apparmor="DENIED" operation="file_inherit" profile="/usr/sbin/swanctl" name="/dev/net/tun" pid=490601 comm="swanctl" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

[Philipp Dreimann]

The swanctl apparmor profile leads to the following deny:

apparmor="DENIED" operation="file_inherit" profile="/usr/sbin/swanctl" name="/dev/net/tun" pid=490601 comm="swanctl" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

I'm using charon-systemd instead of strongswan-starter.

$ dpkg -l|grep "strongswan\|charon"
ii charon-systemd 5.8.2-1ubuntu3 amd64 strongSwan IPsec client, systemd support
ii libcharon-extauth-plugins 5.8.2-1ubuntu3 amd64 strongSwan charon library (extended authentication plugins)
ii libcharon-extra-plugins 5.8.2-1ubuntu3 amd64 strongSwan charon library (extra plugins)
ii libcharon-standard-plugins 5.8.2-1ubuntu3 all transitional package
ii libstrongswan 5.8.2-1ubuntu3 amd64 strongSwan utility and crypto library
ii libstrongswan-extra-plugins 5.8.2-1ubuntu3 amd64 strongSwan utility and crypto library (extra plugins)
ii strongswan 5.8.2-1ubuntu3 all IPsec VPN solution metapackage
ii strongswan-charon 5.8.2-1ubuntu3 amd64 strongSwan Internet Key Exchange daemon
ii strongswan-libcharon 5.8.2-1ubuntu3 amd64 strongSwan charon library
ii strongswan-pki 5.8.2-1ubuntu3 amd64 strongSwan IPsec client, pki command
ii strongswan-starter 5.8.2-1ubuntu3 amd64 strongSwan daemon starter and configuration file parser
ii strongswan-swanctl 5.8.2-1ubuntu3 amd64 strongSwan IPsec client, swanctl command

[Simon Déziel (sdeziel)]

I suspect you using kernel-libipsec which would explain why you are running into this, right? Could you please try the following:

cat << EOF | sudo tee -a /etc/apparmor.d/local/usr.sbin.swanctl
  # libcharon-extra-plugins: kernel-libipsec
  /dev/net/tun rw,
EOF
sudo apparmor_parser -rTW /etc/apparmor.d/usr.sbin.swanctl

Then restart strongswan?

If that fixes the problem, I'll submit a pull request. Setting as incomplete until then.

[Philipp Dreimann (philipp-dreimann)]

No, I'm not running kernel-libipsec.

My configured ipsec connections work despite the apparmor deny action.

[Simon Déziel (sdeziel)]

If the libipsec plugin is not loaded then I cannot explain why it would try to use /dev/net/tun so it's hard to make a case of extending the profile.

[Tobias Brunner (tobias-strongswan)]

There are only three components in strongSwan that open TUN devices, charon-xpc (on macOS), the kernel-pfroute plugin (also not on Linux but macOS and *BSD) and kernel-libipsec, as pointed out by Simon. However, swanctl has no business loading kernel plugins (it doesn't by default), as it is no IKE daemon. It just loads configs/credentials and passes them to the daemon via VICI. So no idea where this comes from, unless strongswan.conf or any includes are somehow messed up and swanctl loads that plugin inadvertently.

[Philipp Dreimann (philipp-dreimann)]

# grep -R kernel-libipsec /etc/strongswan.* /etc/swanctl/
/etc/strongswan.d/charon/kernel-libipsec.conf:kernel-libipsec {

The whole file /etc/strongswan.d/charon/kernel-libipsec.conf:
kernel-libipsec {
    load = no
}

Anything else that I could check?

[Tobias Brunner (tobias-strongswan)]

That file is not relevant for swanctl (unless it was manually included, check the main strongswan.conf file). Check the output of `swanctl --help` (lists the plugins), use strace to see when exactly that access happens.

[Lucas Kanashiro (lucaskanashiro)]

Hi Philipp,

Thank you for taking the time to file a bug report.

I was not able to reproduce the issue reported by you using the default configuration provided by the packages. Could you please provide your configuration files? They should live in:

- /etc/strongswan.d/
- /etc/swanctl/
- /etc/strongswan.conf
- /etc/ipsec.conf

You can also use dpkg to help you identify the modified files:

$ sudo dpkg --verify charon-systemd libcharon-extauth-plugins libcharon-extra-plugins libstrongswan strongswan-charon strongswan-libcharon strongswan-pki strongswan-starter strongswan-swanctl

Since there is not enough information in your report to begin triage or to
differentiate between a local configuration problem and a bug in Ubuntu, I
am marking this bug as "Incomplete". We would be grateful if you would:
provide a more complete description of the problem, explain why you
believe this is a bug in Ubuntu rather than a problem specific to your
system, and then change the bug status back to "New".

For local configuration issues, you can find assistance here:
http://www.ubuntu.com/support/community

[Launchpad Janitor (janitor)]

[Expired for strongswan (Ubuntu) because there has been no activity for 60 days.]