AppArmor Denial Hunting

Find a silent AppArmor denial that makes a service fail without any error in its log.

A advanced Linux challenge worth 20 points. Solve it hands-on in a real Linux environment in your browser - no local setup, no fake shells.

The Challenge

A newly deployed service fails silently. File permissions look correct. This is a MAC denial, not a DAC permission error.

Your tasks:

• Find denials in the pre-generated log: grep "DENIED" /var/log/apparmor-denials.log
• Identify the denied path and operation from the log lines
• Write the correct AppArmor rule to /etc/apparmor.d/usr.bin.myservice.d/extra.rules

Format: /denied/path/here rw,

• Reload: apparmor_parser -r /etc/apparmor.d/usr.bin.myservice 2>/dev/null || true
• Write the denied path + rule added to /tmp/apparmor_fix.txt
• Run check to validate