Novell APPARMOR 1.2 Instruction Manual

Novell AppArmor
Powered by
Immunix
Administration
Guide
www.novell.com
1.2 09/29/2005

Novell AppArmor Powered by Immunix 1.2 Administra-
tion Guide
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this docu-
mentation, and specically disclaims any express or implied warranties of merchantability or tness
for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to
make changes to its content, at any time, without obligation to notify any person or entity of such re-
visions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and
specically disclaims any express or implied warranties of merchantability or tness for any particular
purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software,
at any time, without any obligation to notify any person or entity of such changes.
You may not use, export, or re-export this product in violation of any applicable laws or regulations
including, without limitation, U.S. export regulations or the laws of the country in which you reside.
Copyright © 2000 - 2004, 2005 Novell, Inc. All rights reserved. No part of this publication may be
reproduced, photocopied, stored on a retrieval system, or transmitted without the express written
consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is
described in this document. In particular, and without limitation, these intellectual property rights
may include one or more of the U.S. patents listed at http://www.novell.com/company/
legal/patents/ and one or more additional patents or pending patent applications in the U.S.
and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the online documentation for this and other Novell products, and
to get updates, see www.novell.com/documentation.
Novell Trademarks
AppArmor is a registered trademark of Novell, Inc. in the United States and other countries.
Immunix is a trademark of Novell, Inc. in the United States and other countries.
Novell is a registered trademark of Novell, Inc. in the United States and other countries.
SUSE is a registered trademark of SUSE LINUX Products GmbH, a Novell business.

Third-Party Materials
All third-party trademarks are the property of their respective owners.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTIC-
ULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSE-
QUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTI-
TUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUP-
TION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CON-
TRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.

Contents
Introduction to Novell AppArmor vii
1Immunizing Programs 13
2Selecting Programs to Immunize 15
2.1 Immunize Programs That Grant Privilege . . . . . . . . . . . . . . . 15
2.2 Inspect Open Ports to Immunize Programs . . . . . . . . . . . . . . 16
3Building Novell AppArmor Proles 21
3.1 Prole Components and Syntax . . . . . . . . . . . . . . . . . . . 21
3.2 Building and Managing Novell AppArmor Proles . . . . . . . . . . . 24
3.3 Building Novell AppArmor Proles with the YaST GUI . . . . . . . . . . 26
3.4 Building Novell AppArmor Proles Using the Command Line Interface . . 49
3.5 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 54
3.6 Pathnames and Globbing . . . . . . . . . . . . . . . . . . . . . . 73
3.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . . 74
4Managing Proled Applications 77
4.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 77
4.2 Setting Up Event Notication . . . . . . . . . . . . . . . . . . . . 78
4.3 Reports............................. 81
4.4 Reacting to Security Events . . . . . . . . . . . . . . . . . . . . 102
4.5 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 103
5Proling Your Web Applications Using ChangeHat Apache 105
5.1 ApacheChangeHat........................ 106

5.2 Apache Conguration for mod_change_hat . . . . . . . . . . . . . 113
6Support 117
6.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 117
6.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 117
6.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 119
6.4 Troubleshooting......................... 119
6.5 Support for SUSE Linux . . . . . . . . . . . . . . . . . . . . . . 121
6.6 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 126
Glossary 129
vi

Introduction to Novell
AppArmor
Novell® AppArmor Powered by Immunix is designed to provide easy-to-use application
security for both servers and workstations. Novell AppArmor is an access control system
that lets you specify per program which les the program may read, write, and execute.
AppArmor secures applications by enforcing good application behavior without relying
on attack signatures, so can prevent attacks even if they are exploiting previously un-
known vulnerabilities.
Novell AppArmor consists of:
• A library of AppArmor proles for common Linux* applications describing what
les the program needs to access.
• A library of AppArmor prole foundation classes (prole building blocks) needed
for common application activities, such as DNS lookup and user authentication.
• A tool suite for developing and enhancing AppArmor proles, so that you can
change the existing proles to suit your needs and create new proles for your own
local and custom applications.
• Several specially modied applications that are AppArmor enabled to provide en-
hanced security in the form of unique subprocess connement, including Apache.
• The Novell AppArmor–loadable kernel module and associated control scripts to
enforce AppArmor policies on your SUSE® Linux system.
NOTE
Some distributions of SUSE Linux include a version of AppArmor that enforce
policies for a limited set of programs. These policies can be modied to suit
your particular environment using the included AppArmor tool set. To create
AppArmor proles for additional programs, an upgrade to the full version of
AppArmor is required.

1 Documentation Conventions
The following typographical conventions are used in this manual:
Menu Items, Field Names, and Screen Titles in GUIs
When using GUIs, eld names, menu and screen titles, and eld values are shown
as File.
Keys
Key names are listed as they appear on your keyboard, as in Enter and Esc .
Command
Linux commands (and other operating system commands, when used) are repre-
sented this way. This style should indicate to you that you can type the word
or phrase on the command line and press Enter to run the command.
Example 1 Command Environment
To use ls to view the contents in the current directory, enter ls in a terminal
window.
Filename
Filenames, directory names, paths, and RPM package names are represented this
way. This style should indicate that a particular le or directory exists by that name
on your Linux system.
Placeholders
Replace placeholder with the actual value that matches your setup.
Examples, Notes, and Warnings
Examples use Example: when appropriate. Notes and pertinent information are
shown with a Note or Warning ag, as in:
NOTE
Notes highlight information that might help better understand previous
paragraphs. Warnings provide important information that might seriously
affect the integrity of the product or your data.
viii

Computer Output
When you see text in this style, it indicates text displayed by the computer
on the command line. You see responses to typed commands, error messages, and
interactive prompts for your input during scripts or programs shown this way.
Example 2 Computer Output
Use the ls command to display the contents of a directory:
$ ls
Desktop about.html logs
Mail backupfiles mail
Trademarks
A trademark symbol (®, etc.) denotes a Novell trademark. An asterisk (*) denotes
a third-party trademark.
2 Understanding This Guide
Immunizing Programs
Describes operation of Novell AppArmor Powered by Immunix.
Selecting Programs to Immunize
Describes the types of programs that should have Novell AppArmor proles created
for them.
Building Novell AppArmor Proles
Describes how to use the Novell AppArmor tools to immunize your own programs
and third-party programs that you may have installed on your SUSE Linux system.
It also helps you to add, edit, or delete proles that have been created for your ap-
plications.
Managing Proled Applications
Describes how to perform Novell AppArmor prole maintenance, which involves
tracking common issues and concerns.
Proling Your Web Applications Using ChangeHat Apache
Enables you to create subproles for the Apache Web server that allow you to
tightly conne small sections of Web application processing.
Introduction to Novell AppArmor ix

Support
Indicates support options for this product.
Glossary
Provides a list of terms and their denitions.
3 Getting Started with Novell
AppArmor
Novell AppArmor Powered by Immunix (Novell AppArmor) provides you with tech-
nologies to protect your applications from their own vulnerabilities by creating Novell
AppArmor proles for applications on your SUSE Linux system.
3.1 Launching Novell AppArmor through
the YaST GUI
SUSE Linux offers the utility YaST. Using YaST, you can launch the Novell AppArmor
interface. This is the recommended method for a novice Linux user. For the other
available methods, refer to Section 3.2, “Building and Managing Novell AppArmor
Proles” (page 24).
•To start YaST, select System →Control Center (YaST) from the SUSE menu.
YaST is launched as shown in Section 3.2, “Novell AppArmor Basics” (page x),
below. You can refer to this section to navigate in Novell AppArmor.
NOTE
Alternately, you can launch the YaST GUI by opening a terminal window then
entering yast2 while logged in as root.
3.2 Novell AppArmor Basics
Novell AppArmor enables you to manage proles through a simple user interface.
x

In the YaST Control Center, click Novell AppArmor in the left pane. The right from
then shows the different Novell AppArmor conguration option. Select the appropriate
Novell AppArmor conguration option by clicking the corresponding icon.
Depending on the conguration option you select, refer to one of the following locations
in this guide:
Add Prole Wizard
For detailed steps, refer to Section 3.3.1, “Adding a Prole Using the Wizard”
(page 27).
AppArmor Reports
For detailed steps, refer to Section 4.3, “Reports” (page 81).
Edit Prole
Edit an existing Novell AppArmor prole on your system. For detailed steps, refer
to Section 3.3.3, “Editing a Prole” (page 39).
Update Prole Wizard
For detailed steps, refer to Section 3.3.5, “Updating Proles from Syslog Entries”
(page 42).
Introduction to Novell AppArmor xi

AppArmor Control Panel
For detailed steps, refer to Section 3.3.6, “Managing Novell AppArmor and Secu-
rity Event Status” (page 47).
Delete Prole
Delete an existing Novell AppArmor prole from your system. For detailed steps,
refer to Section 3.3.4, “Deleting a Prole” (page 41).
Manually Add Prole
Add a Novell AppArmor prole for an application on your system without the help
of the wizard. For detailed steps, refer to Section 3.3.2, “Manually Adding a Prole”
(page 34).
xii

1
Immunizing Programs
Novell® AppArmor provides immunization technologies that protect SUSE Linux ap-
plications from the inherent vulnerabilities they possess. After installing Novell App-
Armor, setting up Novell AppArmor proles and rebooting the computer, your system
becomes immunized because it begins to enforce the Novell AppArmor security policies.
Protecting programs with Novell AppArmor is referred to as immunizing.
Novell AppArmor sets up a collection of default application proles to protect standard
Linux services. To protect other applications, use the Novell AppArmor tools to create
proles for the applications that you want protected. This chapter introduces you to the
philosophy of immunizing programs. Proceed to Chapter 3, Building Novell AppArmor
Proles (page 21) if you are ready to build and manage Novell AppArmor proles.
Novell AppArmor provides streamlined access control for network services by specifying
which les each program is allowed to read, write, and execute. This ensures that each
program does what it is supposed to do and nothing else.
Novell AppArmor is host intrusion prevention, or a mandatory access control scheme,
that is optimized for servers. Previously, access control schemes were centered around
users because they were built for large timeshare systems. Alternatively, modern network
servers largely do not permit users to log in, but instead provide a variety of network
services for users, such as Web, mail, le, and print. Novell AppArmor controls the
access given to network services and other programs to prevent weaknesses from being
exploited.
Immunizing Programs 13

2
Selecting Programs to Immunize
Novell® AppArmor quarantines programs to protect the rest of the system from being
damaged by a compromised process. You should inspect your ports to see which pro-
grams should be proled (refer to Section 2.2, “Inspect Open Ports to Immunize Pro-
grams” (page 16)) and prole all programs that grant privilege (Section 2.1, “Immunize
Programs That Grant Privilege” (page 15)).
2.1 Immunize Programs That Grant
Privilege
Programs that need proling are those that mediate privilege. The following programs
have access to resources that the person using the program does not have, so they grant
the privilege to the user when used:
cron jobs
Programs that are run periodically by cron. Such programs read input from a variety
of sources and can run with special privileges, sometimes with as much as root
privilege. For example, cron can run /usr/bin/updatedb daily to keep the
locate database up to date with sufcient privilege to read the name of every le
in the system. For instructions for nding these types of programs, refer to Sec-
tion 2.2.1, “Immunizing Cron Jobs” (page 18).
Web Applications
Programs that can be invoked through a Web browser, including CGI Perl scripts,
PHP pages, and more complex Web applications. For instructions on nding these
Selecting Programs to Immunize 15

types of programs, refer to Section 2.2.2, “Immunizing Web Applications”
(page 18).
Network Agents
Programs (servers and clients) that have open network ports. User clients such as
mail clients and Web browsers, surprisingly, mediate privilege. These programs
run with the privilege to write to the user's home directories and they process input
from potentially hostile remote sources, such as hostile Web sites and e-mailed
malicious code. For instructions on nding these types of programs, refer to Sec-
tion 2.2.3, “Immunizing Network Agents” (page 20).
Conversely, unprivileged programs do not need to be proled. For instance, a shell
script might invoke the cp program to copy a le. Because cp does not have its own
prole, it inherits the prole of the parent shell script, so can copy any les that the
parent shell script's prole can read and write.
2.2 Inspect Open Ports to Immunize
Programs
An automated method for nding network server daemons that should be proled is to
use the unconned tool. You can also simply view a report of this information in the
YaST GUI (refer to Section “Application Audit Report” (page 88) for instructions).
The unconned tool uses the command netstat -nlp to inspect your open ports
from inside your computer, detect the programs associated with those ports, and inspect
the set of Novell AppArmor proles that you have loaded. Unconned then reports
these programs along with the Novell AppArmor prole associated with each program,
or reports “none” if the program is not conned.
NOTE
If you create a new prole, you must restart the program that has been proled
for unconned to detect and report the new proled state.
Below is a sample unconned output:
2325 /sbin/portmap not confined
3702❶/usr/sbin/sshd❷confined by '/usr/sbin/sshd❸(enforce)'
4040 /usr/sbin/ntpd confined by '/usr/sbin/ntpd (enforce)'
16

4373 /usr/lib/postfix/master confined by '/usr/lib/postfix/master (enforce)'
4505 /usr/sbin/httpd2-prefork confined by '/usr/sbin/httpd2-prefork (enforce)'
5274 /sbin/dhcpcd not confined
5592 /usr/bin/ssh not confined
7146 /usr/sbin/cupsd confined by '/usr/sbin/cupsd (complain)'
❶The rst portion is a number. This number is the process ID number (PID) of the
listening program.
❷The second portion is a string that represents the absolute path of the listening
program
❸The nal portion indicates the prole conning the program, if any.
NOTE
Unconned requires root privileges and should not be run from a shell that is
conned by an AppArmor prole.
Unconned does not distinguish between one network interface and another, so it reports
all unconned processes, even those that might be listening to an internal LAN interface.
Finding user network client applications is dependent on your user preferences. The
unconned tool detects and reports network ports opened by client applications, but
only those client applications that are running at the time the unconned analysis is
performed. This is a problem because network services tend to be running all the time,
while network client applications tend only to be running when the user is interested
in them.
Applying Novell AppArmor proles to user network client applications is also dependent
on user preferences, and Novell AppArmor is intended for servers rather than worksta-
tions. Therefore, we leave proling of user network client applications as an exercise
for the user.
To aggressively conne desktop applications, the unconned command supports a
paranoid option, which reports all processes running and the corresponding AppArmor
proles that might or might not be associated with each process. The unconned user
can then decide whether each of these programs needs an AppArmor prole.
Additional proles can be traded with other users and with the Novell® security devel-
opment team on the user mailing list at http://mail.wirex.com/mailman/
listinfo/immunix-users.
Selecting Programs to Immunize 17

2.2.1 Immunizing Cron Jobs
To nd programs that are run by cron, you need to inspect your local cron conguration.
Unfortunately, cron conguration is rather complex, so there are numerous les to in-
spect. Periodic cron jobs are run from these les:
/etc/crontab
/etc/cron.d/*
/etc/cron.daily/*
/etc/cron.hourly/*
/etc/cron.monthly/*
/etc/cron.weekly/*
For root's cron jobs, you can edit the tasks with crontab -e and list root's cron tasks
with crontab -l. You must be root for these to work.
Once you nd these programs, you can use the Add Prole Wizard to create proles
for them. Refer to Section 3.3.1, “Adding a Prole Using the Wizard” (page 27).
2.2.2 Immunizing Web Applications
To nd Web applications, you should investigate your Web server conguration. The
Apache Web server is highly congurable and Web applications can be stored in many
directories, depending on your local conguration. SUSE Linux, by default, stores Web
applications in /srv/www/cgi-bin/. To the maximum extent possible, each Web
application should have an Novell AppArmor prole.
Once you nd these programs, you can use the AppArmor Add Prole Wizard to create
proles for them. Refer to Section 3.3.1, “Adding a Prole Using the Wizard” (page 27).
CGI Programs and Subprocess Connement in Web
Applications
Because CGI programs are executed by the Apache Web server, the prole for Apache
itself usr.sbin.httpd2-prefork (for Apache2 on SUSE Linux) must be modied
to add execute permissions to each of these programs. For instance, adding the line
/srv/www/cgi-bin/my_hit_counter.pl rpx grants Apache permission to
execute the Perl script my_hit_counter.pl and requires that there be a dedicated
prole for my_hit_counter.pl. If my_hit_counter.pl does not have a ded-
18

icated prole associated with it, the rule should say
/srv/www/cgi-bin/my_hit_counter.pl rix to cause my_hit_counter
.pl to inherit the usr.sbin.httpd2-prefork prole.
Some users might nd it inconvenient to specify execute permission for every CGI
script that Apache might invoke. Instead, the administrator can grant controlled access
to collections of CGI scripts. For instance, adding the line
/srv/www/cgi-bin/*.{pl,py,pyc} rix allows Apache to execute all les
in /srv/www/cgi-bin/ ending in .pl (Perl scripts) and .py or .pyc (Python
scripts). As above, the ix part of the rule causes the Python scripts to inherit the Apache
prole, which is appropriate if you do not want to write individual proles for each
Python script.
NOTE
If you want the subprocess connement module (mod_change_hat) function-
ality when Web applications handle Apache modules (mod_perl and mod
_php), use the ChangeHat features when you add a prole in YaST or at the
command line. To take advantage of the subprocess connement, refer to
Section 5.1, “Apache ChangeHat” (page 106).
Proling Web applications that use mod_perl and mod_php require slightly different
handling. In this case, the “program” is a script interpreted directly by the module
within the Apache process, so no exec happens. Instead, the Novell AppArmor version
of Apache calls change_hat() naming a subprole (a “hat”) corresponding to the
name of the URI requested.
NOTE
The name presented for the script to execute might not be the URI, depending
on how Apache has been congured for where to look for module scripts. If
you have congured your Apache to place scripts in a different place, the dif-
ferent names appear in syslog when Novell AppArmor complains about access
violations. See Chapter 4, Managing Proled Applications (page 77).
For mod_perl and mod_php scripts, this is the name of the Perl script or the PHP
page requested. For example, adding this subprole allows the localtime.php page to
execute and access the local system time:
Selecting Programs to Immunize 19

/usr/sbin/httpd2-prefork^/cgi-bin
localtime.php {
/etc/localtime r,
/srv/www/cgi-bin/localtime.php r,
/usr/lib/locale/** r,
}
If no subprole has been dened, the Novell AppArmor version of Apache applies the
DEFAULT_URI hat. This subprole is basically sufcient to display an HTML Web
page. The DEFAULT_URI hat that Novell AppArmor provides by default is the follow-
ing:
/usr/sbin/suexec2 ixr,
/var/log/apache2/** rwl,
/home/*/public_html/** r,
/srv/www/htdocs/** r,
/srv/www/icons/*.{gif,jpg,png} r,
/usr/share/apache2/** r,
If you want a single Novell AppArmor prole for all Web pages and CGI scripts served
by Apache, a good approach is to edit the DEFAULT_URI subprole.
2.2.3 Immunizing Network Agents
To nd network server daemons that should be proled, you should inspect the open
ports on your machine, consider the programs that are answering on those ports, and
provide proles for as many of those programs as possible. If you provide proles for
all programs with open network ports, an attacker cannot get to the le system on your
machine without passing through a Novell AppArmor prole policy.
Scan your server for open network ports manually from outside the machine using a
scanner, such as nmap, or from inside the machine using netstat. Then inspect the ma-
chine to determine which programs are answering on the discovered open ports.
20