Configure AppArmor for charon - Futurex Documentation

On Ubuntu and other AppArmor distributions, charon runs under a confinement profile that does not permit reading the Futurex library or configuration from /usr/local/lib/fxpkcs11 and /etc/fxpkcs11. Grant that access before configuring strongSwan.

Skip this section on a distribution that does not use AppArmor. On SELinux, grant charon equivalent access to the same paths instead. This guide does not provide an SELinux policy.

Create the local AppArmor override

Shell

sudo mkdir -p /etc/apparmor.d/local

sudo tee /etc/apparmor.d/local/usr.lib.ipsec.charon > /dev/null << 'EOF'
/usr/local/lib/fxpkcs11/libfxpkcs11.so rm,
/usr/local/lib/fxpkcs11/PKCS11Manager rm,
/etc/fxpkcs11.cfg r,
/etc/fxpkcs11/ r,
/etc/fxpkcs11/* r,
/etc/fxpkcs11.log rw,
/etc/fxpkcs11.log* rw,
/tmp/fxpkcs11.log rw,
/tmp/fxpkcs11.log* rw,
/var/log/charon-debug.log rw,
EOF

The file may already exist and be empty. An empty override parses cleanly and reloads without error, yet charon is still denied. Confirm the file has content before continuing.

Shell

sudo wc -l /etc/apparmor.d/local/usr.lib.ipsec.charon

The count is 10, matching the rules above. If it reports 0, the tee command did not write; re-run it.

Reload the profile

Shell

sudo apparmor_parser -r /etc/apparmor.d/usr.lib.ipsec.charon

Verify AppArmor is no longer denying charon

This verification matters. If the override is missing or incomplete, nothing fails here — the problem surfaces several steps later as load-token reply {success=no} with no mention of AppArmor.

Shell

sudo systemctl restart strongswan-starter
sleep 5
sudo dmesg | grep -i 'apparmor.*DENIED' | tail -20

The command returns no output, or no entries whose profile= names charon and whose name= points at a Futurex path. Any such line names the exact path that is still blocked — add it to the override and reload.

If dmesg requires elevated access or returns nothing on your system, check the audit log instead:

Shell

sudo grep -i 'apparmor.*DENIED' /var/log/syslog /var/log/audit/audit.log 2>/dev/null | tail -20

​Create the local AppArmor override

​Reload the profile

​Verify AppArmor is no longer denying charon

Create the local AppArmor override

Reload the profile

Verify AppArmor is no longer denying charon