我正在尝试在 Ubuntu 23.04 上设置 Strongswan / IKEV2 VPN。我已经编译并运行了网络管理器插件。
当我尝试连接时，我在系统日志中收到以下错误，即无法打开证书包。
根据日志，Apparmor 似乎阻止了访问。
我该如何修复它以便 Apparmor 允许访问该文件？
2023-10-12T22:07:00.546588-04:00 fafnir charon: 10[CFG] received stroke: add connection '3c204271-9b89-4f25-85b8-3e13d53e6bde'
2023-10-12T22:07:00.546660-04:00 fafnir charon: 10[CFG] added configuration '3c204271-9b89-4f25-85b8-3e13d53e6bde'
2023-10-12T22:07:01.492277-04:00 fafnir charon: 12[CFG] rereading secrets
2023-10-12T22:07:01.492891-04:00 fafnir charon: 12[CFG] loading secrets from '/etc/ipsec.secrets'
2023-10-12T22:07:01.492904-04:00 fafnir charon: 12[CFG] loading secrets from '/etc/ipsec.d/ipsec.nm-l2tp.secrets'
2023-10-12T22:07:01.492915-04:00 fafnir charon: 12[LIB] opening '/home/alan/pki2/client_fafnir.p12' failed: Permission denied
2023-10-12T22:07:01.492949-04:00 fafnir charon: 12[LIB] building CRED_CONTAINER - PKCS12 failed, tried 3 builders
2023-10-12T22:07:01.492960-04:00 fafnir charon: 12[CFG] loading credentials from '/home/alan/pki2/client_fafnir.p12' failed
2023-10-12T22:07:01.495808-04:00 fafnir charon: 13[CFG] received stroke: initiate '3c204271-9b89-4f25-85b8-3e13d53e6bde'
2023-10-12T22:07:01.496243-04:00 fafnir kernel: [217471.389372] audit: type=1400 audit(1697162821.489:404): apparmor="DENIED" operation="open" class="file" profile="/usr/lib/ipsec/charon" name="/home/alan/pki2/client_fafnir.p12" pid=913258 comm="charon" requested_mask="r" denied_mask="r" fsuid=0 ouid=1000
答案1
将证书包复制到 /etc/ipsec.d/certs 并解决权限问题。