Novell APPARMOR 1.2 - QUICK GUIDE AND Datasheet

Novell AppArmor
Powered by
Immunix
Installation and
QuickStart Guide
www.novell.com
1.2 09/29/2005

Novell AppArmor Powered by Immunix 1.2 Installation
and QuickStart Guide
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this docu-
mentation, and specically disclaims any express or implied warranties of merchantability or tness
for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to
make changes to its content, at any time, without obligation to notify any person or entity of such re-
visions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and
specically disclaims any express or implied warranties of merchantability or tness for any particular
purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software,
at any time, without any obligation to notify any person or entity of such changes.
You may not use, export, or re-export this product in violation of any applicable laws or regulations
including, without limitation, U.S. export regulations or the laws of the country in which you reside.
Copyright © 2000 - 2004, 2005 Novell, Inc. All rights reserved. No part of this publication may be
reproduced, photocopied, stored on a retrieval system, or transmitted without the express written
consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is
described in this document. In particular, and without limitation, these intellectual property rights
may include one or more of the U.S. patents listed at http://www.novell.com/company/
legal/patents/ and one or more additional patents or pending patent applications in the U.S.
and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the online documentation for this and other Novell products, and
to get updates, see www.novell.com/documentation.
Novell Trademarks
AppArmor is a registered trademark of Novell, Inc. in the United States and other countries.
Immunix is a trademark of Novell, Inc. in the United States and other countries.
Novell is a registered trademark of Novell, Inc. in the United States and other countries.
SUSE is a registered trademark of SUSE LINUX Products GmbH, a Novell business.

Third-Party Materials
All third-party trademarks are the property of their respective owners.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTIC-
ULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSE-
QUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTI-
TUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUP-
TION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CON-
TRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.

Contents
1Introduction to Novell AppArmor 7
2Installing Novell AppArmor 9
3Enabling Novell AppArmor 11
4Getting Started with Proling Applications 13
4.1 Choosing the Applications to Prole . . . . . . . . . . . . . . . . . 13
4.2 Building and Modifying Proles . . . . . . . . . . . . . . . . . . . 14
4.3 Conguring Novell AppArmor Event Notication and Reports . . . . . . 16
4.4 Updating Your Proles . . . . . . . . . . . . . . . . . . . . . . . 18

1
Introduction to Novell AppArmor
Many security vulnerabilities result from bugs in trusted programs. A trusted program
runs with privilege that some attacker would like to have and the program fails to keep
that trust if there is a bug in the program that allows the attacker to acquire that privilege.
Novell AppArmor is an application security solution designed specically to provide
least privilege connement to suspect programs. AppArmor allows the administrator
to specify the domain of activities the program can perform by developing a security
prole for that application—a listing of les that the program may access and the oper-
ations the program may perform.
Effective hardening of a computer system requires minimizing the number of programs
that mediate privilege then securing the programs as much as possible. With Novell
AppArmor, you only need to prole the programs that are exposed to attack in your
environment, which drastically reduces the amount of work required to harden your
computer. AppArmor proles enforce policies to make sure that programs do what they
are supposed to do, but nothing else.
Administrators only need to care about the applications that are vulnerable to attacks
and generate proles for these. Hardening a system thus comes down to building and
maintaining the AppArmor prole set and monitoring any policy violations or exceptions
logged by AppArmor's reporting facility.
Building AppArmor proles to conne an application is very straightforward and intu-
itive. AppArmor ships with several tools that assist in prole creation. AppArmor does
not require you to do any programming or script handling. The only task that is required
from the administrator is to determine a policy of strictest access and execute permissions
for each application that needs to be hardened.
Introduction to Novell AppArmor 7

Updates or modications to the application proles are only required if the software
conguration or the desired range of activities changes. AppArmor offers intuitive tools
to handle prole updates or modications.
Users will not notice AppArmor at all. It runs “behind the scenes” and does not require
any user interaction. Performance will not be affected noticeably by AppArmor. If some
activity of the application is not covered by an AppArmor prole or if some activity
of the application is prevented by AppArmor, the administrator needs to adjust the
prole of this application to cover this kind of behavior.
This guide outlines the basic tasks that need to be performed with AppArmor to effec-
tively harden a system. For more in-depth information, refer to Novell AppArmor
Powered by Immunix 1.2 Administration Guide.
8

2
Installing Novell AppArmor
Users installing either a GNOME or the KDE desktop selection can skip this section,
because Novell® AppArmor is installed by default as part of these selections.
If installing neither of these desktops or even going for en entirely text-based environ-
ment, do the following to install the required packages using the YaST package manager.
1Log in as root and start YaST.
2In the YaST Control Center, select Software →Software Management.
3Use the search functionality of YaST (keywords “AppArmor” and “subdomain”)
to install the following packages:
• subdomain-parser-demo
• subdomain-parser-common
• libimmunix
• libimnxcert
• subdomain-docs
• yast2-subdomain
• subdomain-proles
• subdomain-leaf-cert
• subdomain-utils
Installing Novell AppArmor 9

4Select all these packages for installation then select Accept. YaST resolves any
dependencies and installs all the packages for you.
5After YaST has nished updating the system conguration, select Finish to leave
the package manager.
10

3
Enabling Novell AppArmor
After Novell® AppArmor has been installed, explicitly enable it to make sure that it is
started whenever your system boots. Use the YaST System Services (Runlevel) module
for this task:
1Log in as root and start YaST.
2Start System →System Services (Runlevel).
3In the list of services displayed, select subdomain. See Figure 3.1, “Enabling
Novell AppArmor Using YaST” (page 12).
4Click Enable to enable AppArmor permanently.
5Click Finish to accept your settings.
Enabling Novell AppArmor 11

Figure 3.1 Enabling Novell AppArmor Using YaST
Using the YaST Runlevel tool, you enable services permanently—these settings survive
a reboot of your system. To enable AppArmor temporarily—for the duration of one
session only—proceed as follows:
1Log in as root and start YaST.
2Start Novell AppArmor →AppArmor Control Panel.
3Set the AppArmor Status to AppArmor is enabled by clicking Congure →Enable
→OK.
4Apply your settings with Done.
12

4
Getting Started with Proling
Applications
Prepare a successful deployment of Novell® AppArmor on your system by carefully
considering the following items:
1Determine the applications to prole. Read more on this in Section 4.1,
“Choosing the Applications to Prole” (page 13).
2Build the needed proles as roughly outlined in Section 4.2, “Building and
Modifying Proles” (page 14). Check the results and adjust the proles when
necessary.
3Keep track of what is happening on your system by running AppArmor reports
and dealing with security events. Refer to Section 4.3, “Conguring Novell
AppArmor Event Notication and Reports” (page 16).
4Update your proles whenever your environment changes or you need to react
to security events logged by AppArmor's reporting tool. Refer to Section 4.4,
“Updating Your Proles” (page 18).
4.1 Choosing the Applications to
Prole
You only need to protect the programs that are exposed to attacks in your particular
setup, so only use proles for those applications you really run. Use the following list
to determine the most likely candidates:
Getting Started with Proling Applications 13

Network Agents
Programs (servers and clients) have open network ports and network agents are
server programs that respond to those network ports. User clients (such as mail
clients and Web browsers) also have open network ports and mediate privilege.
Web Applications
CGI Perl scripts, PHP pages, and more complex Web applications can be invoked
through a Web browser.
Cron Jobs
Programs that the cron daemon periodically runs read input from a variety of
sources.
To nd out which processes are currently running with open network ports and might
need a prole to conne them, run unconfined as root.
Example 4.1 Output of unconned
19848 /usr/sbin/cupsd not confined
19887 /usr/sbin/sshd not confined
19947 /usr/lib/postfix/master not confined
29205 /usr/sbin/sshd confined by '/usr/sbin/sshd (enforce)'
Each of the processes in the above example labeled not confined might need a
custom prole to conne it. Those labeled confined by are already protected by
AppArmor.
TIP: For More Information
For more information about choosing the the right applications to prole, refer
to Chapter Selecting Programs to Immunize (↑Novell AppArmor Powered by
Immunix 1.2 Administration Guide).
4.2 Building and Modifying Proles
Novell® AppArmor on SUSE Linux ships with a precongured set of proles for the
most important applications. In addition to that, you can use AppArmor to create your
own proles for a set of applications dened in /etc/apparmor/README
.profiles.
14

There are two ways of managing proles. One is to use the graphical front-end provided
by the YaST Novell AppArmor modules and the other is to use the command line tools
provided by the AppArmor suite itself. Both methods basically work the same way.
Running unconned as described in Section 4.1, “Choosing the Applications to Prole”
(page 13) identies a list of applications that may need a prole to run in a safe mode.
For each application, perform the following steps to create a prole:
1As root, let AppArmor create a rough outline of the application's prole by
running genprof programname
or
running YaST →Novell AppArmor →Add Prole Wizard and specifying the
complete path of the application to prole.
A basic prole is outlined and AppArmor is put into learning mode, which means
that it logs any activity of the program you are executing but does not restrict it,
yet.
2Run the full range of the application's actions to let AppArmor get a very specic
picture of its activities.
3Let AppArmor analyze the log les generated in Step 2 (page 15). Do this either
by running typing Sin genprof
or
clicking Scan system log for AppArmor events in the Add Prole Wizard and
follow the instructions given in the wizard until the prole is completed.
AppArmor scans the logs it recorded during the application's run and asks you
to set the access rights for each event that was logged. Either set them for each
le or use globbing.
4Once all access permissions are set, your prole is set to enforce mode mode.
The prole is applied and AppArmor restricts the application according to the
prole just created.
If you started genprof against an application that had an existing prole that was
in complain mode, this prole will remain in learning mode upon exit of this
Getting Started with Proling Applications 15

learning cycle. For more information on changing the mode of a prole, refer to
Section “Complain or Learning Mode” (Chapter 3, Building Novell AppArmor
Proles, ↑Novell AppArmor Powered by Immunix 1.2 Administration Guide)
and Section “Enforce Mode” (Chapter 3, Building Novell AppArmor Proles,
↑Novell AppArmor Powered by Immunix 1.2 Administration Guide).
Test your prole settings by performing every task you need with the application you
just conned. Normally, the conned program runs smoothly and you do not notice
AppArmor activities at all. However, if you notice certain misbehavior with your appli-
cation, check the system logs and see if AppArmor is too closely constricting your ap-
plication. Find the appropriate logs in /var/log/messages or run dmesg.
Any output resembling the following example hints at AppArmor too closely conning
your application:
SubDomain: REJECTING w access to /var/run/nscd/socket (traceroute(2050) profile
/usr/sbin/traceroute active /usr/sbin/traceroute)
To adjust the prole, run the Add Prole Wizard again as described above and let it
analyze the log messages relating this particular application. Determine the access rights
or restrictions when prompted by YaST.
TIP: For More Information
For more information about prole building and modication, refer to Chap-
ter Building Novell AppArmor Proles (↑Novell AppArmor Powered by Immunix
1.2 Administration Guide).
4.3 Conguring Novell AppArmor
Event Notication and Reports
Set up event notication in Novell® AppArmor so you can review security events.
Event Notication is an Novell AppArmor feature that informs a specied e-mail recip-
ient when systemic Novell AppArmor activity occurs under the chosen severity level.
This feature is currently available via the YaST interface.
To set up event notication in YaST, proceed as follows:
16

1Make sure that a mail server is running on your system to deliver the event noti-
cations.
2Log in as root and start YaST. Then select Novell AppArmor →AppArmor
Control Panel ).
3In Enable Security Event Notication section, select Congure.
4For each record type (Terse,Summary, and Verbose) set a report frequency, enter
the e-mail address to receive the reports and determine the severity of events to
log. If you want to include unknown events in the event reports, check Include
Unknown Severity Events.
NOTE
Unless you are familiar with AppArmor's event categorization, choose to
be notied about events for all security levels.
5Leave this dialog with OK →Finish to apply your settings.
Congure Novell AppArmor reports. Using reports, you can read important Novell
AppArmor security events reported in the log les without manually sifting through
the cumbersome messages only useful to the logprof tool. You can decrease the size
of the report by ltering by date range or program name.
To congure the AppArmor reports, proceed as follows:
1Log in as root and start YaST. Select Novell AppArmor →AppArmor Reports.
2Select the type of report you want to examine or congure from Executive Secu-
rity Summary,Applications Audit, and Security Incident Report.
3Edit the report generation frequency, e-mail address, export format, and the loca-
tion of the reports by selecting Edit and providing the requested data.
4To run a report of the selected type, click Run Now.
5Browse through the archived reports of a given type by selecting View Archive
and specifying the report type.
or
Getting Started with Proling Applications 17

Delete unneeded reports or add new ones.
TIP: For More Information
For more information about conguring event notication in Novell AppArmor,
refer to Section “Setting Up Event Notication” (Chapter 4, Managing Proled
Applications, ↑Novell AppArmor Powered by Immunix 1.2 Administration Guide).
More information about report conguration can be found in Section “Reports”
(Chapter 4, Managing Proled Applications, ↑Novell AppArmor Powered by
Immunix 1.2 Administration Guide).
4.4 Updating Your Proles
Software and system congurations change over time. As a result of that your prole
setup for AppArmor might need some ne-tuning from time to time. AppArmor checks
your system log for policy violations or other AppArmor events and lets you adjust
your prole set accordingly. Any application behavior that is outside of any prole
denition can also be addressed using the Update Prole Wizard.
To update your prole set, proceed as follows:
1Log in as root and start YaST.
2Start Novell AppArmor →Update Prole Wizard.
3Adjust access or execute rights to any resource or for any executable that has
been logged when prompted.
4Leave YaST after you answered all questions. Your changes are applied to the
respective proles.
TIP: For More Information
For more information about updating your proles from the system logs, refer
to Section “Updating Proles from Syslog Entries” (Chapter 3, Building Novell
AppArmor Proles, ↑Novell AppArmor Powered by Immunix 1.2 Administration
Guide).
18