That is where the "chromium-browser" string comes from, and that is the profile that wont load, somewhere in that, or the submodules that are called has an error in it.
Code: Select all
cat usr.bin.chromium-browser
# Last Modified: Tue Nov 23 14:25:47 2021
@{chromium} = chromium{,-browser}
#include <tunables/global>
# Author: Jamie Strandboge <jamie@canonical.com>
# We need 'flags=(attach_disconnected)' in newer chromium versions
profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconnected) {
#include <abstractions/audio>
#include <abstractions/cups-client>
#include <abstractions/dbus-session>
#include <abstractions/dbus-strict>
#include <abstractions/gnome>
#include <abstractions/ibus>
#include <abstractions/lightdm>
#include <abstractions/nameservice>
#include <abstractions/ubuntu-browsers.d/chromium-browser>
#include <abstractions/user-tmp>
#include <local/usr.bin.chromium-browser>
capability sys_admin,
capability sys_chroot,
capability sys_ptrace,
network inet stream,
network inet6 stream,
deny dbus send bus=system path=/org/freedesktop/UPower interface=org.freedesktop.DBus.Properties member=Get peer=(label=unconfined),
deny dbus send bus=system path=/org/freedesktop/UPower interface=org.freedesktop.UPower member={EnumerateDevices,GetDisplayDevice} peer=(label=unconfined),
deny dbus send bus=system path=/org/freedesktop/UPower/devices/* interface=org.freedesktop.DBus.Properties member=Get peer=(label=unconfined),
deny dbus send bus=system path=/org/freedesktop/hostname1 interface=org.freedesktop.DBus.Properties member=GetAll peer=(label=unconfined),
ptrace trace peer=@{profile_name},
ptrace trace peer=@{profile_name}//lsb_release,
ptrace trace peer=@{profile_name}//xdgsettings,
unix (receive, send) peer=(label=/usr/lib/@{chromium}/@{chromium}//chromium_browser_sandbox),
deny /run/udev/data/** r,
deny /usr/lib/@{chromium}/** w,
deny /var/cache/fontconfig/ w,
deny @{PROC}/[0-9]*/oom_{,score_}adj w,
/**/ r,
/etc/@{chromium}/policies/** r,
/proc/sys/fs/inotify/max_user_watches r,
/sys/devices/**/uevent r,
/sys/devices/pci[0-9]*/**/block/**/size r,
/sys/devices/pci[0-9]*/**/class r,
/sys/devices/pci[0-9]*/**/config r,
/sys/devices/pci[0-9]*/**/device r,
/sys/devices/pci[0-9]*/**/irq r,
/sys/devices/pci[0-9]*/**/removable r,
/sys/devices/pci[0-9]*/**/resource r,
/sys/devices/pci[0-9]*/**/revision r,
/sys/devices/pci[0-9]*/**/subsystem_device r,
/sys/devices/pci[0-9]*/**/subsystem_vendor r,
/sys/devices/pci[0-9]*/**/vendor r,
/sys/devices/system/cpu/cpu*/cpufreq/cpuinfo_max_freq r,
/sys/devices/system/cpu/cpufreq/policy*/cpuinfo_max_freq r,
/sys/devices/system/node/node*/meminfo r,
/sys/devices/virtual/block/**/removable r,
/sys/devices/virtual/block/**/size r,
/sys/devices/virtual/tty/tty*/active r,
/tmp/.X[0-9]*-lock r,
/usr/bin/lsb_release rCx -> lsb_release,
/usr/bin/xdg-settings rCx -> xdgsettings,
/usr/lib/@{chromium}/*.pak mr,
/usr/lib/@{chromium}/@{chromium} ix,
/usr/lib/@{chromium}/chrome-sandbox cx -> chromium_browser_sandbox,
/usr/lib/@{chromium}/locales/* mr,
/usr/lib/@{chromium}/xdg-settings rCx -> xdgsettings,
/usr/share/fonts/**/*.pfb m,
/usr/share/fonts/truetype/**/*.tt[cf] m,
/usr/share/icons/**/*.cache m,
/usr/{include,share,src}** r,
/{usr/,}bin/ps rUx,
@{PROC}/[0-9]*/clear_refs rw,
@{PROC}/[0-9]*/fd/ r,
@{PROC}/[0-9]*/net/if_inet6 r,
@{PROC}/[0-9]*/net/ipv6_route r,
@{PROC}/[0-9]*/smaps r,
@{PROC}/[0-9]*/stat r,
@{PROC}/[0-9]*/statm r,
@{PROC}/[0-9]*/task/[0-9]*/stat r,
@{PROC}/filesystems r,
@{PROC}/self/exe rix,
@{PROC}/sys/kernel/shmmax r,
@{PROC}/sys/kernel/yama/ptrace_scope r,
@{PROC}/sys/net/ipv4/tcp_fastopen r,
@{PROC}/vmstat r,
owner /home/*/.cache/mesa_shader_cache/0*/*.tmp k,
owner /home/*/.config/chromium/WidevineCdm/4.10.2391.0/_platform_specific/linux_x64/libwidevinecdm.so m,
# owner /proc/*/clear_refs w,
owner /{,var/}run/shm/shmfd-* mrw,
owner /{,var/}run/user/*/dconf/ rw,
owner /{,var/}run/user/*/dconf/user rw,
owner /{dev,run}/shm/pulse-shm* m,
owner /{dev,run}/shm/{,.}org.chromium.* mrw,
owner @{HOME}/ r,
owner @{HOME}/.cache/chromium/ rw,
owner @{HOME}/.cache/chromium/** rw,
owner @{HOME}/.cache/chromium/Cache/* mr,
owner @{HOME}/.cache/mesa_shader_cache/* mr,
owner @{HOME}/.config/chromium/ rw,
owner @{HOME}/.config/chromium/** rwk,
owner @{HOME}/.config/chromium/**/Cache/* mr,
owner @{HOME}/.config/chromium/**/Dictionaries/*.bdic mr,
owner @{HOME}/.config/chromium/Dictionaries/*.bdic mr,
owner @{HOME}/.config/dconf/user r,
owner @{HOME}/.local/share/applications/defaults.list r,
owner @{HOME}/.local/share/applications/mimeinfo.cache r,
owner @{HOME}/.local/share/mime/mime.cache m,
owner @{HOME}/.mozilla/** k,
owner @{HOME}/.mozilla/firefox/*/prefs.js r,
owner @{HOME}/.mozilla/firefox/profiles.ini r,
owner @{HOME}/.pki/nssdb/* rwk,
owner @{HOME}/Downloads/ r,
owner @{HOME}/Downloads/* rw,
owner @{HOME}/Public/ r,
owner @{HOME}/Public/* r,
owner @{PROC}/[0-9]*/auxv r,
owner @{PROC}/[0-9]*/clear_refs wr,
owner @{PROC}/[0-9]*/cmdline r,
owner @{PROC}/[0-9]*/io r,
owner @{PROC}/[0-9]*/setgroups w,
owner @{PROC}/[0-9]*/status r,
owner @{PROC}/[0-9]*/task/[0-9]*/status r,
owner @{PROC}/[0-9]*/{uid,gid}_map w,
profile chromium_browser_sandbox {
capability chown,
capability dac_override,
capability fsetid,
capability setgid,
capability setuid,
capability sys_admin,
capability sys_chroot,
capability sys_ptrace,
signal (receive send) set=exists,
signal peer=@{profile_name},
signal receive peer=/usr/lib/@{chromium}/@{chromium},
signal receive peer=unconfined,
ptrace (read readby),
unix (receive, send) peer=(label=/usr/lib/@{chromium}/@{chromium}),
unix (create),
unix peer=(label=@{profile_name}),
unix (getattr, getopt, setopt, shutdown) addr=none,
deny @{PROC}/[0-9]*/oom_adj w,
deny @{PROC}/[0-9]*/oom_score_adj w,
/dev/null rw,
/etc/ld.so.cache r,
/usr/bin/@{chromium} r,
/usr/lib/@{chromium}/@{chromium} Px,
/usr/lib/@{chromium}/chrome-sandbox mr,
/usr/lib/@{multiarch}/libstdc++.so* mr,
/usr/lib/libstdc++.so* mr,
/{usr/,}lib/@{multiarch}/ld-*.so* mr,
/{usr/,}lib/@{multiarch}/libc-*.so* mr,
/{usr/,}lib/@{multiarch}/libgcc_s.so* mr,
/{usr/,}lib/@{multiarch}/libld-*.so* mr,
/{usr/,}lib/@{multiarch}/libm-*.so* mr,
/{usr/,}lib/@{multiarch}/libpthread-*.so* mr,
/{usr/,}lib/libgcc_s.so* mr,
/{usr/,}lib/tls/*/{cmov,nosegneg}/libc-*.so* mr,
/{usr/,}lib/tls/*/{cmov,nosegneg}/libm-*.so* mr,
/{usr/,}lib/tls/*/{cmov,nosegneg}/libpthread-*.so* mr,
/{usr/,}lib{,32,64}/ld-*.so* mr,
/{usr/,}lib{,32,64}/libc-*.so* mr,
/{usr/,}lib{,32,64}/libld-*.so* mr,
/{usr/,}lib{,32,64}/libm-*.so* mr,
/{usr/,}lib{,32,64}/libpthread-*.so* mr,
@{PROC}/ r,
@{PROC}/[0-9]*/ r,
@{PROC}/[0-9]*/fd/ r,
@{PROC}/[0-9]*/status r,
@{PROC}/[0-9]*/task/[0-9]*/stat r,
owner /tmp/** rw,
}
profile lsb_release {
#include <abstractions/base>
#include <abstractions/python>
/etc/debian_version r,
/etc/dpkg/origins/** r,
/etc/lsb-release r,
/usr/bin/ r,
/usr/bin/dpkg-query rix,
/usr/bin/lsb_release r,
/usr/bin/python3.[0-9] mr,
/usr/include/python2.[4567]/pyconfig.h r,
/usr/local/lib/python3.[0-9]/dist-packages/ r,
/usr/share/distro-info/** r,
/var/lib/dpkg/** r,
/{usr/,}bin/dash rix,
}
profile xdgsettings {
#include <abstractions/bash>
#include <abstractions/gnome>
/etc/ld.so.cache r,
/etc/xdg/** r,
/usr/bin/[gm]awk rix,
/usr/bin/basename rix,
/usr/bin/cut rix,
/usr/bin/dirname rix,
/usr/bin/gconftool-2 ix,
/usr/bin/xdg-mime rix,
/usr/bin/xdg-settings r,
/usr/lib/@{chromium}/xdg-settings r,
/usr/share/applications/*.desktop r,
/usr/share/applications/*.list r,
/{usr/,}bin/dash rix,
/{usr/,}bin/grep rix,
/{usr/,}bin/head rix,
/{usr/,}bin/mkdir rix,
/{usr/,}bin/mv rix,
/{usr/,}bin/readlink rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/touch rix,
/{usr/,}bin/tr rix,
/{usr/,}bin/which rix,
owner @{HOME}/.local/share/applications/ w,
owner @{HOME}/.local/share/applications/mimeapps.list* rw,
}
}
That profile is where the problem lies, Chromium starts and runs, but only partially contrained by apparmor.
Hi,