After installing and enabling Apparmor on my system I got some weird output when booting that I can't understand. If anyone is willing to help me with this/research this with me, I would greatly appreciate it. My init system is runit.
How I got to here:
So I installed the packages
sudo pacman -S apparmor apparmor-runit
Enabled apparmor's enforce mode in /etc/rc/apparmor.conf and added
lsm=landlock,lockdown,yama,apparmor,bpf
to the kernel parameters in /etc/default/grub.
I made sure the audit daemon and rules (ctl) were enabled in runit and rebooted.
The issue:
My machine booted just fine but soon my console was flooded with messages of the type
* Load profile enforce: /etc/apparmor.d/usr.sbin.winbindd
File not found, skipping...
(one for each profile), ending with
/usr/lib/rc/functions: line 82: /run/sv.d/failed/: Is a directory
followed by the login prompt.
What I got so far:
Delving into the sysinit script /etc/rc/sysinit/96-apparmor, the last error in the functions file is obviously caused by a failed call of
(( rc || $? )) && stat_die
since stat_die is called without any arguments.
Everything else is weird. This is the for loop that prints the above pairs of lines (one for every profile) in the sysinit script
for profile in /etc/apparmor.d/*; do
if [[ -f "$profile" ]]; then
printf '* Load profile %s: %sn' "$APPARMOR" "$profile"
apparmor_parser -a "$AACOMPLAIN" "$profile"
fi
done
So the printf command prints the first line and the apparmor_parser command prints the second line.
Digging through the apparmor source code, this error happens on line 1652 of parser/parser_main.c:
if (profilename && stat(profilename, &stat_file) == -1) {
last_error = errno;
PERROR("File %s not found, skipping...n", profilename);
if (abort_on_error)
break;
goto cleanup;
}
appearing as if an empty string had been passed to apparmor_parser??
My confussion is even greater since after these 52 error messages, every profile appears to be loaded properly, as verified by aa-status and some testing with firejail. How is this possible, since the goto cleanup;
line clearly skips the loading of the profile into memory?
My guess (not tested yet) is that the empty "$AACOMPLAIN" in the sysinit script somehow gets interpreted as an empty string since the filename in the error message appears to be empty (note the %s), generating one extra line of error (besides the silent success when the profile is loaded).
Does anybody have more insight on this (non)issue? Possible fixes?