github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2116] firejail AppArmor profile doesn't work #1434

New issue

Closed

opened 2026-05-05 08:05:57 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 08:05:57 -06:00

Owner

Originally created by @hardenedfly on GitHub (Sep 15, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2116

Here's what happens when I run sudo aa-enforce firejail-default:

Setting /etc/apparmor.d/firejail-default to enforce mode.

ERROR: Path doesn't start with / or variable: firejail-default

I compiled firejail this way:


./configure --prefix=/usr --enable-apparmor

make

sudo make install-strip

I'm using Arch Linux with a kernel that has AppArmor support enabled, I tested AppArmor with other profiles and it worked properly.

My kernel: 4.18.7.a-1-hardened

My AppArmor version:apparmor 2.13.0-4

Originally created by @hardenedfly on GitHub (Sep 15, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2116 Here's what happens when I run `sudo aa-enforce firejail-default`: ``` Setting /etc/apparmor.d/firejail-default to enforce mode. ERROR: Path doesn't start with / or variable: firejail-default ``` I compiled firejail this way: ``` ./configure --prefix=/usr --enable-apparmor make sudo make install-strip ``` I'm using Arch Linux with a kernel that has AppArmor support enabled, I tested AppArmor with other profiles and it worked properly. My kernel: `4.18.7.a-1-hardened` My AppArmor version:`apparmor 2.13.0-4`

gitea-mirror closed this issue

2026-05-05 08:05:58 -06:00

gitea-mirror commented

2026-05-05 08:06:00 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 15, 2018):

Try restarting. I've had this issue when apparmor was updated.

@chiraag-nataraj commented on GitHub (Sep 15, 2018): Try restarting. I've had this issue when apparmor was updated.

gitea-mirror commented

2026-05-05 08:06:00 -06:00

Author

Owner

@hardenedfly commented on GitHub (Sep 15, 2018):

I did that, The issue remains.

@hardenedfly commented on GitHub (Sep 15, 2018): I did that, The issue remains.

gitea-mirror commented

2026-05-05 08:06:01 -06:00

Author

Owner

@hardenedfly commented on GitHub (Sep 15, 2018):

@chiraag-nataraj
It seems to be something related to this bug, https://gitlab.com/apparmor/apparmor/merge_requests/142

I'm not sure what an attachment path is(I'm still a beginner, sorry) but can you include one?

@hardenedfly commented on GitHub (Sep 15, 2018): @chiraag-nataraj It seems to be something related to this bug, https://gitlab.com/apparmor/apparmor/merge_requests/142 I'm not sure what an attachment path is(I'm still a beginner, sorry) but can you include one?

gitea-mirror commented

2026-05-05 08:06:02 -06:00

Author

Owner

@hardenedfly commented on GitHub (Sep 16, 2018):

I just checked. Regardless of the error, the profile appears in when I run sudo aa-status after reloading the apparmor service. Does this mean that the profile is loaded but broken or something like that? I mean it still shows the error when running sudo aa-enforce firejail-default

@hardenedfly commented on GitHub (Sep 16, 2018): I just checked. Regardless of the error, the profile appears in when I run `sudo aa-status` after reloading the `apparmor` service. Does this mean that the profile is loaded but broken or something like that? I mean it still shows the error when running `sudo aa-enforce firejail-default`

gitea-mirror commented

2026-05-05 08:06:02 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 16, 2018):

Ohh. Right, so if the profile is already loaded, I think it gives that error. You'd have to use sudo apparmor_parser -r /etc/apparmor.d/firejail-default or something like that to reload a profile that's already loaded.

@chiraag-nataraj commented on GitHub (Sep 16, 2018): Ohh. Right, so if the profile is already loaded, I think it gives that error. You'd have to use `sudo apparmor_parser -r /etc/apparmor.d/firejail-default` or something like that to reload a profile that's already loaded.

gitea-mirror commented

2026-05-05 08:06:04 -06:00

Author

Owner

@Vincent43 commented on GitHub (Sep 17, 2018):

firejail-default apparmor profile is loaded only on demand by firejail as it doesn't protect any specific binary but only those which firejail pass to it. You don't load it manually. You can check it by running firejail --apparmor bash then from different terminal sudo aa-status.

@Vincent43 commented on GitHub (Sep 17, 2018): `firejail-default` apparmor profile is loaded only on demand by firejail as it doesn't protect any specific binary but only those which firejail pass to it. You don't load it manually. You can check it by running `firejail --apparmor bash` then from different terminal `sudo aa-status`.

gitea-mirror referenced this issue

2026-05-05 10:11:08 -06:00

[PR #1427] [MERGED] Unify all profiles #3959

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1434

No description provided.

Rows
Columns