cannot confine using apparmor on Arch linux LTS kernel

[virgilhem]

Since a recent kernel update I got the error "Warning: Cannot confine the application using AppArmor" when using the "--apparmor" flag"

The verification performed in src/firejail/sandbox.c failed with the error EINVAL:

test.c:
#include <sys/apparmor.h>
#include <stdio.h>
int main() {
if(aa_change_onexec("firejail-default")<0) { perror(NULL); }
}

$ gcc -lapparmor test.c
$ ./a.out
Invalid argument

Still the "aa-status" command shows that the firejail-default profile is correctly loaded in the kernel.
Don't know if this is a distro specfic issue.

[glitsj16]

Don't know if this is a distro specfic issue.

I can confirm your observations on Arch Linux with linux-lts 5.4.98. Luckily linux-lts 5.10.16 is in testing so I tried that as well and that works as expected (no output from your test.c). Looks like a kernel issue IMO.

[virgilhem]

FYI the issue has been reported upstream:
https://gitlab.com/apparmor/apparmor/-/issues/150

[rusty-snake]

FYI https://gitlab.com/apparmor/apparmor/-/issues/150 was closed last week.