> alias /var/spool/cups/ -> /srv/ssd3/var/spool/cups/,
>
> Please try one of these :)
I tried this option and it works. Thank you.
Now an printer can be added.
Is there a way to get the working of apparmot more transparent?
There seems only aa-status on the command line.
Cheers
karsten
