Home / ubuntu / Questions / 1488879
Accepted
Thystra
Asked: 2023-10-13 10:16:37 +0800 CST

Apparmor prevents access to certificate bundle for IKEv2 VPN

  • 772

I am trying to get a Strongswan / IKEV2 VPN set up on Ubuntu 23.04. I have the Network Manager plugin compiled and working.
When I attempt the connection, I get the below error in syslog, that it is unable to open the certificate bundle.
Based on the log it appears Apparmor is blocking the access.

How do I fix it so Apparmor will allow access to the file?

2023-10-12T22:07:00.546588-04:00 fafnir charon: 10[CFG] received stroke: add connection '3c204271-9b89-4f25-85b8-3e13d53e6bde'
2023-10-12T22:07:00.546660-04:00 fafnir charon: 10[CFG] added configuration '3c204271-9b89-4f25-85b8-3e13d53e6bde'
2023-10-12T22:07:01.492277-04:00 fafnir charon: 12[CFG] rereading secrets
2023-10-12T22:07:01.492891-04:00 fafnir charon: 12[CFG] loading secrets from '/etc/ipsec.secrets'
2023-10-12T22:07:01.492904-04:00 fafnir charon: 12[CFG] loading secrets from '/etc/ipsec.d/ipsec.nm-l2tp.secrets'
2023-10-12T22:07:01.492915-04:00 fafnir charon: 12[LIB]   opening '/home/alan/pki2/client_fafnir.p12' failed: Permission denied
2023-10-12T22:07:01.492949-04:00 fafnir charon: 12[LIB] building CRED_CONTAINER - PKCS12 failed, tried 3 builders
2023-10-12T22:07:01.492960-04:00 fafnir charon: 12[CFG]   loading credentials from '/home/alan/pki2/client_fafnir.p12' failed
2023-10-12T22:07:01.495808-04:00 fafnir charon: 13[CFG] received stroke: initiate '3c204271-9b89-4f25-85b8-3e13d53e6bde'
2023-10-12T22:07:01.496243-04:00 fafnir kernel: [217471.389372] audit: type=1400 audit(1697162821.489:404): apparmor="DENIED" operation="open" class="file" profile="/usr/lib/ipsec/charon" name="/home/alan/pki2/client_fafnir.p12" pid=913258 comm="charon" requested_mask="r" denied_mask="r" fsuid=0 ouid=1000
network-manager

1 Answers

  1. Best Answer

    Copied cert bundle to /etc/ipsec.d/certs and that resolved permission issue.

    • 0