· about 30 minutes · runs on ubuntu-26.04 · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
notes is a small internal web app on port 8080. When someone starts it by hand it
sometimes comes up — and a few minutes later it is gone again. After a reboot it never comes back
at all. Colleagues opening http://<server>:8080/ get an old page that says the service was
retired, or nothing.
The app runs as the notes user. Its notes live in /srv/notes. The server runs AppArmor, and
security wants it to stay that way.
What is expected, and graded:
You have root through sudo. Everything must still hold after a reboot.
The machine is checked, rebooted, and checked again. A check passes only if it passes both times.
| Check | Objective |
|---|---|
| 01_notes_active_and_enabled | Keep a systemd service running across crashes and reboots |
| 02_notes_restarts_on_failure | Keep a systemd service running across crashes and reboots |
| 03_notes_serves_its_notes | Diagnose a failing service from its logs: permissions and port conflicts |
| 04_data_access_confined | Fix an AppArmor denial without weakening AppArmor |
| 05_profile_still_enforced | Fix an AppArmor denial without weakening AppArmor |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
man 1 journalctlman 5 systemd.serviceman 8 ssman 7 apparmorman 8 aa-status4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
What does `Restart=on-failure` do?
Restarts the service when it exits with a failure status, is killed by a signal, or times out
on-failure covers unclean exits; Restart=always also restarts after a clean exit. A manual systemctl stop never triggers a restart.
man 5 systemd.service
Why add Restart= in a drop-in instead of editing the unit in /usr/lib/systemd/system?
Package updates overwrite vendor unit files; drop-ins in /etc survive them
/etc/systemd/system/<unit>.d/*.conf is read on top of the vendor file. systemctl edit creates one.
man 5 systemd.unit (Drop-in)
Where do you find AppArmor denials on an Ubuntu system?
In the kernel log — lines containing apparmor="DENIED"
Denials are audit messages from the kernel: journalctl -k, dmesg, or the audit log when auditd runs. /etc/apparmor.d holds the profiles, not the log.
https://ubuntu.com/server/docs/how-to/security/apparmor/ · man 7 apparmor