Re: [apparmor] How to setup apparmor for calling an executable from another executable with a profile

2018-05-29 Thread Christian Boltz
Hello, Am Dienstag, 29. Mai 2018, 07:05:28 CEST schrieb Germán Diago Gómez: > I have a question I posted in Stackoverflow and ubuntu stack exchange > with no luck. > > My problem is the following: > > > I have a problem I am not sure how to solve in AppArmor. > > Basically I have a profile tha

Re: [apparmor] How to setup apparmor for calling an executable from another executable with a profile

2018-05-29 Thread Germán Diago Gómez
Sounds like /the/other/executable ix, is what fits you best. This is what I did before (and just tried again). Indeed this is not working for me (I just checked again). I think the problem might be that the executable I try to execute (/my/other/executable) is in /usr/bin? Because /my/exec

Re: [apparmor] How to setup apparmor for calling an executable from another executable with a profile

2018-05-29 Thread Seth Arnold
On Tue, May 29, 2018 at 09:49:45PM +0700, Germán Diago Gómez wrote: > sudo apparmor_parser -r -W myprofile-file > > And run the docker machine like this: > > docker run ... --security-opt apparmor=my-profile ... > > if I execute /usr/bin/myexe I get permission denied Hello, If you check your a

Re: [apparmor] How to setup apparmor for calling an executable from another executable with a profile

2018-05-29 Thread Germán Diago Gómez
If you check your audit logs or dmesg you will find an AppArmor DENIED line with full details about the denied request. Once you've got those, then it'll be easier to make concrete suggestions for changes. Thanks I found a couple of problems. First one being that clang++ (which I am invoking)