Public bug reported:
Because of the AppArmor profile, tshark can't load Wireshark's user
preferences stored in the home directory. This affects dissection of
certain protocols, such as ESP SAs stored in the separate preference
file.
Output of tshark --version:
$ LANG=C tshark --version
tshark: Error loading table 'MaxMind Database Paths': Permission denied
tshark: Error loading table 'ESP SAs': Permission denied
tshark: Error loading table 'PDCP UE security keys': Permission denied
tshark: Error loading table 'User DLTs Table': Permission denied
tshark: Can't open your preferences file
"/home/psj/.config/wireshark/preferences": Permission denied.
tshark: Could not open your disabled protocols file
"/home/psj/.config/wireshark/disabled_protos": Permission denied.
tshark: Could not open your enabled protocols file
"/home/psj/.config/wireshark/enabled_protos": Permission denied.
tshark: Could not open your heuristic dissectors file
"/home/psj/.config/wireshark/heuristic_protos": Permission denied.
TShark (Wireshark) 4.4.7.
Output of tshark -G plugins:
$ LANG=C tshark -G plugins
tshark: Can't open your preferences file
"/home/psj/.config/wireshark/preferences": Permission denied.
Related dmesg while running these commands:
[48580.665509] audit: type=1400 audit(1763857088.075:47428): apparmor="DENIED"
operation="open" class="file" profile="tshark"
name="/home/psj/.local/lib/wireshark/plugins/" pid=240350 comm="tshark"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
[48580.746454] audit: type=1400 audit(1763857088.156:47429): apparmor="DENIED"
operation="open" class="file" profile="tshark"
name="/home/psj/.config/wireshark/extcap.cfg" pid=240350 comm="tshark"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
[48580.746461] audit: type=1400 audit(1763857088.156:47430): apparmor="DENIED"
operation="open" class="file" profile="tshark"
name="/home/psj/.config/wireshark/preferences" pid=240350 comm="tshark"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
[48586.609309] audit: type=1400 audit(1763857094.019:47431): apparmor="DENIED"
operation="open" class="file" profile="tshark"
name="/home/psj/.local/lib/wireshark/plugins/" pid=240393 comm="tshark"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
[48586.689766] audit: type=1400 audit(1763857094.099:47432): apparmor="DENIED"
operation="open" class="file" profile="tshark"
name="/home/psj/.config/wireshark/extcap.cfg" pid=240393 comm="tshark"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
[48586.689772] audit: type=1400 audit(1763857094.099:47433): apparmor="DENIED"
operation="open" class="file" profile="tshark"
name="/home/psj/.config/wireshark/preferences" pid=240393 comm="tshark"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Workaround is adding the following lines in the /etc/apparmor.d/tshark file:
owner @{HOME}/.config/wireshark/ r,
owner @{HOME}/.config/wireshark/* r,
owner @{HOME}/.config/wireshark/profiles/* r,
owner @{HOME}/.local/lib/wireshark/plugins/ r,
owner @{HOME}/.local/lib/wireshark/plugins/* r,
These locations are documented in the Wireshark manual:
*
https://www.wireshark.org/docs/wsug_html_chunked/ChConfigurationPluginFolders.html
*
https://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html
* https://www.wireshark.org/docs/wsug_html_chunked/ChPluginFolders.html
After adding these lines in the AppArmor profile, the tshark --version
command does not complain about the denied permission.
System information:
$ lsb_release -rd
Description: Ubuntu 25.10
Release: 25.10
$ LANG=C apt-cache policy apparmor # (the profile is provided by the apparmor
package)
apparmor:
Installed: 5.0.0~alpha1-0ubuntu8.1
Candidate: 5.0.0~alpha1-0ubuntu8.1
Version table:
*** 5.0.0~alpha1-0ubuntu8.1 500
500 http://de.archive.ubuntu.com/ubuntu questing-updates/main amd64v3
Packages
100 /var/lib/dpkg/status
5.0.0~alpha1-0ubuntu8 500
500 http://de.archive.ubuntu.com/ubuntu questing/main amd64v3 Packages
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2132234
Title:
tshark AppArmor profile restricts reading user configuration and
plugins
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2132234/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
