Failed to set custom path to swanctl.conf

[sam-ans]

Hi everyone, I'm trying to set custom path to swanctl.conf :

$ uname -a
Linux deb10 4.19.0-22-amd64 #1 SMP Debian 4.19.260-1 (2022-09-29) x86_64 GNU/Linux

$ sudo swanctl --version
strongSwan swanctl 5.9.9

$ sudo swanctl --load-all
loaded ike secret 'ike-1'
loaded ike secret 'ike-2'
no authorities found, 0 unloaded
no pools found, 0 unloaded
loaded connection 'ciscoios'
successfully loaded 1 connections, 0 unloaded

$ sudo cp /etc/swanctl/swanctl.conf /tmp

$ sudo swanctl --load-all --file /tmp/swanctl.conf 
failed to open config file '/tmp/swanctl.conf'
...
no authorities found, 0 unloaded
no pools found, 0 unloaded
no connections found, 1 unloaded

What is wrong?

[tobiasbrunner]

Check the file actually exists and the permissions are OK (could be some LSM interfering).

[sam-ans]

The permissions are OK, but it is failed to load the file from /tmp/, /home/, etc. :

~$ ls -lh /tmp/swanctl.conf 
-rw-r--r-- 1 root root 917 Jul  4 07:30 /tmp/swanctl.conf

$ sudo swanctl --load-all --file /tmp/swanctl.conf 
failed to open config file '/tmp/swanctl.conf'
...
no authorities found, 0 unloaded
no pools found, 0 unloaded
no connections found, 0 unloaded

$ sudo swanctl --list-conns
$

$ sudo chmod 777 /tmp/swanctl.conf 
vmas@deb10:~$ ls -lh /tmp/swanctl.conf 
-rwxrwxrwx 1 root root 917 Jul  4 07:30 /tmp/swanctl.conf

$ sudo swanctl --load-all --file /tmp/swanctl.conf 
failed to open config file '/tmp/swanctl.conf'
...
no authorities found, 0 unloaded
no pools found, 0 unloaded
no connections found, 0 unloaded

The same file is loaded successfully from /etc/swanctl :

$ sudo cp /tmp/swanctl.conf /etc/swanctl/
$ ls -lh /etc/swanctl/swanctl.conf
-rw-r--r-- 1 root root 917 Jul  4 07:29 /etc/swanctl/swanctl.conf

$ sudo swanctl --load-all --file /etc/swanctl/swanctl.conf
loaded ike secret 'ike-1'
loaded ike secret 'ike-2'
no authorities found, 0 unloaded
no pools found, 0 unloaded
loaded connection 'test1'
successfully loaded 1 connections, 0 unloaded

$ sudo swanctl --list-conns
test1: IKEv1, reauthentication every 10800s
  local:  172.16.10.2
  remote: 172.16.10.1
  local pre-shared key authentication:
    id: 172.16.10.2
  remote pre-shared key authentication:
    id: 172.16.10.1
  test1: TUNNEL, rekeying every 5400s or 500000000 bytes or 1000000 packets
    local:  192.168.2.0/24
    remote: 192.168.1.0/24

[tobiasbrunner]

Again, it could be an LSM (SELinux or AppArmor) that only allows swanctl to read from /etc/swanctl.

[sam-ans]

Based on tobiasbrunner answer, I updated swanctl AppArmor profile (/etc/apparmor.d/usr.sbin.swanctl).
This fixed the issue
Thank you very much

[gowdamanil]

Thanks @sam-ans , had same issue, got resolved by updating the AppArmor file.
Another thing I wanted to note here is, after updating the /etc/apparmor.d/usr.sbin.swanctl.
Restart the service using the command sudo service appamor reload
Then start the ipsec connection.
Left this here because I was stuck at this and this could help someone.

[tobiasbrunner]

You both might consider not changing that file directly (as it's provided by the distro), but add an override in /etc/apparmor.d/local/.

[gowdamanil]

Yes, thanks @tobiasbrunner it worked.