The service passes the file permissions — a separate check stops it. That is AppArmor: on top of the ordinary permissions it allows a specific program only what is written in its profile.
A service's profile is a file in /etc/apparmor.d/: the path to the program and a list of paths it may read and write. A profile has two modes:
- enforce — anything not in the profile is forbidden;
- complain — nothing is forbidden, violations are only written to the log.
sudo aa-status shows the loaded profiles and their modes. Two commands switch the mode:
In complain the service works even if the profile does not allow a path — so you can see what it is missing without breaking access for good.
complain is kept only while you debug: in it the profile protects nothing. Once you have found the cause, put enforce back.
Switch the profile to complain
Switch the docsrv service profile (/etc/apparmor.d/usr.local.bin.docsrv) to complain mode without touching the profile itself. After that the service must serve index.html on http://127.0.0.1:8097/index.html.
Goals · 0 of 2
- Put the docsrv profile in complain not done yet
- Get the service to serve the page not done yet
You switched the docsrv profile to complain, and the service serves pages from /srv/docs. You added no path to the profile. What happens if you put it back in enforce?
-
The service starts in any profile mode; in enforce it is only refused the unlisted path.
systemctl is-active lab-docsstays active. -
sudo aa-enforceswitches the profile either way. After itaa-statusshows docsrv in enforce. -
complain adds nothing to the profile, it only logs. In enforce the unlisted
/srv/docsis closed again:curlreturns “Permission denied”.
In enforce the unlisted /srv/docs path is closed again — complain did not change the profile.