Novell APPARMOR - AND Manual

Admin Guide
Novell AppArmor
Powered by Immunix

User’s Guide
2
Introduction to AppArmor 3
Conventions Used in This User’s Guide 3
Manual Text 3
Examples, Notes and Warnings 4
Command 4
Filename 4
Computer Output 4
Prompts 5
Understanding This User’s Guide 5
Getting Started With AppArmor 5
AppArmor Installation 6
Launching AppArmor through the YaST GUI 6
AppArmor Basics 6
Why Immunize Programs? 9
How To Immunize With AppArmor 9
What Should You Immunize? 10
Immunizing SetUID Programs 11
Immunizing Cron Jobs 11
Immunizing Web Applications 11
Immunizing Network Agents 13
How to Build AppArmor Profiles 16
Profile Components and Syntax 16
Breaking Down the AppArmor Profile Into Its Parts 16
#include 18
Capability Entries (POSIX.1e) 19
Choosing the YaST GUI, YaST ncurses Console or Command-line
Interface 19
To Use the YaST GUI 20
To Use the YaST ncurses Console 20
To use the Command-line Interface 20
Building AppArmor Profiles With the YaST GUI 21
Using the Add Profile Wizard 23
Editing a AppArmor Profile 28
Deleting a Profile 31
Update Profiles From Syslog Entries 32
Manually Adding a Profile 36
Managing AppArmor and Security Event Status 41
Building AppArmor Profiles Using the Command-line Interface 43
Checking the SubDomain Module Status 44
Building AppArmor Profiles 45
Add or Create a AppArmor Profile 46
Edit AppArmor Profile 46

3
Delete AppArmor Profile. 47
Two Methods of Profiling 47
Standalone Profiling 48
Systemic Profiling 48
Summary of Profiling Tools 50
Enforce Mode 52
Path Names and Regular Expression Matching 66
File Permission Access Modes 66
Read Mode 67
Write Mode 67
Discrete Profile Execute Mode 67
Unconstrained Execute Mode 67
Inherit Execute Mode 68
Link Mode 68
Managing Profiled Applications 69
Monitoring Your Secured Applications 69
Setting Up Event Notification 69
Creating Reports 70
Maintaining Your Security Profiles 73
Backing Up Your Security Profiles 74
Changing Your Security Profiles 74
Introducing New Software Into Your Environment 74
Profiling Your Web Applications Using ChangeHat Apache 76
What is ChangeHat? 76
Apache ChangeHat 76
Tools for Managing ChangeHat Aware Applications 77
phpsysinfo Hat (Subprofile) 80
Adding Hats and Entries to Hats 81
Apache Configuration for mod_change_hat 83
vhosts Directives 84
Location and Directory Directives 84
Support 88
Updating AppArmor Online 88
Using the Man Pages 89
Troubleshooting Solutions 90
Getting Online Support 91
Using Mailing List Support 91
Glossary 92

User’s Guide
4
Chapter 1 Introduction to Novell
AppArmor
The Novell AppArmor, powered by Immunix TM (or Novell AppArmor) is
designed to provide application security for both servers and worksta-
tions that is easy to use. Novell AppArmor secures applications by dif-
ferentiating between “good” and “bad” behaviors, permitting the good
and preventing the bad. This works to defend your systems without
resorting to attack signatures, and thus can prevent attacks even if
they are exploiting previously unknown vulnerabilities.
Novell AppArmor is a mandatory access control system designed for
application firewalling, Novell AppArmor lets you specify per program
which files the program may read, write, and execute.
Novell AppArmor is comprised of:
•A library of Novell AppArmor profiles for common Linux applications
describing what files the program needs to access.
•A library of Novell AppArmor profile foundation classes (profile
building blocks) needed for common application activities such as
DNS lookup and user authentication.
•A tool suite for developing and enhancing Novell AppArmor profiles,
so that you can change the existing profiles to suit your needs, and
create new profiles for your own local and custom applications.
•Several specially modified applications that are Novell AppArmor-
enabled to provide enhanced security in the form of Novell AppAr-
mor’s unique sub-process confinement, including Apache.
•The Novell AppArmor loadable kernel module and associated con-
trol scripts to enforce Novell AppArmor policies on your SuSE
LINUX Enterprise Server 9 systems.
Conventions Used in This User’s Guide
Manual Text
When using GUIs, field names, menu and screen titles, and field val-
ues are shown as File.

5
Conventions Used in This User’s Guide
Key names are listed as they appear on your keyboard, as in Enter
and Esc (for Escape).
Examples, Notes and Warnings
Examples are focused with Example: when appropriate. Notes and
pertinent information are shown with a Note: or Warning! flag, as in:
Note:
Notes highlight information that might help you to better understand
previous paragraphs. Warnings provide important information that
might seriously affect the integrity of the product or your data.
Command
Linux commands (and other operating system commands, when used)
are represented this way. This style should indicate to you that you
can type the word or phrase on the command line and press [Enter] to
invoke a command.
Example: To use ls to view the contents in the current directory,
you would type ls in a terminal window.
Filename
Filenames, directory names, paths, and RPM package names are rep-
resented this way. This style should indicate that a particular file or
directory exists by that name on your Linux system.
Computer Output
When you see text in this style, it indicates text displayed by the
computer on the command line. You will see responses to commands
you typed in, error messages, and interactive prompts for your input
during scripts or programs shown this way.
Example: Use the ls command to display the contents of a direc-
tory:
$ ls
Desktop about.html logs
Mail backupfiles mail

User’s Guide
6
Prompts
A prompt, which is a computer's way of signifying that it is ready for you
to input something, will be shown in this style.
Example: puter login:
Understanding This User’s Guide
For installation instructions, please refer to the separate Novell AppAr-
mor Installation & Quickstart Guide.
Chapter 2: Why Immunize Programs? describes operation of the
Novell AppArmor, powered by Immunix.
Chapter 3: What Should You Immunize? describes the types and
details about a program that should have Novell AppArmor profiles cre-
ated for them.
Chapter 4: How to Build Novell AppArmor Profiles describes how
to use the Novell AppArmor tools to immunize your own programs and
3rd party programs that you may have installed on your SuSe Linux. It
also helps you to add, edit or delete profiles that have been created for
your applications.
Chapter 5: Managing Profiled Applications describes how to per-
form Novell AppArmor profile maintenance, which involves tracking
common issues and concerns.
Chapter 6: Profiling Your Web Applications Using ChangeHat
Apache enables you to create subprofiles that can be applied to sev-
eral applications, saving you a great deal of time and redundant efforts.
Chapter 8: Glossary indicates support options for this product.
Getting Started With Novell AppArmor
The Novell AppArmor, powered by Immunix (Novell AppArmor) pro-
vides you with technologies to protect your applications from their own
vulnerabilities by creating Novell AppArmor profiles for applications on
your SuSE LINUX Enterprise Server 9 (SLES 9).

7
Getting Started With Novell AppArmor
Novell AppArmor Installation
After Installing the SLES 9, including the required packages, you are
ready to install Novell AppArmor. Refer to the Novell AppArmor Instal-
lation Guide for detailed installation steps.
Once Novell AppArmor is installed, you are ready to use it to manage
Novell AppArmor profiles.You can do this through the graphical user
interface (GUI) or by using the command line (refer to “Building Novell
AppArmor Profiles Using the Command-line Interface” on page46).
Launching Novell AppArmor through the YaST GUI
The SuSE LINUX Enterprise Server 9 offers the SUSE utility, Yet
Another Setup Tool (YaST). Using YaST, you can launch the Novell
AppArmor interface. This is the recommended method for a novice
Linux user. For the other available methods, refer to “Choosing the
YaST GUI, YaST ncurses Console or Command-line Interface” on
page 20.
1. To launch YaST, from the SuSE Menu, select System.
2. From the System cascading menu, select YaST. The YaST GUI is
launched as shown in Novell AppArmor Basics, below.You can
refer to this section to navigate Novell AppArmor.
Note: Alternately, you can launch the YaST GUI by opening a termi-
nal window typing yast2 while logged in as root.
Novell AppArmor Basics
Novell AppArmor enables you to manage profiles through a simple

User’s Guide
8
user interface.
1. From the YaST GUI, click Novell AppArmor in the left panel. The dif-
ferent Novell AppArmor configuration options display.
2. Select the appropriate Novell AppArmor configuration option by
clicking the corresponding icon.
3. Depending on the configuration option you select, refer to one of
the following locations in this guide:
• Add Profile Wizard: For detailed steps, refer to “Using the Add Pro-
file Wizard” on page24.
• Edit Profile: Edits an existing Novell AppArmor profile on your sys-
tem. For detailed steps, refer to “Editing a Novell AppArmor Profile”
on page 29.
• Delete Profile: Deletes an existing Novell AppArmor profile from your
system. For detailed steps, refer to “Deleting a Profile” on page32.
• Update Profile Wizard: For detailed steps, refer to “Update Profiles
From Syslog Entries” on page33.
• Manually Add Profile:Adds Novell AppArmor profile for an applica-
tion on your system without the help of the wizard. For detailed steps,
refer to “Manually Adding a Profile” on page37.

9
Getting Started With Novell AppArmor
• Review Novell AppArmor Security Events: For detailed steps,
refer to “Creating Reports” on page74.
• Novell AppArmor Control Panel: For detailed steps, refer to “Man-
aging Novell AppArmor and Security Event Status” on page43.

User’s Guide
10
Chapter 2 Why Immunize Programs?
Novell AppArmor provides Immunization technologies that protect
SLES 9 applications from the inherent vulnerabilities they possess.
After installing Novell AppArmor, setting up Novell AppArmor profiles
and rebooting the PC, your system becomes Immunized because it
begins to enforce the Novell AppArmor security policies. Protecting
programs with Novell AppArmor is referred to as Immunizing. In the
following sections, we explain why and how to immunize your pro-
grams.
Novell AppArmor sets you up with a collection of default application
profiles to protect standard Linux services. To protect other applica-
tions, use the Novell AppArmor tools to create profiles for the applica-
tions that you want protected. This chapter introduces you to the
philosophy of Immunizing programs. Proceed to Chapter 4: How to
Build Novell AppArmor Profiles if you’re ready to build and manage
Novell AppArmor profiles.
How To Immunize With Novell AppArmor
Novell AppArmor provides streamlined access control for network
services by specifying which files each program is allowed to read,
write, and execute. This ensures that each program does what it is
supposed to do, and nothing else.
Novell AppArmor is host intrusion prevention or a mandatory access
control scheme that is optimized for servers. Previously, access control
schemes were centered around users because they were built for large
time-share systems. Alternatively, modern network servers largely do
not permit users to log in, and instead provide a variety of network ser-
vices for users such as web, mail, file, print, etc. Novell AppArmor con-
trols the access given to network services and other programs to
prevent weaknesses from being exploited.

11
How To Immunize With Novell AppArmor
Chapter 3 What Should You Immunize?
Novell AppArmor quarantines programs to protect the rest of the sys-
tem from being damaged by a compromised process. Thus programs
that need profiling are those that mediate privilege. For example,
sometimes a program has access to resources that the person using
the program does not have, which is true for the following types of pro-
grams:
•SetUID Programs: Programs that are setuid or setgid run as
the user or group that owns the program file, rather than the usual
case of running as the user and group of the person invoking the
program. For instructions on using Novell AppArmor for this type of
program, refer to “Immunizing SetUID Programs” on page12.
•cron jobs: Programs that will be run periodically by cron. Such pro-
grams read input from a variety of sources, and may run with spe-
cial privileges, sometimes with as much as root privilege, e.g. cron
runs /usr/bin/updatedb daily to keep the slocate database up to
date, with sufficient privilege to read the name of every file in the
system. For instructions on using Novell AppArmor for this type of
program, refer to “Immunizing Cron Jobs” on page12.
•Web Applications: Programs that can be invoked through a web
browser, including CGI PERL scripts, PHP pages, and more com-
plex web applications. For instructions on using Novell AppArmor
for this type of program, refer to “Immunizing Web Applications” on
page 12.
•Network Agents: Programs (servers and clients) that have open
network ports. User clients such as mail clients and web browsers,
surprisingly, mediate privilege. These programs run with the privi-
lege to write to the user’s home directories, and process input from
potentially hostile remote sources, such as hostile web sites and e-
mailed malicious code. For instructions on using Novell AppArmor
for this type of program, refer to “Immunizing Network Agents” on
page 14.
Conversely, unprivileged programs do not need to be profiled. For
instance, a shell script might invoke the cp program to copy a file.
Since cp does not have its own profile, it inherits the profile of the

User’s Guide
12
parent shell script, and thus can copy any files that the parent shell
script’s profile can read and write.
Immunizing SetUID Programs
To find setuid programs, you can inspect your file system. For
instance, this command will find files that are setuid root:
Immunizing Cron Jobs
To find programs that will be run by cron, you need to inspect your
local cron configuration. Unfortunately, cron configuration is rather
complex, and so there are numerous files to inspect. Periodic cron jobs
are run from these files:
For root’s cron jobs, you can edit the tasks with “crontab -e”, and list
root’s cron tasks with “crontab -l”. You must be root for these to
work.
Immunizing Web Applications
To find web applications, you should investigate your web server con-
figuration. The Apache web server is highly configurable, and web
applications can be stored in many directories, depending on your local
configuration. SuSE Linux, by default, stores web applications in
/srv/www/cgi-bin/. To the maximum extent possible, each web
application should have an Novell AppArmor profile.
Because CGI programs are to be executed by the Apache web server,
the profile for Apache itself usr.sbin.httpd2-prefork (for Apache
2 on SuSE Linux) must be modified to add execute permissions to
find / -user root -perm -4000 -print
/etc/crontab
/etc/cron.d/*
/etc/cron.daily/*
/etc/cron.hourly/*
/etc/cron.monthly/*
/etc/cron.weekly/*

13
How To Immunize With Novell AppArmor
each of these programs. For instance, adding the line
“/srv/www/cgi-bin/my_hit_counter.pl rpx,” would grant
Apache permission to execute the PERL script my_hit_counter.pl
and require that there be a dedicated profile for
my_hit_counter.pl. If my_hit_counter.pl does not have a
dedicated profile associated with it, then the rule should say
“/srv/www/cgi-bin/my_hit_counter.pl rix,” to cause
my_hit_counter.pl to inherit the usr.sbin.httpd2-prefork
profile.
Some users may find it inconvenient to specify execute permission for
every CGI script that Apache may invoke. Instead, the administrator
can grant controlled access to collections of CGI scripts. For instance,
adding the line “/srv/www/cgi-bin/*.{pl,py,pyc} rix,” will
allow Apache to execute all files in /srv/www/cgi-bin/ ending in
.pl (PERL scripts) or .py or .pyc (Python scripts). As above, the
“ix” part of the rule causes the Python scripts to inherit the Apache
profile, which is appropriate if you do not want to write individual pro-
files for each Python script.
Note: If you want the Sub-process confinement module
(mod_change_hat) functionality when web applications handle
Apache modules, (mod_perl and mod_php), insert the Novell AppAr-
mor sub-process confinement module into the Apache web server.
The Novell AppArmor installer installs this modified Apache web
server along with change_hat. Novell AppArmor for Apache is pro-
vided by the mod_change_hat Apache module. To take advantage
of the sub-process confinement, refer to “Apache ChangeHat” on
page 79.
Profiling web applications that use mod_perl and mod_php require
slightly different handling. In this case, the “program” is a script inter-
preted directly by the module within the Apache process, so no exec
happens. Instead, the Novell AppArmor version of Apache calls
change_hat() naming a subprofile (a “hat”) corresponding to the
name of the URI being requested.1For mod_perl and mod_php
scripts, this will be the name of the PERL script or the PHP page
requested. So for example, adding this subprofile to foo will allow the

User’s Guide
14
localtime.php page to execute and access the local system time:
If no subprofile has been defined, then the Novell AppArmor version of
Apache applies the DEFAULT_URI hat. This subprofile is basically suf-
ficient to display an HTML web page. The DEFAULT_URI hat that is
provided by default is:
If you want a single Novell AppArmor profile for all web pages and CGI
scripts served by Apache, then editing the DEFAULT_URI subprofile is
a good approach.
Immunizing Network Agents
To find network server daemons that should be profiled, you should
inspect the open ports on your machine, consider the programs that
are answering on those ports, and provide profiles for as many of those
programs as possible. If you provide profiles for all programs with open
network ports, then for all possible network threats, the attacker cannot
get to the file system on your machine without passing through an Nov-
ell AppArmor profile policy.
1. The name presented for the script to be executed may not be the URI, depending on how
Apache has been configured for where to look for module scripts. If you have configured
your Apache to place scripts in a different place, then the different names will show up in
Syslog when Novell AppArmor complains about access violations. See “Managing Profiled
Applications” on page72.
/usr/sbin/httpd2-prefork^/cgi-bin/localtime.php {
/etc/localtime r,
/srv/www/cgi-bin/localtime.php r,
/usr/lib/locale/** r,
}
/usr/sbin/suexec2 ixr,
/var/log/apache2/** rwl,
/home/*/public_html/** r,
/srv/www/htdocs/** r,
/srv/www/icons/*.{gif,jpg,png} r,
/usr/share/apache2/** r,

15
How To Immunize With Novell AppArmor
Scanning your server for open network ports can be done manually
from outside the machine using a scanner such as nmap, or from
inside the machine using netstat, and then inspecting the machine
to determine which programs are answering on the discovered open
ports.
Using Unconfined To Inspect Open Ports
An automated method for finding network server daemons that should
be profiled is to use the unconfined tool. Using the command “net-
stat -nlp,” the unconfined tool inspects your open ports from inside
your computer, detects the programs associated with those ports,
inspects the set of Novell AppArmor profiles that you have loaded.
Unconfined then reports these programs along with the Novell AppAr-
mor profile associated with each program, or reports "none" if the pro-
gram is not confined.
Note: If you create a new profile, you must restart the program that
has been profiled in order for unconfined to detect and report the new
profiled state.
Below you will find sample unconfined output:
•The first portion is a number. This number is the Process ID num-
ber (PID), of the listening program.
•The second portion is a string, which represents is the absolute
path of the listening program
•The final portion indicates the profile confining the program, if any.
2325 /sbin/portmap not confined
3702 /usr/sbin/sshd confined by '/usr/sbin/sshd (enforce)'
4040 /usr/sbin/ntpd confined by '/usr/sbin/ntpd (enforce)'
4373 /usr/lib/postfix/master confined by
'/usr/lib/postfix/master (enforce)'
4505 /usr/sbin/httpd2-prefork confined by
'/usr/sbin/httpd2-prefork (enforce)'
5274 /sbin/dhcpcd not confined
5592 /usr/bin/ssh not confined
7146 /usr/sbin/cupsd confined by '/usr/sbin/cupsd
(complain)'

User’s Guide
16
Notes:
Requires root privilege, and should not itself be run from within aNovell
AppArmor profile.
unconfined does not distinguish between one network interface and
another, and so it will report all unconfined processes, even those that
may be listening to an internal LAN interface.
Finding user network client applications is dependent on your user’s
preferences. The unconfined tool will detect and report network
ports opened by client applications, but only those client applications
that are running at the time the unconfined analysis is performed.
This is a problem because network services tend to be running all the
time, while network client applications tend to only be running when the
user is interested in them.
Applying Novell AppArmor profiles to user network client applications is
also dependent on user’s preferences, and is intended for servers
rather than workstations, and so we leave profiling of user network cli-
ent applications as an exercise for the user.
To aggressively confine desktop applications, the unconfined com-
mand supports a paranoid option, which will report all processes run-
ning and the corresponding AppArmor profiles that may or may not be
associated with each process. The unconfined user can then decide
whether each of these programs needs an AppArmor profile.
Additional profiles may be traded with other users and with the Novell
security development team on the user's mailing list at the following
URL:
http://mail.wirex.com/mailman/listinfo/Novell AppArmor-
users

17
Profile Components and Syntax
Chapter 4 How to Build Novell AppArmor
Profiles
This chapter explains how to build and manage Novell AppArmor pro-
files. You are ready to build Novell AppArmor profiles once you select
the programs to be profiled. For help with this, refer to “What Should
You Immunize?” on page11.
Profile Components and Syntax
This section details the syntax or makeup of Novell AppArmor profiles.
An example illustrating this syntax is presented on “Breaking Down the
Novell AppArmor Profile Into Its Parts” on page17.
Breaking Down the Novell AppArmor Profile Into Its
Parts
Novell AppArmor profile components are called Novell AppArmor
Rules. Currently there are two main types of Novell AppArmor rules,
path entries and capability entries. Path entries specify what the pro-
cess can access in the filesystem and Capability entries provide a
more fine-grained control over what a confined process is allowed to
do through other system calls that require privileges. Includes are a
type of meta-rule or directives that pull in path and capability entries
from other files.

User’s Guide
18
The easiest way of explaining what a profile is comprised of and how to
create one is to show the details of a sample profile. Consider, for
example, the following profile for the program, /sbin/klogd:
The first line: The first line is a comment.
The second line: The second line indicates the absolute path of the
program to be confined. In this example, whenever a program named
/sbin/klogd executes, it will be confined by this profile.
Subsequent lines within the brackets {}: The rest of the lines take
one of several forms:
•#include directives that pull in components of Novell AppArmor
profiles to simplify profiles.
•Capability Entries statements that enable each of the 32
POSIX.1e capabilities.
•Path Entries in which the first part specifies the absolute path of a
file (possibly including regular expression globbing), and the second
part indicates permissible access modes (r: read, w: write, and x:
execute).
Spaces or Tabs: A white space of any kind (spaces or tabs) can pre-
cede path names or separate the path name from the access modes.
White space between the access mode and the trailing comma is
optional.
# profile to confine klogd
/sbin/klogd
{
#include <abstractions/base>
capability sys_admin,
/boot/* r,
/proc/kmsg r,
/sbin/klogd r,
/var/run/klogd.pid lw,
}

19
Profile Components and Syntax
When a profile is created for a program, the program can only access
the files, modes, and POSIX capabilities specified in the profile. These
restrictions are in addition to the native Linux access controls.
Example: To gain the capability CAP_CHOWN, the program must
have both access to CAP_CHOWN under conventional Linux access
controls (typically, be a root-owned process) and have “capability
chown” in its profile. Similarly, to be able to write to the file /foo/bar
the program must have both the correct user-ID and mode bits set in
the files attributes (see the chmod and chown man pages) and have
“/foo/bar w” in its profile.
Attempts to violate Novell AppArmor rules are recorded in syslog. In
many cases, Novell AppArmor rules will prevent an attack from work-
ing because necessary files are not accessible, and in all cases Novell
AppArmor confinement bounds the damage that the attacker can do to
the set of files permitted by Novell AppArmor.
#include
#includes are directives that pull in components of other Novell AppAr-
mor profiles to simplify profiles. Include files procure access permis-
sions for programs. By using an include, you can give the program
access to directory paths or files that are also required by other pro-
grams. Using includes can reduce the size of a profile.
By default, the #include statement appends the beginning of the path-
name to /etc/subdomain.d/ which is where it expects to find the include
file. Unlike other profile statements (but similar to C programs),
#include lines do not end with a comma.
Novell AppArmor provides two classes of #includes, Abstractions and
Program Chunks to assist you in profiling your applications.
Abstractions
Abstractions are #includes that are grouped by common application
tasks. These tasks include access to authentication mechanisms,
access to nameservice routines, common graphics requirements, and
system accounting, among others. Files listed in these abstractions
are specific to the named task; programs that require one of these files

User’s Guide
20
will usually require some of the other files listed in the abstraction file
(depending upon local configuration as well as the specific require-
ments of the program). Abstractions can be found in the following
directory:
/etc/subdomain.d/abstractions/
Program Chunks
The program chunks are access controls for specific programs that a
system administrator may wish to control based on local site policy.
Each chunk is used by a single program; these are provided to ease
local-site modifications to policy and updates to policy provided by
Novell. Administrators can modify policy in these files to suit their own
needs, leaving the program profiles unmodified, which will simplify the
task of merging policy updates from Novell into enforced policy at each
site.
The access restrictions in the program chunks are typically very liberal,
and are designed to allow your users access to their files in the least
intrusive way possible, while still allowing system resources to be pro-
tected. An exception to this rule is the postfix* series of program
chunks; these profiles are used to help abstract the location of the
postfix binaries. You will probably not want to reduce the permissions
in the postfix* series. Program Chunks can be found in the following
directory:
/etc/subdomain.d/program-chunks/
Capability Entries (POSIX.1e)
Capabilities statements are simply the word “capability” followed by the
name of the POSIX.1e capability as defined in the capabilities(7) man
page, which you can get to by typing man capabilities in a termi-
nal window.
Choosing the YaST GUI, YaST ncurses Console or
Command-line Interface
There are three ways you can build and manage Novell AppArmor pro-
files, depending on the type of computer environment you prefer. You