Ubuntu, Apparmor and moved home dirs

I got a new HDD recently and linked /home to a new partition mounted on /data/, /data/home/. Just like I did a dozen times before. Now a realized, that my pdf viewer evince (and surely some other programs) aren’t working anymore. Evince crashes with this error message:

(evince:22792): EggSMClient-WARNING **: Failed to connect to the session manager: None of the authentication protocols specified are supported
(evince:22792): Gtk-WARNING **: Attempting to read the recently used resources file at `/home/lenfers/.recently-used.xbel', but the parser failed: Datei »/home/lenfers/.recently-used.xbel« konnte nicht geöffnet werden: Permission denied.
** (evince:22792): WARNING **: Error creating last_settings file: Fehler beim Öffnen der Datei »/home/lenfers/.gnome2/evince/last_settings«: No such file or directory

As I found out, that is caused by AppArmor, a surely useful innovation to secure your computer, but new enough that I haven’t took the time to get to know it. AppArmor is activated by default on Ubunut 10.04 (and IIRC 9.10 and maybe 9.04 as well) and restricts access of programs on certain files. Due to the change of my home directory, evince tried to access files which for AppArmor are in /data/home/lenfers/ and consequently disallowed access to them.

The solution to this is easy, after I found it: Make your new location for home directories known to AppArmor: Add the path of your home direcories to the HOMEDIRs var in  /etc/apparmor.d/tunables/home. Now the line looks like that for me:

@{HOMEDIRS}=/home/ /data/home/

Now back to work. 🙂

What do you think of this post?
  • Awesome (6)
  • Interesting (3)
  • Useful (8)
  • Boring (4)
  • Sucks (1)

5 Antworten auf „Ubuntu, Apparmor and moved home dirs“

  1. Hello, Guten Abend,

    I’ve landed to your to you post after I get into a similar configuration.

    Two notes to fee your topic :

    I have checked path supplied in tunables/home must strictly ends with „/“, otherwise you may get into serious trouble (I do not know why, this produce many malfunctions, I will have to study this deeper a later day).

    This tunables/home does not solve anything if you also moved /tmp (which I did), and some things may still not work due to AppArmor. You have to edit tunables/alias for that purpose.

    Then later, I have checked you may simply add an alias too for /home the same way you may do for /tmp. There is not even the need to edit tunables/home, just edit tunables/alias, so that every thing is managed in the same place.

    Example : I have a partition mounted on /mnt/vars, designated to hold home and tmp. and /home and /tmp are links to /mnt/vars/home and /mnt/vars/tmp. So I added this in /etc/apparmor.d/tunables/alias :

    alias /home/ -> /mnt/vars/home/,
    alias /tmp/ -> /mnt/vars/tmp/,

    Here again, do not forget „/“ at the end of paths. Also note the comma. I do not know why this comma is required, but this is what is indicated in comment from tunables/alias.

    Have a nice day! 🙂

  2. Funny, I just stumbled last week about aliases while modfiying AppArmor on a server of mine. But I appreciate your comment, that solution is surely better than mine, perhaps it will help someone else. 🙂

  3. Alternatively, I found an even better way to solve the trick : use mound-bind instead of links. AppArmor enjoy this better, and there is no need any more to edit AppArmor configuration files.

    An example. Let say you have a partition to hold /home and /tmp directories. You first mount that partition, as usual, but instead of symbolic links from the root partition to the final location of home and temp, you use a mount-bind in fstab :

    # Mount the partition
    /dev/sda3 /mnt/vars btrfs
    # Mount /home using bind
    /mnt/vars/home /home none bind
    # Mount /tmp the same way
    /mnt/vars/tmp /tmp none bind

    You use none as the partition kind, because the partition kind is not to be provided with bind, an you use bind as the mount option.

    Seems to be cleaner in the end.

  4. That surely works as well, but for some reason I prefer the link/alias solution. But your contribution is much appreciated and as you said will work as well. Seems to be a matter of preference.

Schreibe einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert.