<div dir="ltr">Accidentally replied rather than replying all.<br><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 27, 2017 at 10:30 AM, Jason Wittlin-Cohen <span dir="ltr"><<a href="mailto:jwittlincohen@gmail.com" target="_blank">jwittlincohen@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks for the quick reply!<div><br></div><div>Adding <span style="font-size:12.8px"> #include <abstractions/nvidia> to /etc/apparmor.d/local/usr.bin.<wbr>totem fixed the issue. I am now able to open Totem and play videos. I still see some apparmor DENY messages in the logs, but they seem unrelated.</span></div><div><span style="font-size:12.8px"><br></span></div><div><br></div><div><div><span style="font-size:12.8px">Oct 27 10:09:45 kernel: audit: type=1400 audit(1509113385.373:2948): apparmor="DENIED" operation="file_mmap" profile="/usr/bin/totem" name="/tmp/.glE98VL2" pid=6719 comm="totem" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000</span></div><div><span style="font-size:12.8px">Oct 27 10:09:45 kernel: audit: type=1400 audit(1509113385.373:2949): apparmor="DENIED" operation="file_mmap" profile="/usr/bin/totem" name="/tmp/.glE98VL2" pid=6719 comm="totem" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000</span></div><div><span style="font-size:12.8px">Oct 27 10:09:45 kernel: audit: type=1400 audit(1509113385.373:2950): apparmor="DENIED" operation="mkdir" profile="/usr/bin/totem" name="/home/jason.nv/" pid=6719 comm="totem" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000</span></div><div><span style="font-size:12.8px">Oct 27 10:09:45 kernel: audit: type=1400 audit(1509113385.377:2951): apparmor="DENIED" operation="file_mmap" profile="/usr/bin/totem" name="/tmp/.gldPWDHt" pid=6719 comm="totem" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000</span></div><div><span style="font-size:12.8px">Oct 27 10:09:45 kernel: audit: type=1400 audit(1509113385.377:2952): apparmor="DENIED" operation="file_mmap" profile="/usr/bin/totem" name="/tmp/.gldPWDHt" pid=6719 comm="totem" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000</span></div><div><span style="font-size:12.8px">Oct 27 10:09:45 kernel: audit: type=1400 audit(1509113385.377:2953): apparmor="DENIED" operation="mkdir" profile="/usr/bin/totem" name="/home/jason.nv/" pid=6719 comm="totem" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000</span></div><div><span style="font-size:12.8px">Oct 27 10:09:45 kernel: audit: type=1400 audit(1509113385.447:2954): apparmor="DENIED" operation="exec" profile="/usr/bin/totem" name="/bin/dash" pid=6778 comm="totem" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0</span></div><div><span style="font-size:12.8px">Oct 27 10:16:04 kernel: audit: type=1400 audit(1509113764.487:2956): apparmor="DENIED" operation="file_mmap" profile="/usr/bin/totem" name="/tmp/.glph14DP" pid=12243 comm="totem" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000</span></div><div><span style="font-size:12.8px">Oct 27 10:16:04 kernel: audit: type=1400 audit(1509113764.487:2957): apparmor="DENIED" operation="file_mmap" profile="/usr/bin/totem" name="/tmp/.glph14DP" pid=12243 comm="totem" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000</span></div><div><span style="font-size:12.8px">Oct 27 10:16:04 kernel: audit: type=1400 audit(1509113764.487:2958): apparmor="DENIED" operation="mkdir" profile="/usr/bin/totem" name="/home/jason.nv/" pid=12243 comm="totem" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000</span></div><div><span style="font-size:12.8px">Oct 27 10:16:04 kernel: audit: type=1400 audit(1509113764.492:2959): apparmor="DENIED" operation="file_mmap" profile="/usr/bin/totem" name="/tmp/.glnEQ3yX" pid=12243 comm="totem" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000</span></div><div><span style="font-size:12.8px">Oct 27 10:16:04 kernel: audit: type=1400 audit(1509113764.492:2960): apparmor="DENIED" operation="file_mmap" profile="/usr/bin/totem" name="/tmp/.glnEQ3yX" pid=12243 comm="totem" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000</span></div><div><span style="font-size:12.8px">Oct 27 10:16:04 kernel: audit: type=1400 audit(1509113764.492:2961): apparmor="DENIED" operation="mkdir" profile="/usr/bin/totem" name="/home/jason.nv/" pid=12243 comm="totem" requested_mask="c" denied_mask="c" fsuid=1000 ou</span></div></div><div><br></div><div>------------</div><div><br></div><div>As an aside, I think I am hitting a similar issue when attempting to add apparmor integration to the google-chrome profile in Firejail (firejail ships with its own apparmor profile which allows for additional hardening that is not possible when running firejail alone). When I enable apparmor integration in the Chrome profile, GPU rendering and acceleration are disabled resulting in horrid tearing. I see this message in the logs: </div><div><br></div><div><div>Oct 27 10:06:45 kernel: audit: type=1400 audit(1509113205.516:2856): apparmor="DENIED" operation="open" profile="firejail-default" name="/proc/modules" pid=1417 comm="nvidia-modprobe" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0</div></div><div><br></div><div>I tried adding <span style="font-size:12.8px"> #include <abstractions/nvidia> to /etc/apparmor.d/local/<wbr>firejail-local but then firejail_parser complains "Found reference to variable HOME, but is never declared." </span></div><div>I reported the issue here if you are curious: <a href="https://github.com/netblue30/firejail/issues/1615" target="_blank">https://github.com/<wbr>netblue30/firejail/issues/1615</a><wbr>. <br></div><div><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 27, 2017 at 4:01 AM, intrigeri <span dir="ltr"><<a href="mailto:intrigeri@debian.org" target="_blank">intrigeri@debian.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Control: retitle -1 Totem segfaults with NVIDIA proprietary drivers when AppArmor profile is enforced<br>
Control: tag -1 + moreinfo<br>
<br>
Hi Jason!<br>
<br>
Jason Wittlin-Cohen:<br>
> Totem suffers a segmentation fault upon startup when its respective apparmor<br>
> profile is set to enforce mode. It starts fine when the apparmor profile is<br>
> set to complain mode. I have not modified the /etc/apparmor.d/usr.bin.totem<br>
> profile.<br>
<br>
> […]<br>
> Oct 27 00:00:22 debian-testing kernel: [139101.193078] audit: type=1400<br>
> audit(1509076822.746:1331): apparmor="DENIED" operation="open"<br>
> profile="/usr/bin/totem" name="/proc/modules" pid=29696 comm="totem"<br>
> requested_mask="r" denied_mask="r" fsuid=1000 ouid=0<br>
> Oct 27 00:00:22 debian-testing kernel: [139101.194061] audit: type=1400<br>
> audit(1509076822.747:1332): apparmor="DENIED" operation="exec"<br>
> profile="/usr/bin/totem" name="/usr/bin/nvidia-modprobe<wbr>" pid=29699<br>
> comm="totem"<br>
> requested_mask="x" denied_mask="x" fsuid=1000 ouid=0<br>
<br>
Thanks for reporting this. This seems to be specific to using the<br>
NVIDIA proprietary drivers. Unfortunately I have no NVIDIA hardware<br>
available so I'll need help from you to fix this. This may require<br>
more than one "please test this and report back" iteration.<br>
<br>
Could you please try adding to /etc/apparmor.d/local/usr.bin.<wbr>totem<br>
<br>
#include <abstractions/nvidia><br>
<br>
… then run "sudo apparmor_parser -r /etc/apparmor.d/usr.bin.totem"<br>
and retry.<br>
<br>
If that's not enough, also add:<br>
<br>
/usr/bin/nvidia-modprobe Pix,<br>
<br>
… then run "sudo apparmor_parser -r /etc/apparmor.d/usr.bin.totem"<br>
and retry.<br>
<br>
If both fail, I will need the corresponding AppArmor logs that you can<br>
gather with:<br>
<br>
sudo journalctl -ka --no-hostname | grep -w 'apparmor="DENIED"'<br>
<br>
Or, if systemd-journald is not running:<br>
<br>
sudo grep -w 'apparmor="DENIED"' \<br>
/var/log/auditd/auditd.log \<br>
/var/log/syslog<br>
<br>
This could also be worth a try:<br>
<br>
/usr/bin/nvidia-modprobe PUx,<br>
<br>
(it's not good enough to be applied as-in in Debian but at least it<br>
may help us diagnose the problem :)<br>
<br>
Thanks in advance!<br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div></div>