[apparmor] Weird problem with LD_LIBRARY_PATH

[John Johansen]

On 05/05/2014 05:40 PM, Aaron Lewis wrote:
> Oops, "When I enforce the opt.chromium.chromium.chromium.sh policy"
> should be "When I enforce the opt.chromium.chromium.chromium policy"
> 
> On Tue, May 6, 2014 at 8:40 AM, Aaron Lewis <the.warl0ck.1989 at gmail.com> wrote:
>> Hi,
>>
>> I'm trying to setup a chromium profile that is installed in a
>> different location,
>>
>> %> cat /opt/chromium/chromium/chromium.sh
>> #!/bin/bash
>>
>> export LD_LIBRARY_PATH=/opt/chromium/libs/
>> /opt/chromium/chromium/chromium "$@"
>>
>> When I enforce the opt.chromium.chromium.chromium.sh policy, it says:
>> (No problem running it if aa is diabled)
>> %> /opt/chromium/chromium/chromium.sh
>> /opt/chromium/chromium/chromium: error while loading shared libraries:
>> libicui18n.so.52: cannot open shared object file: No such file or
>> directory
>>
>> But I already have: "/opt/chromium/libs/* rm," in that profile, anything wrong?
>>
>> That profile is for "/opt/chromium/chromium/chromium", not the script though
>>

Can you provide some more info?
What distro/release or version of apparmor and kernel
Is there a denied message logged?
  If not is there a deny causing the logging to be suppressed?
    You can turn off deny suppressing the audit message by doing (as root)
      echo -n "noquiet" >/sys/module/apparmor/parameters/audit
Does it work in complain mode but not enforce? Or visa versa?