I can't seem to get the xattr solution to work. I'm trying it on a
normal binary and it's failing like so:
# Contents of /etc/apparmor.d/falkon
abi <abi/4.0>,
include <tunables/global>
profile falkon xattrs=(security.apparmor=falkon) flags=(unconfined) {
userns,
include if exists <local/falkon>
}
# setfattr command
user@user-standardpc:/usr/bin$ sudo setfattr -n security.apparmor -v falkon
/usr/bin/falkon
# make sure the attribute is set
user@user-standardpc:/usr/bin$ getfattr -n security.apparmor /usr/bin/falkon
getfattr: Removing leading '/' from absolute path names
# file: usr/bin/falkon
security.apparmor="falkon"
# attempt to launch
user@user-standardpc:/usr/bin$ /usr/bin/falkon
[3967:3967:1220/095728.818079:FATAL:credentials.cc(125)] Check failed: . :
Permission denied (13)
Trace/breakpoint trap (core dumped)
#checking the logs
user@user-standardpc:/usr/bin$ journalctl -n100
...
Dec 20 09:57:28 user-standardpc kernel: audit: type=1400
audit(1703084248.814:826): apparmor="DENIED" operation="userns_create"
class="namespace" info="User namespace creation restricted" error=-13
profile="unconfined" pid=3967 comm="falkon" requested="userns_create"
denied="userns_create"
Dec 20 09:57:37 user-standardpc kernel: traps: falkon[3967] trap int3
ip:7f3ae85d7b13 sp:7ffe61e8b700 error:0 in
libQt5WebEngineCore.so.5.15.15[7f3ae63b4000+6931000]
...
The solution that involves spelling out the absolute path to the file
does work.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/2046844
Title:
AppArmor user namespace creation restrictions cause many applications
to crash with SIGTRAP
Status in apparmor package in Ubuntu:
Confirmed
Status in digikam package in Ubuntu:
Confirmed
Status in epiphany-browser package in Ubuntu:
Confirmed
Status in falkon package in Ubuntu:
Confirmed
Status in qutebrowser package in Ubuntu:
Confirmed
Bug description:
Hi, I run Ubuntu development branch 24.04 and I have a problem with
Epiphany browser 45.1-1 (Gnome Web): program doesn't launch, and I get
this error
$ epiphany
bwrap: Creating new namespace failed: Permission denied
** (epiphany:12085): ERROR **: 14:44:35.023: Failed to fully launch
dbus-proxy: Le processus fils s’est terminé avec le code 1
Trappe pour point d'arrêt et de trace (core dumped)
$ epiphany
bwrap: Creating new namespace failed: Permission denied
** (epiphany:30878): ERROR **: 22:22:26.926: Failed to fully launch
dbus-proxy: Le processus fils s’est terminé avec le code 1
Trappe pour point d'arrêt et de trace (core dumped)
Thanks for your help!
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2046844/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
