Home / ubuntu / Questions / 1094025
In Process
Fifi Cek
Asked: 2018-11-19 10:22:45 +0800 CST

Apparmor profile for Chromium browser to read from VirtualBox shared folder

  • 772

Were there any changes in apparmore profile for Chriomium browser since 16.04 LTS?

Ubuntu 17.x was skipped. We ran 16.04, now B.Beaver. With transition to Beaver Chriomium stopped to be able to access VirtualBox shared folder. Ubuntu is virtual machine.

The question is also why no profile was found for Chromium at apparmore's default profiles location?

virtualbox chromium shared-folders apparmor

1 Answers

  1. AppArmor profile for Chromium browser needed customization by applying procedure shown below in order for Chromium running on Bionic Beaver virt. machine to be able to access host machine (hypervised by VirtualBox) shared folder.

    $ sudo touch /etc/apparmor.d/local/snap.chromium.chromium

$ echo "/media/sf_exchange/ r," > /etc/apparmor.d/local/snap.chromium.chromium
$ echo "/media/sf_exchange/** r," >> /etc/apparmor.d/local/snap.chromium.chromium
$
$ sudo cat /etc/apparmor.d/local/snap.chromium.chromium
/media/sf_exchange/ r, 
/media/sf_exchange/** r,

    Followed by sequence

    $ sudo apparmor_parser -R  /var/lib/snapd/apparmor/profiles/snap.chromium.chromium 
$ sudo apparmor_parser     /var/lib/snapd/apparmor/profiles/snap.chromium.chromium -a

    However, just 

    $ sudo apparmor_parser     /var/lib/snapd/apparmor/profiles/snap.chromium.chromium -r

    instead of two former commands should help too if only my apparmor understanding is correct. Profile file located in /etc/apparmor.d/local/ overlay profile provided by Ubuntu package and stored to /etc/apparmor.d/local/.

    No modifications were necessary for other Chromium appsarmor profile:

    /etc/apparmor.d/usr.bin.chromium-browser

    as

    sudo aa-status
...
10 processes are in enforce mode.
   snap.chromium.chromium (5871) 
   snap.chromium.chromium (5984) 
   snap.chromium.chromium (5986) 
   snap.chromium.chromium (6010) 
   snap.chromium.chromium (6015) 
   snap.chromium.chromium (6165) 
   snap.chromium.chromium (6178) 
   snap.chromium.chromium (6198) 
   snap.chromium.chromium (6209) 
   snap.chromium.chromium (6212)
...

    Please inform if found and applied approach needs improvement or optimization.

    • 1