mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 16:35:02 +01:00
ac53d2c30e
files (they should be included with the relavent individual packages). Made package build in new novell forge environment.
154 lines
5.5 KiB
Text
154 lines
5.5 KiB
Text
# $Id$
|
|
# This publication is intellectual property of Novell Inc. Its contents
|
|
# can be duplicated, either in part or in whole, provided that a copyright
|
|
# label is visibly located on each copy.
|
|
#
|
|
# All information found in this book has been compiled with utmost
|
|
# attention to detail. However, this does not guarantee complete accuracy.
|
|
# Neither SUSE LINUX GmbH, the authors, nor the translators shall be held
|
|
# liable for possible errors or the consequences thereof.
|
|
#
|
|
# Many of the software and hardware descriptions cited in this book
|
|
# are registered trademarks. All trade names are subject to copyright
|
|
# restrictions and may be registered trade marks. SUSE LINUX GmbH
|
|
# essentially adheres to the manufacturer's spelling.
|
|
#
|
|
# Names of products and trademarks appearing in this book (with or without
|
|
# specific notation) are likewise subject to trademark and trade protection
|
|
# laws and may thus fall under copyright restrictions.
|
|
#
|
|
# Please direct suggestions and comments to apparmor-general@forge.novell.com.
|
|
|
|
|
|
=pod
|
|
|
|
=head1 NAME
|
|
|
|
AppArmor kernel enhancement to confine programs to a limited set of resources.
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
AppArmor is a kernel enhancement to confine programs to a limited set
|
|
of resources. AppArmor's unique security model is to bind access control
|
|
attributes to programs rather than to users.
|
|
|
|
AppArmor confinement is provided via I<profiles> loaded into the kernel
|
|
via apparmor_parser(8), typically through the F</etc/init.d/boot.apparmor>
|
|
SysV initscript, which is used like this:
|
|
|
|
# /etc/init.d/boot.apparmor start
|
|
# /etc/init.d/boot.apparmor stop
|
|
# /etc/init.d/boot.apparmor restart
|
|
# /etc/init.d/boot.apparmor kill
|
|
|
|
AppArmor can operate in two modes: I<enforcement>, and I<complain or learning>:
|
|
|
|
=over 4
|
|
|
|
=item *
|
|
|
|
I<enforcement> - Profiles loaded in enforcement mode will result
|
|
in enforcement of the policy defined in the profile as well as reporting
|
|
policy violation attempts to syslogd.
|
|
|
|
=item *
|
|
|
|
I<complain> - Profiles loaded in C<complain> mode will not enforce policy.
|
|
Instead, it will report policy violation attempts. This mode is convenient for
|
|
developing profiles. To manage complain mode for individual profiles the
|
|
utilities /usr/bin/complain and /usr/bin/enforce can be used.
|
|
These utilities take a program name as an argument.
|
|
|
|
|
|
=back
|
|
|
|
Profiles are traditionally stored in files in F</etc/apparmor.d/>
|
|
under filenames with the convention of replacing the B</> in pathnames
|
|
with B<.> (except for the root B</>) so profiles are easier to manage
|
|
(e.g. the F</usr/sbin/sshd> profile would be named F<usr.sbin.sshd>).
|
|
|
|
Profiles are applied to a process at exec(3) time (as seen through the
|
|
execve(2) system call); an already running process cannot be confined.
|
|
However, once a profile is loaded for a program, that program will be
|
|
confined on the next exec(3).
|
|
|
|
AppArmor supports the Linux kernel's securityfs filesystem, and makes
|
|
available the list of the profiles currently loaded; to mount the
|
|
filesystem:
|
|
|
|
# mount -tsecurityfs securityfs /sys/kernel/security
|
|
$ cat /sys/kernel/security/apparmor/profiles
|
|
/usr/bin/mutt
|
|
/usr/bin/gpg
|
|
...
|
|
|
|
Normally, the initscript will mount securityfs if it has not already
|
|
been done.
|
|
|
|
AppArmor also restricts what privileged operations a confined process
|
|
may execute, even if the process is running as root. A confined process
|
|
cannot call the following system calls:
|
|
|
|
create_module(2) delete_module(2) init_module(2) ioperm(2)
|
|
iopl(2) mount(2) umount(2) ptrace(2) reboot(2) setdomainname(2)
|
|
sethostname(2) swapoff(2) swapon(2) sysctl(2)
|
|
|
|
A confined process can not call mknod(2) to create character or block devices.
|
|
|
|
=head1 ERRORS
|
|
|
|
When a confined process tries to access a file it does not have permission
|
|
to access, the kernel will report a message to klogd, similar to:
|
|
|
|
AppArmor: REJECTING x access to /bin/bash (irssi(2667)
|
|
profile /usr/local/bin/irssi active /usr/local/bin/irssi)
|
|
AppArmor: REJECTING r access to /home/sarnold (mozilla-bin(3029)
|
|
profile /usr/lib/mozilla-1.4/mozilla-bin active
|
|
/usr/lib/mozilla-1.4/mozilla-bin)
|
|
AppArmor: REJECTING rw access to /dev/pts/4 (sh(1721)
|
|
profile /usr/bin/crontab active /usr/bin/crontab)
|
|
|
|
The permissions requested by the process are immediately after
|
|
REJECTING. The "name" and process id of the running program are reported,
|
|
as well as the profile name and any "hat" that may be active. ("Name"
|
|
is in quotes, because the process name is limited to 15 bytes; it is the
|
|
same as reported through the Berkeley process accounting.) If no hat is
|
|
active (see change_hat(2)) then the profile name is printed for "active".
|
|
|
|
For confined processes running under a profile that has been loaded in
|
|
complain mode, enforcement will not take place and the log messages
|
|
reported to klogd will be of the form:
|
|
|
|
AppArmor: PERMITTING r access to /root/.viminfo (vi(1272)
|
|
profile /bin/vim active /bin/vim)
|
|
AppArmor: PERMITTING w access to /root/.viminfo.tmp (vi(1272)
|
|
profile /bin/vim active /bin/vim)
|
|
AppArmor: PERMITTING wl access to /root/.viminfo (vi(1272)
|
|
profile /bin/vim active /bin/vim)
|
|
AppArmor: PERMITTING rwl access to /root/.viminfo.tmp (vi(1272)
|
|
profile /bin/vim active /bin/vim)
|
|
AppArmor: PERMITTING w access to /root/.viminfo (vi(1272)
|
|
profile /bin/vim active /bin/vim)
|
|
|
|
=head1 FILES
|
|
|
|
=over 4
|
|
|
|
=item F</etc/init.d/boot.apparmor>
|
|
|
|
=item F</etc/apparmor.d/>
|
|
|
|
=item F</usr/share/vim/current/syntax/apparmor.vim>
|
|
|
|
=item F</lib/apparmor/>
|
|
|
|
=back
|
|
|
|
=head1 SEE ALSO
|
|
|
|
apparmor_parser(8), change_hat(2), apparmor.d(5),
|
|
subdomain.conf(5), autodep(1), clean(1), apparmor.vim(5),
|
|
unconfined(8), enforce(1), complain(1), and
|
|
L<http://forge.novell.com/modules/xfmod/project/?apparmor>.
|
|
|
|
=cut
|