AppArmor

AppArmor - это реализация Модуля безопасности линукс по управлению доступом на основе имен. AppArmor ограничивает отдельные программы набором перечисленных файлов и возможностями в соответствии с правилами posix 1003.1e.

AppArmor устанавливается и загружается по умолчанию. Он использует профили приложений для определения какие файлы и права доступа требуются приложению. Некоторые пакеты устанавливают свои собственные профили, а дополнительные профили можно найти в пакете apparmor-profiles.

Для установки пакета apparmor-profiles наберите в терминале:

sudo apt-get install apparmor-profiles

Профили AppArmor имеют два режима выполнения:

1. Фиксации/Обучения: нарушения профиля разрешаются и сохраняются в журнале. Полезно для тестирования и разработки новых профилей

2. Предписаний/Ограничений: принуждает следовать политике профиля, при этом также записывает нарушения в журнал.

The apparmor-utils package contains command line utilities that you can use to change the AppArmor execution mode, find the status of a profile, create new profiles, etc.

  apparmor_status is used to view the current status of AppArmor profiles.

  sudo apparmor_status

  aa-complain places a profile into complain mode.

  sudo aa-complain /path/to/bin

  aa-enforce places a profile into enforce mode.

  sudo aa-enforce /path/to/bin

  The /etc/apparmor.d directory is where the AppArmor profiles are located. It can be used to manipulate the mode of all profiles.

  Enter the following to place all profiles into complain mode:

  sudo aa-complain /etc/apparmor.d/*

  To place all profiles in enforce mode:

  sudo aa-enforce /etc/apparmor.d/*

  apparmor_parser is used to load a profile into the kernel. It can also be used to reload a currently loaded profile using the -r option. To load a profile:

  cat /etc/apparmor.d/profile.name | sudo apparmor_parser -a

  To reload a profile:

  cat /etc/apparmor.d/profile.name | sudo apparmor_parser -r

  /etc/init.d/apparmor can be used to reload all profiles:

  sudo /etc/init.d/apparmor reload

  The /etc/apparmor.d/disable directory can be used along with the apparmor_parser -R option to disable a profile.

  sudo ln -s /etc/apparmor.d/profile.name /etc/apparmor.d/disable/
  sudo apparmor_parser -R /etc/apparmor.d/profile.name

  To re-enable a disabled profile remove the symbolic link to the profile in /etc/apparmor.d/disable/. Then load the profile using the -a option.

  sudo rm /etc/apparmor.d/disable/profile.name
  cat /etc/apparmor.d/profile.name | sudo apparmor_parser -a

  AppArmor can be disabled, and the kernel module unloaded by entering the following:

  sudo /etc/init.d/apparmor stop
  sudo update-rc.d -f apparmor remove

  To re-enable AppArmor enter:

  sudo /etc/init.d/apparmor start
  sudo update-rc.d apparmor defaults

Replace profile.name with the name of the profile you want to manipulate. Also, replace /path/to/bin/ with the actual executable file path. For example for the ping command use /bin/ping

AppArmor profiles are simple text files located in /etc/apparmor.d/. The files are named after the full path to the executable they profile replacing the «/» with «.». For example /etc/apparmor.d/bin.ping is the AppArmor profile for the /bin/ping command.

There are two main type of rules used in profiles:

  Path entries: which detail which files an application can access in the file system.

  Capability entries: determine what privileges a confined process is allowed to use.

As an example take a look at /etc/apparmor.d/bin.ping:

#include <tunables/global> /bin/ping flags=(complain) {

#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/nameservice>

capability net_raw,
capability setuid,
network inet raw,

/bin/ping mixr,
/etc/modules.conf r,

}

  #include <tunables/global>: include statements from other files. This allows statements pertaining to multiple applications to be placed in a common file.

  /bin/ping flags=(complain): path to the profiled program, also setting the mode to complain.

  capability net_raw,: allows the application access to the CAP_NET_RAW Posix.1e capability.

  /bin/ping mixr,: allows the application read and execute access to the file.

After editing a profile file the profile must be reloaded. See Using AppArmor for details.

  Design a test plan: Try to think about how the application should be exercised. The test plan should be divided into small test cases. Each test case should have a small description and list the steps to follow.

  Some standard test cases are:

      Starting the program.

      Stopping the program.

      Reloading the program.

      Testing all the commands supported by the init script.

  Generate the new profile: Use aa-genprof to generate a new profile. From a terminal:

  sudo aa-genprof executable

  For example:

  sudo aa-genprof slapd

  To get your new profile included in the apparmor-profiles package, file a bug in Launchpad against the AppArmor package:

      Include your test plan and test cases.

      Attach your new profile to the bug.

When the program is misbehaving, audit messages are sent to the log files. The program aa-logprof can be used to scan log files for AppArmor audit messages, review them and update the profiles. From a terminal:

sudo aa-logprof

  See the AppArmor Administration Guide for advanced configuration options.

  For details using AppArmor with other Ubuntu releases see the AppArmor Community Wiki page.

  The OpenSUSE AppArmor page is another introduction to AppArmor.

  A great place to ask for AppArmor assistance, and get involved with the Ubuntu Server community, is the #ubuntu-server IRC channel on freenode.