Novell APPARMOR 2.0 Instruction Manual

Novell AppArmor
www.novell.com2.0
August28,2006 Novell AppArmor 2.0 Administration Guide

Novell AppArmor 2.0 Administration Guide
List of Authors: Leona Beatrice Campbell, Jana Jaeger
This publication is intellectual property of Novell Inc.
Its contents can be duplicated, either in part or in whole, provided that a copyright label is visibly lo-
cated on each copy.
All information found in this book has been compiled with utmost attention to detail. However, this
does not guarantee complete accuracy. Neither SUSE LINUX GmbH, the authors, nor the translators
shall be held liable for possible errors or the consequences thereof.
Novell, the Novell logo, the N logo and SUSE are registered trademarks of Novell, Inc. in the United
States and other countries. * Linux is a registered trademark of Linus Torvalds. All other third party
trademarks are the property of their respective owners.

Contents
About This Guide v
1Immunizing Programs 9
2Selecting Programs to Immunize 11
2.1 Immunize Programs That Grant Privilege . . . . . . . . . . . . . . . 11
2.2 Inspect Open Ports to Immunize Programs . . . . . . . . . . . . . . 12
3Building Novell AppArmor Proles 19
3.1 Prole Components and Syntax . . . . . . . . . . . . . . . . . . . 19
3.2 Building and Managing Novell AppArmor Proles . . . . . . . . . . . 23
3.3 Building Novell AppArmor Proles with the YaST GUI . . . . . . . . . . 24
3.4 Building Novell AppArmor Proles Using the Command Line Interface . . 47
3.5 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 51
3.6 Pathnames and Globbing . . . . . . . . . . . . . . . . . . . . . . 69
3.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . . 71
4Managing Proled Applications 77
4.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 77
4.2 Setting Up Event Notication . . . . . . . . . . . . . . . . . . . . 78
4.3 Reports............................. 81
4.4 Reacting to Security Events . . . . . . . . . . . . . . . . . . . . 102
4.5 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 102
5Proling Your Web Applications Using ChangeHat Apache 105
5.1 ApacheChangeHat........................ 106

5.2 Apache Conguration for apache2-mod-apparmor . . . . . . . . . . 113
6Support 117
6.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 117
6.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 117
6.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 119
6.4 Troubleshooting......................... 120
6.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 121
ABackground Information on AppArmor Proling 123
Glossary 125

About This Guide
Novell® AppArmor is designed to provide easy-to-use application security for both
servers and workstations. Novell AppArmor is an access control system that lets you
specify per program which les the program may read, write, and execute. AppArmor
secures applications by enforcing good application behavior without relying on attack
signatures, so can prevent attacks even if they are exploiting previously unknown vul-
nerabilities.
Novell AppArmor consists of:
• A library of AppArmor proles for common Linux* applications describing what
les the program needs to access.
• A library of AppArmor prole foundation classes (prole building blocks) needed
for common application activities, such as DNS lookup and user authentication.
• A tool suite for developing and enhancing AppArmor proles, so that you can
change the existing proles to suit your needs and create new proles for your own
local and custom applications.
• Several specially modied applications that are AppArmor enabled to provide en-
hanced security in the form of unique subprocess connement, including Apache.
• The Novell AppArmor–loadable kernel module and associated control scripts to
enforce AppArmor policies on your SUSE® Linux system.
This guide covers the following topics:
Immunizing Programs
Describes the operation of Novell AppArmor.
Selecting Programs to Immunize
Describes the types of programs that should have Novell AppArmor proles created
for them.
Building Novell AppArmor Proles
Describes how to use the Novell AppArmor tools to immunize your own programs
and third-party programs that you may have installed on your SUSE Linux system.

It also helps you to add, edit, or delete proles that have been created for your ap-
plications.
Managing Proled Applications
Describes how to perform Novell AppArmor prole maintenance, which involves
tracking common issues and concerns.
Proling Your Web Applications Using ChangeHat Apache
Enables you to create subproles for the Apache Web server that allow you to
tightly conne small sections of Web application processing.
Support
Indicates support options for this product.
Glossary
Provides a list of terms and their denitions.
NOTE
Novell AppArmor ships with any SUSE Linux–based Novell operating system.
Text references to SUSE Linux apply to SUSE Linux OSS, the SUSE Linux retail
product, and the SUSE Linux Enterprise product family.
1 Feedback
We want to hear your comments and suggestions about this manual and the other doc-
umentation included with this product. Please use the User Comments feature at the
bottom of each page of the online documentation and enter your comments there.
2 Documentation Conventions
The following typographical conventions are used in this manual:
•/etc/passwd: lenames and directory names
•placeholder: replace placeholder with the actual value
vi Novell AppArmor 2.0 Administration Guide

•PATH: the environment variable PATH
•ls,--help: commands, options, and parameters
•user: users or groups
•Alt ,Alt +F1 : a key to press or a key combination; keys are shown in uppercase
as on a keyboard
•File,File →Save As: menu items, buttons
•Dancing Penguins (Chapter Penguins, ↑Reference): This is a reference to a chapter
in another book.
About This Guide vii

1
Immunizing Programs
Novell® AppArmor provides immunization technologies that protect SUSE Linux ap-
plications from the inherent vulnerabilities they possess. After installing Novell App-
Armor, setting up Novell AppArmor proles, and rebooting the computer, your system
becomes immunized because it begins to enforce the Novell AppArmor security policies.
Protecting programs with Novell AppArmor is referred to as immunizing.
Novell AppArmor sets up a collection of default application proles to protect standard
Linux services. To protect other applications, use the Novell AppArmor tools to create
proles for the applications that you want protected. This chapter introduces the philos-
ophy of immunizing programs. Proceed to Chapter 3, Building Novell AppArmor Proles
(page 19) if you are ready to build and manage Novell AppArmor proles.
Novell AppArmor provides streamlined access control for network services by specifying
which les each program is allowed to read, write, and execute. This ensures that each
program does what it is supposed to do and nothing else.
Novell AppArmor is host intrusion prevention, or mandatory access control scheme,
that is optimized for servers. Previously, access control schemes were centered around
users because they were built for large timeshare systems. Alternatively, modern network
servers largely do not permit users to log in, but instead provide a variety of network
services for users, such as Web, mail, le, and print. Novell AppArmor controls the
access given to network services and other programs to prevent weaknesses from being
exploited.
Immunizing Programs 9

TIP: Background Information for Novell AppArmor
To get a more in-depth overview of AppArmor and the overall concept behind
it, refer to Appendix A, Background Information on AppArmor Proling
(page 123).
10 Novell AppArmor 2.0 Administration Guide