1 Distro_debian

Steve Beattie edited this page 2017-11-07 11:26:27 -08:00

Table of Contents

• In Stock Debian
• Experimental AppArmor on Debian Jessie amd64
• Kernel
• Obtaining
• Building
• Installing
• Checking
• Tools
• Checking
• Tuning logs

In Stock Debian

AppArmor should be available out of the box in the latest Debian distros. Please see http://wiki.debian.org/AppArmor

To enable the AppArmor in the Debian kernel, add “security=apparmor” to the kernel parameters, like this:

 sed -i -e 's/GRUB_CMDLINE_LINUX_DEFAULT="/&security=apparmor /' /etc/default/grub

This sed command results in the following /etc/default/grub line on my system:

 GRUB_CMDLINE_LINUX_DEFAULT=“security=apparmor quiet”

Then run

 update-grub

Experimental AppArmor on Debian Jessie amd64

Kernel

Obtaining

 mkdir -p ~/apparmor/ && cd ~/apparmor/
 wget https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.10.2.tar.xz
 tar -xJf linux-3.10.2.tar.xz
 cd linux-3.10.2/

Building

 cd ~/apparmor/linux-3.10.2/

See if we can reuse the existing kernel configuration (CONFIG_IKCONFIG=y, CONFIG_IKCONFIG_PROC=y):

 cp /proc/config.gz ./ && gzip -d config.gz

Tweak the kernel, enable AppArmor:

 apt-get install libncurses-dev
 make menuconfig

“Security options” ---> “AppArmor support”, “Enable AppArmor 2.4 compatability”

Installing

 aptitude install dpkg-dev bc
 cd ~/apparmor/linux-3.10.2/
 make deb-pkg
 dpkg -i ../linux-firmware-image_{version}.deb
 dpkg -i ../linux-headers-{version}.deb
 dpkg -i ../linux-image-{version}.deb

If the kernel is installed on another host, then symlinks for DKMS should be fixed.

 rm /lib/modules/{version}/build; ln -s /usr/src/linux-headers-{version} /lib/modules/{version}/build
 rm /lib/modules/{version}/source; ln -s /usr/src/linux-headers-{version} /lib/modules/{version}/source

About dpkg -i ../linux-libc-{version}.deb: /usr/include/x86_64-linux-gnu/asm seems to be missing from latest linux-libc-{version}.deb. If you installed linux-libc-{version}.deb, you can downgrade to Debian version with aptitude install linux-libc-dev=3.0.0-3.

Finally:

 update-grub

Checking

Reboot under new kernel:

 /sbin/shutdown -r now

or

 reboot

Now see if AppArmor is loaded and enabled (should print “Y”):

 cat /sys/module/apparmor/parameters/enabled

Tools

 aptitude install apparmor apparmor-profiles
 /etc/init.d/apparmor restart

Checking

 cat /var/log/audit/audit.log | grep apparmor_parser

should display something like

 type=AVC msg=audit(1316949034.097:108): apparmor=“STATUS” operation=“profile_load” name=“/bin/ping” pid=5207 comm=“apparmor_parser”

Tuning logs

Audit data by default is dropped into /var/log/messages via rsyslogd. That way, the data is severely capped by the kernel in order not to overload the messages log. To make audit data usable with AppArmor we should install auditd and tune it to keep large amounts of data:

 apt-get install auditd
 sed -i -re 's/max_log_file = [0-9]+/max_log_file = 200/' /etc/audit/auditd.conf
 /etc/init.d/auditd restart