AppArmor and Capabilities

Could anyone please answer this one too?

Thanks,
Urs

Hi Luis,

Thank your for your reply.

What I still do not understand is the workflow in Lab 33.2.. After setting the capabilities in Step 1-3, the new ping-x program works as expected, even after a reboot:

Step 2:

alu@ubuntu-dt-vm:~$ ls -l /bin/ping
-rwxr-xr-x 1 root root 89768 Apr  8  2024 /bin/ping
alu@ubuntu-dt-vm:~$ 
alu@ubuntu-dt-vm:~$ sudo cp /bin/ping /bin/ping-x
alu@ubuntu-dt-vm:~$ 
alu@ubuntu-dt-vm:~$ ls -l /bin/ping-x
-rwxr-xr-x 1 root root 89768 Nov 12 08:44 /bin/ping-x
alu@ubuntu-dt-vm:~$ 
alu@ubuntu-dt-vm:~$ sudo getcap /bin/ping
/bin/ping cap_net_raw=ep
alu@ubuntu-dt-vm:~$ sudo getcap /bin/ping-x
alu@ubuntu-dt-vm:~$ 
alu@ubuntu-dt-vm:~$ ping-x -c3 -4 127.0.0.1
ping-x: socktype: SOCK_RAW
ping-x: socket: Operation not permitted
ping-x: => missing cap_net_raw+p capability or setuid?
alu@ubuntu-dt-vm:~$

Step 3:

alu@ubuntu-dt-vm:~$ sudo setcap cap_net_raw+ep /bin/ping-x
alu@ubuntu-dt-vm:~$ 
alu@ubuntu-dt-vm:~$ sudo getcap /bin/ping
/bin/ping cap_net_raw=ep
alu@ubuntu-dt-vm:~$ sudo getcap /bin/ping-x
/bin/ping-x cap_net_raw=ep
alu@ubuntu-dt-vm:~$ 
alu@ubuntu-dt-vm:~$ ping-x -c3 -4 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.081 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.055 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.055 ms

--- 127.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2061ms
rtt min/avg/max/mdev = 0.055/0.063/0.081/0.012 ms
alu@ubuntu-dt-vm:~$ 
alu@ubuntu-dt-vm:~$ sudo reboot

# [... after reboot...]

alu@ubuntu-dt-vm:~$ ping-x -c3 -4 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.070 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.066 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.051 ms

--- 127.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2053ms
rtt min/avg/max/mdev = 0.051/0.062/0.070/0.008 ms

Maybe I missed something, but this means that the following steps by generating the AppArmor profile with aa-genprof (Step 4+) become useless as it doesn't change anything in terms of the ping-x's behavior. The program ping-x works before and it also works after setting up the AppArmor profile.

Therefore, after restoring the latest VM snapshot, I tried it again without setting the capabilities, but this experiment failed. Only setting up an AppArmor profile without previously changing the capabilities seam not to work for some reason.

Hence, the only way I get the ping-x to work is setting the capabilities, with or without creating an AppArmor profile.

It would be great if you could further explain that behavior, so I can understand the relationship between setting the capabilities and AppArmor.

Thanks,
Urs

Perfect, thank you very much.

Regards,
Urs