Running on Ubuntu 24.04.3 Desktop, permission denied when executing the standard installed GNOME apps like nautilus

[benj-ntu]

Ran the Ubuntu 24.04 hardening script on an Ubuntu Desktop 24.04 signage player. Executed and ran as root as the script requires. Everything seemed successful.

However, after booting up the machine and logging in, I am not able to use the GUI to open the nautilus file manager application.

I also cannot launch it via terminal either, I get the following error:

nautilus: error while loading shared libraries: libnautilus-extension.so.4: cannot open shared object file: Permission denied

I also tried to run this on another system, and some of the other applications I had already installed just became unusable and broke. So, it doesn't seem to just affect this application specifically.

Can you clarify how far this hardening goes, what specifically could be causing this, and potentially add more flexibility as to the level of this hardening so that existing system(s) and apps installed will not break?

I would really like to use this script but every single time I have ran it it's broken my existing Ubuntu Desktop instances. I can see the potential and use case for something like this but I cannot use it on my instances if they break straight out of the box, ideally it should be a bit more flexible.

Many thanks for your time.

[benj-ntu]

1. No Desktop Detection
   The script has no logic to detect desktop environments:

Only checks Ubuntu version and container status
MISSING: if systemctl is-active gdm || systemctl is-active lightdm; then

2. Installs Extra Profiles Without Testing
   Starting line 589:

"apparmor-profiles"        # Standard profiles
"apparmor-profiles-extra"  # Experimental profiles - NOT READY FOR ENFORCE

Then immediately enforces them all without testing.

From the Ubuntu documentation:
https://documentation.ubuntu.com/server/how-to/security/apparmor/

Some even more experimental profiles carried by the package are placed in /usr/share/doc/apparmor-profiles/extras/. These profiles are not considered mature enough to be shipped in enforce mode by default. Therefore, they are shipped in complain mode.

[gensecai-dev]

Hi @benj-ntu

Thank you for taking the time to report this issue with such detail. You've highlighted a significant oversight in how the script handles desktop environments, and we appreciate you bringing this to our attention.

You're absolutely right , the current implementation doesn't distinguish between server and desktop systems, which leads to the exact breakage you experienced. After investigating, we've identified the root cause and as you correctly noted, Ubuntu's documentation explicitly warns that these profiles aren't mature enough for enforce mode. This is what's breaking nautilus and other GNOME applications.

Additional Issues We Found:

While investigating your report, we discovered several similar concerns that could affect desktop users:

• Experimental snap confinement settings that may restrict desktop apps
• Overly restrictive ProtectHome settings on certain services
• SSH password authentication disabled without verifying SSH keys exist (potential lockout risk)
• No desktop environment detection whatsoever

Planned Fixes:

1. Add proper desktop environment detection ($DISPLAY, $XDG_CURRENT_DESKTOP)
2. Skip or selectively apply experimental AppArmor profiles
3. Implement configurable hardening levels (minimal/moderate/strict) as you suggested
4. Add appropriate warnings and safeguards for desktop systems

We should have anticipated that users would run this on desktop systems. We'll work on a fix that respects the different requirements of desktop vs. server environments.

Thank you again for the thorough report , it's helping us make this tool safer for everyone.