Novell APPARMOR 2.1 - Instruction Manual

AppArmor
www.novell.com2.1
September27,2007 Novell AppArmor Administration Guide

Novell AppArmor Administration Guide
Copyright © 2006-2007 Novell, Inc.
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU
Free Documentation License, Version 1.2 or any later version published by the Free Software Foun-
dation; with the Invariant Section being this copyright notice and license. A copy of the license is in-
cluded in the section entitled “GNU Free Documentation License”.
SUSE®, openSUSE®, the openSUSE® logo, Novell®, the Novell® logo, the N® logo, are registered
trademarks of Novell, Inc. in the United States and other countries. Linux* is a registered trademark
of Linus Torvalds. All other third party trademarks are the property of their respective owners. A
trademark symbol (® , ™, etc.) denotes a Novell trademark; an asterisk (*) denotes a third-party
trademark.
All information found in this book has been compiled with utmost attention to detail. However, this
does not guarantee complete accuracy. Neither Novell, Inc., SUSE LINUX Products GmbH, the authors,
nor the translators shall be held liable for possible errors or the consequences thereof.

Contents
About This Guide v
1Immunizing Programs 1
1.1 Introducing the AppArmor Framework . . . . . . . . . . . . . . . . 2
1.2 Determining Programs to Immunize . . . . . . . . . . . . . . . . . . 4
1.3 Immunizing cron Jobs . . . . . . . . . . . . . . . . . . . . . . . . 5
1.4 Immunizing Network Applications . . . . . . . . . . . . . . . . . . 5
2Prole Components and Syntax 11
2.1 Breaking a Novell AppArmor Prole into Its Parts . . . . . . . . . . . 12
2.2 #include Statements ...................... 21
2.3 Capability Entries (POSIX.1e) . . . . . . . . . . . . . . . . . . . . 22
2.4 Using the Local AppArmor Prole Repository . . . . . . . . . . . . . 22
2.5 Using the External AppArmor Prole Repository . . . . . . . . . . . . 23
2.6 Important Filenames and Directories . . . . . . . . . . . . . . . . . 25
3Building and Managing Proles with YaST 27
3.1 Adding a Prole Using the Wizard . . . . . . . . . . . . . . . . . . 29
3.2 Manually Adding a Prole . . . . . . . . . . . . . . . . . . . . . 37
3.3 EditingProles.......................... 38
3.4 DeletingaProle......................... 43
3.5 Updating Proles from Log Entries . . . . . . . . . . . . . . . . . . 44
3.6 Managing Novell AppArmor and Security Event Status . . . . . . . . . 45
4Building Proles from the Command Line 49
4.1 Checking the AppArmor Module Status . . . . . . . . . . . . . . . 49

4.2 Building AppArmor Proles . . . . . . . . . . . . . . . . . . . . . 51
4.3 Adding or Creating an AppArmor Prole . . . . . . . . . . . . . . . 52
4.4 Editing an AppArmor Prole . . . . . . . . . . . . . . . . . . . . 52
4.5 Deleting an AppArmor Prole . . . . . . . . . . . . . . . . . . . . 52
4.6 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 53
5Proling Your Web Applications Using ChangeHat 75
5.1 ApacheChangeHat........................ 76
5.2 Conguring Apache for mod_apparmor . . . . . . . . . . . . . . . 83
6Managing Proled Applications 87
6.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 87
6.2 Conguring Security Event Notication . . . . . . . . . . . . . . . . 88
6.3 Conguring Reports . . . . . . . . . . . . . . . . . . . . . . . . 91
6.4 Conguring and Using the AppArmor Desktop Monitor Applet . . . . . 111
6.5 Reacting to Security Event Rejections . . . . . . . . . . . . . . . . 112
6.6 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 112
7Support 115
7.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 115
7.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 115
7.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 117
7.4 Troubleshooting......................... 118
7.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 124
ABackground Information on AppArmor Proling 127
BGNU Licenses 129
B.1 GNU General Public License . . . . . . . . . . . . . . . . . . . . 129
B.2 GNU Free Documentation License . . . . . . . . . . . . . . . . . 132
Glossary 137

About This Guide
Novell® AppArmor is designed to provide easy-to-use application security for both
servers and workstations. Novell AppArmor is an access control system that lets you
specify per program which les the program may read, write, and execute. AppArmor
secures applications by enforcing good application behavior without relying on attack
signatures, so it can prevent attacks even if they are exploiting previously unknown
vulnerabilities.
Novell AppArmor consists of:
• A library of AppArmor proles for common Linux* applications describing what
les the program needs to access.
• A library of AppArmor prole foundation classes (prole building blocks) needed
for common application activities, such as DNS lookup and user authentication.
• A tool suite for developing and enhancing AppArmor proles, so that you can
change the existing proles to suit your needs and create new proles for your own
local and custom applications.
• Several specially modied applications that are AppArmor enabled to provide en-
hanced security in the form of unique subprocess connement, including Apache
and Tomcat.
• The Novell AppArmor–loadable kernel module and associated control scripts to
enforce AppArmor policies on your openSUSE® system.
This guide covers the following topics:
Immunizing Programs
Describes the operation of Novell AppArmor and describes the types of programs
that should have Novell AppArmor proles created for them.
Prole Components and Syntax
Introduces the prole components and syntax.
Building and Managing Proles with YaST
Describes how to use the AppArmor YaST modules to build, maintain and update
proles.

Building Proles from the Command Line
Describes how to use the AppArmor command line tools to build, maintain and
update proles.
Proling Your Web Applications Using ChangeHat
Enables you to create subproles for the Apache Web server that allow you to
tightly conne small sections of Web application processing.
Managing Proled Applications
Describes how to perform Novell AppArmor prole maintenance, which involves
tracking common issues and concerns.
Support
Indicates support options for this product.
Glossary
Provides a list of terms and their denitions.
1 Feedback
We want to hear your comments and suggestions about this manual and the other doc-
umentation included with this product. Please use the User Comments feature at the
bottom of each page of the online documentation and enter your comments there.
2 Documentation Conventions
The following typographical conventions are used in this manual:
•/etc/passwd: lenames and directory names
•placeholder: replace placeholder with the actual value
•PATH: the environment variable PATH
•ls,--help: commands, options, and parameters
•user: users or groups
vi Novell AppArmor Administration Guide

•Alt,Alt +F1: a key to press or a key combination; keys are shown in uppercase as
on a keyboard
•File,File >Save As: menu items, buttons
•Dancing Penguins (Chapter Penguins, ↑Another Manual): This is a reference to a
chapter in another manual.
3 Source Code
The source code of openSUSE is publicly available. To download the source code,
proceed as outlined under http://www.novell.com/products/suselinux/
source_code.html. If requested we send you the source code on a DVD. We need
to charge a $15 or €15 fee for creation, handling and postage. To request a DVD of the
source code, send an e-mail to [email protected] [mailto:sourcedvd@suse
.de] or mail the request to:
SUSE Linux Products GmbH
Product Management openSUSE
Maxfeldstr. 5
D-90409 Nürnberg
Germany
About This Guide vii

1
Immunizing Programs
Novell® AppArmor provides immunization technologies that protect applications from
the inherent vulnerabilities they possess. After installing Novell AppArmor, setting up
Novell AppArmor proles, and rebooting the computer, your system becomes immu-
nized because it begins to enforce the Novell AppArmor security policies. Protecting
programs with Novell AppArmor is referred to as immunizing.
Novell AppArmor sets up a collection of default application proles to protect standard
Linux services. To protect other applications, use the Novell AppArmor tools to create
proles for the applications that you want protected. This chapter introduces the philos-
ophy of immunizing programs. Proceed to Chapter 2, Prole Components and Syntax
(page 11), Chapter 3, Building and Managing Proles with YaST (page 27), or Chap-
ter 4, Building Proles from the Command Line (page 49) if you are ready to build and
manage Novell AppArmor proles.
Novell AppArmor provides streamlined access control for network services by specifying
which les each program is allowed to read, write, and execute, and which type of
network it is allowed to access. This ensures that each program does what it is supposed
to do and nothing else. Novell AppArmor quarantines programs to protect the rest of
the system from being damaged by a compromised process.
Novell AppArmor is a host intrusion prevention or mandatory access control scheme.
Previously, access control schemes were centered around users because they were built
for large timeshare systems. Alternatively, modern network servers largely do not permit
users to log in, but instead provide a variety of network services for users, such as Web,
mail, le, and print servers. Novell AppArmor controls the access given to network
services and other programs to prevent weaknesses from being exploited.
Immunizing Programs 1

TIP: Background Information for Novell AppArmor
To get a more in-depth overview of AppArmor and the overall concept behind
it, refer to Appendix A, Background Information on AppArmor Proling
(page 127).
1.1 Introducing the AppArmor
Framework
This section provides a very basic understanding of what is happening “behind the
scenes” (and under the hood of the YaST interface) when you run AppArmor.
An AppArmor prole is a plain text le containing path entries and access permissions.
See Section 2.1, “Breaking a Novell AppArmor Prole into Its Parts” (page 12) for a
detailed reference prole. The directives contained in this text le are then enforced
by the AppArmor routines to quarantine the process or program.
The following tools interact in the building and enforcement of AppArmor proles and
policies:
aa-unconned
aa-unconned detects any application running on your system that listens for net-
work connections and is not protected by an AppArmor prole. Refer to Section
“aa-unconned—Identifying Unprotected Processes” (page 73) for detailed infor-
mation about this tool.
aa-autodep
aa-autodep creates a basic skeleton of a prole that needs to be eshed out before
it is put to productive use. The resulting prole is loaded and put into complain
mode, reporting any behavior of the application that is not (yet) covered by App-
Armor rules. Refer to Section “aa-autodep—Creating Approximate Proles”
(page 56) for detailed information about this tool.
aa-genprof
aa-genprof generates a basic prole and asks you to rene this prole by executing
the application, generating log events that need to be taken care of by AppArmor
policies. You are guided through a series of questions to deal with the log events
2Novell AppArmor Administration Guide