Linux Labs
Linux Labs
EN

Server security / Stage 8 of 10

AppArmor: when the profile denies access

Not running Starting usually ~20 s
Leave the lesson

Step 1 of 5 · on a machine · 7 min

The permissions are right, but there is no access

What you will learn

  • Find an AppArmor denial in the kernel log by the apparmor="DENIED" line and read what is denied, and to whom.
  • Tell the enforce and complain profile modes apart and switch them with aa-enforce and aa-complain.
  • Extend a profile with the needed path through /etc/apparmor.d/local and apparmor_parser -r, keeping it in enforce.

The lab-docs help service serves pages from /srv/docs. The files are there with ordinary permissions, yet over the network the service answers with a refusal. Run a request and look at the directory's permissions.

Exercise · look

Make a request to lab-docs

Request the index.html page from lab-docs, look at the permissions of /srv/docs and check the kernel log for apparmor denials.

First, predict

The permissions on /srv/docs/index.html are ordinary (644, readable by all). What will the service answer to the page request?

Now start the exercise, run the command and compare your prediction with the output.

Sign in and start The machine is available after signing in
Check yourself 1 question

The permissions on /srv/docs/index.html are ordinary (644), yet the service got Permission denied. What do you know for sure?

  • The file exists: ls -l /srv/docs/index.html shows it as 644. The answer was “Permission denied”, not “no such file”.

  • The service answers — the request reached it and returned a refusal text. systemctl is-active lab-docs shows active.

  • The file is readable by everyone (644), whatever user the service runs as. AppArmor refused it — the apparmor="DENIED" line in journalctl -k.

The file permissions are fine, so the refusal came from the AppArmor profile, not from file access.

Found an inaccuracy? Report an error in the lesson

Ubuntu 24.04
Loading…