[BUG] Can't use Google-Chrome anymore after the hardening was done

[madiba237]

Describe the bug
Google chrome worked just fine before the hardening, after it impossible to launch it no matter the user (root...)

To Reproduce
launching google-chrome from the terminal result to this message showing up 👍
/usr/bin/google-chrome: error while loading shared libraries: libdl.so.2: cannot open shared object file: Permission denied

Expected behavior

google-chrome browser should be launched .

System (lsb_release -a):

Distributor ID: Ubuntu
Description: Ubuntu 24.04.1 LTS
Release: 24.04
Codename: noble

Additional context
Add any other context about the problem here.

After stoping and disabeling apparmor.service it still doesn't work

[konstruktoid]

Hi @madiba237 , I have not in any way tested the script on a client running graphical applications.

Can you attach some relevant journal logs as well?

[madiba237]

sorry for the late reply i was overwhelmed by other projects here are lines in my logs that concern google chrome

2024-11-26T15:21:55.301915+01:00 PA-UBUNTU gnome-shell[20638]: Error fetching user unit for own pid: 3
2024-11-26T15:21:55.357382+01:00 PA-UBUNTU google-chrome.desktop[22394]: /usr/bin/google-chrome-stable: error while loading shared libraries: libdl.so.2: cannot open shared object file: Permission denied

Great thanks for the endeavors

[konstruktoid]

no worries, but those log messages was included in you issue as well.
does any logs indicate it's an apparmor issue`? what other relevant logs are there?

what does ls -l /usr/lib/x86_64-linux-gnu/libdl.so.2 return?

since the script is one-shot, have you tried re-installing Chrome?

[madiba237]

Greeting ,
sadly i do not have the VM no more so i won't provide those logs , but i can assure you the issue comes from app armor

[konstruktoid]

After stoping and disabeling apparmor.service it still doesn't work

i can assure you the issue comes from app armor

Could you then list the AppArmor profiles in use?

[madiba237]

here are some google-chrome logs

2024-11-27T13:12:54.925568+01:00 ADM-LAT-171 google-chrome.desktop[30893]: [30885:30910:1127/131254.925529:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission non accordée (13)
2024-11-27T13:12:54.925621+01:00 ADM-LAT-171 google-chrome.desktop[30893]: [30885:30911:1127/131254.925580:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission non accordée (13)
2024-11-27T13:12:54.925687+01:00 ADM-LAT-171 google-chrome.desktop[30893]: [30885:30911:1127/131254.925642:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission non accordée (13)
2024-11-27T13:12:54.925756+01:00 ADM-LAT-171 google-chrome.desktop[30893]: [30885:30910:1127/131254.925704:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission non accordée (13)
2024-11-27T13:12:54.925788+01:00 ADM-LAT-171 google-chrome.desktop[30893]: [30885:30910:1127/131254.925755:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission non accordée (13)
2024-11-27T13:12:54.925861+01:00 ADM-LAT-171 google-chrome.desktop[30893]: [30885:30910:1127/131254.925822:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission non accordée (13)
2024-11-27T13:12:54.925924+01:00 ADM-LAT-171 google-chrome.desktop[30893]: [30885:30910:1127/131254.925868:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission non accordée (13)
2024-11-27T13:12:54.926021+01:00 ADM-LAT-171 google-chrome.desktop[30893]: [30885:30910:1127/131254.925907:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission non accordée (13)
2024-11-27T13:12:54.926035+01:00 ADM-LAT-171 google-chrome.desktop[30893]: [30885:30910:1127/131254.925962:ERROR:address_tracker_linux.cc(452)] Failed to recv from netlink socket: Permission non accordée (13)

[konstruktoid]

Try running sudo aa-complain chrome.
To update the profile afterwards, run aa-logprof and then enforce the profile again.

[madiba237]

Hi @konstruktoid i was able to launch chrome , after running the commands you suggested , i am going for further investigations
i need to allow regular users to launch chrome too
Thx