3 Users in AppArmor

John Johansen edited this page 2020-12-31 03:42:43 +00:00

Table of Contents

• WARNING this document is a WIP
• Related Articles
• Introduction
• User defined policy
• pam_apparmor

WARNING this document is a WIP

Related Articles

• Types of Policy
  • Strict Policy
  • Targeted Policy
  • Role based Access control (RBAC)
  • Multi-category security (MLS)
  • Multi-level security (MCS)
• Policy building blocks
  • policy namespaces
  • policy stacking
  • Delegation of Authority
  • pam_apparmor

Introduction

Unlike some other security systems, AppArmor does not define its own types of users. Instead AppArmor uses system defined users information and it apparmor policy variables to define relevant user types and groupings.

Eg. to define a user_u and system_u similar to what selinux does

@{user_u}=fred george wilma
@{system_y}=barney

these variables can then be used in policy to determine what a user can do

User defined policy

AppArmor allows for users to define and load policy to confine applications run by the user.

users policy namespaces can be restricted by the admin

user policy is unloaded when the last reference is dropped (usually tasks but could also be shared files).

pam_apparmor

pam_apparmor is a pam plug-in that is required for some user based features to function correctly. ...

this just provides an overview see pam_apparmor documentation

session variables @{HOME} - variable

• option for setting up roles

what of setting up user policy namespace

• setup namespace OR auto if allowed by ns policy?
• option for loading
  • could also be done by using .bashrc or .profile