Novell APPARMOR - AND Manual

Admin Guide
Novell AppArmor
Powered by Immunix

User’s Guide
2
Introduction to AppArmor 3
Conventions Used in This User’s Guide 3
Manual Text 3
Examples, Notes and Warnings 4
Command 4
Filename 4
Computer Output 4
Prompts 5
Understanding This User’s Guide 5
Getting Started With AppArmor 5
AppArmor Installation 6
Launching AppArmor through the YaST GUI 6
AppArmor Basics 6
Why Immunize Programs? 9
How To Immunize With AppArmor 9
What Should You Immunize? 10
Immunizing SetUID Programs 11
Immunizing Cron Jobs 11
Immunizing Web Applications 11
Immunizing Network Agents 13
How to Build AppArmor Profiles 16
Profile Components and Syntax 16
Breaking Down the AppArmor Profile Into Its Parts 16
#include 18
Capability Entries (POSIX.1e) 19
Choosing the YaST GUI, YaST ncurses Console or Command-line
Interface 19
To Use the YaST GUI 20
To Use the YaST ncurses Console 20
To use the Command-line Interface 20
Building AppArmor Profiles With the YaST GUI 21
Using the Add Profile Wizard 23
Editing a AppArmor Profile 28
Deleting a Profile 31
Update Profiles From Syslog Entries 32
Manually Adding a Profile 36
Managing AppArmor and Security Event Status 41
Building AppArmor Profiles Using the Command-line Interface 43
Checking the SubDomain Module Status 44
Building AppArmor Profiles 45
Add or Create a AppArmor Profile 46
Edit AppArmor Profile 46

3
Delete AppArmor Profile. 47
Two Methods of Profiling 47
Standalone Profiling 48
Systemic Profiling 48
Summary of Profiling Tools 50
Enforce Mode 52
Path Names and Regular Expression Matching 66
File Permission Access Modes 66
Read Mode 67
Write Mode 67
Discrete Profile Execute Mode 67
Unconstrained Execute Mode 67
Inherit Execute Mode 68
Link Mode 68
Managing Profiled Applications 69
Monitoring Your Secured Applications 69
Setting Up Event Notification 69
Creating Reports 70
Maintaining Your Security Profiles 73
Backing Up Your Security Profiles 74
Changing Your Security Profiles 74
Introducing New Software Into Your Environment 74
Profiling Your Web Applications Using ChangeHat Apache 76
What is ChangeHat? 76
Apache ChangeHat 76
Tools for Managing ChangeHat Aware Applications 77
phpsysinfo Hat (Subprofile) 80
Adding Hats and Entries to Hats 81
Apache Configuration for mod_change_hat 83
vhosts Directives 84
Location and Directory Directives 84
Support 88
Updating AppArmor Online 88
Using the Man Pages 89
Troubleshooting Solutions 90
Getting Online Support 91
Using Mailing List Support 91
Glossary 92

User’s Guide
4
Chapter 1 Introduction to Novell
AppArmor
The Novell AppArmor, powered by Immunix TM (or Novell AppArmor) is
designed to provide application security for both servers and worksta-
tions that is easy to use. Novell AppArmor secures applications by dif-
ferentiating between “good” and “bad” behaviors, permitting the good
and preventing the bad. This works to defend your systems without
resorting to attack signatures, and thus can prevent attacks even if
they are exploiting previously unknown vulnerabilities.
Novell AppArmor is a mandatory access control system designed for
application firewalling, Novell AppArmor lets you specify per program
which files the program may read, write, and execute.
Novell AppArmor is comprised of:
•A library of Novell AppArmor profiles for common Linux applications
describing what files the program needs to access.
•A library of Novell AppArmor profile foundation classes (profile
building blocks) needed for common application activities such as
DNS lookup and user authentication.
•A tool suite for developing and enhancing Novell AppArmor profiles,
so that you can change the existing profiles to suit your needs, and
create new profiles for your own local and custom applications.
•Several specially modified applications that are Novell AppArmor-
enabled to provide enhanced security in the form of Novell AppAr-
mor’s unique sub-process confinement, including Apache.
•The Novell AppArmor loadable kernel module and associated con-
trol scripts to enforce Novell AppArmor policies on your SuSE
LINUX Enterprise Server 9 systems.
Conventions Used in This User’s Guide
Manual Text
When using GUIs, field names, menu and screen titles, and field val-
ues are shown as File.

5
Conventions Used in This User’s Guide
Key names are listed as they appear on your keyboard, as in Enter
and Esc (for Escape).
Examples, Notes and Warnings
Examples are focused with Example: when appropriate. Notes and
pertinent information are shown with a Note: or Warning! flag, as in:
Note:
Notes highlight information that might help you to better understand
previous paragraphs. Warnings provide important information that
might seriously affect the integrity of the product or your data.
Command
Linux commands (and other operating system commands, when used)
are represented this way. This style should indicate to you that you
can type the word or phrase on the command line and press [Enter] to
invoke a command.
Example: To use ls to view the contents in the current directory,
you would type ls in a terminal window.
Filename
Filenames, directory names, paths, and RPM package names are rep-
resented this way. This style should indicate that a particular file or
directory exists by that name on your Linux system.
Computer Output
When you see text in this style, it indicates text displayed by the
computer on the command line. You will see responses to commands
you typed in, error messages, and interactive prompts for your input
during scripts or programs shown this way.
Example: Use the ls command to display the contents of a direc-
tory:
$ ls
Desktop about.html logs
Mail backupfiles mail

User’s Guide
6
Prompts
A prompt, which is a computer's way of signifying that it is ready for you
to input something, will be shown in this style.
Example: puter login:
Understanding This User’s Guide
For installation instructions, please refer to the separate Novell AppAr-
mor Installation & Quickstart Guide.
Chapter 2: Why Immunize Programs? describes operation of the
Novell AppArmor, powered by Immunix.
Chapter 3: What Should You Immunize? describes the types and
details about a program that should have Novell AppArmor profiles cre-
ated for them.
Chapter 4: How to Build Novell AppArmor Profiles describes how
to use the Novell AppArmor tools to immunize your own programs and
3rd party programs that you may have installed on your SuSe Linux. It
also helps you to add, edit or delete profiles that have been created for
your applications.
Chapter 5: Managing Profiled Applications describes how to per-
form Novell AppArmor profile maintenance, which involves tracking
common issues and concerns.
Chapter 6: Profiling Your Web Applications Using ChangeHat
Apache enables you to create subprofiles that can be applied to sev-
eral applications, saving you a great deal of time and redundant efforts.
Chapter 8: Glossary indicates support options for this product.
Getting Started With Novell AppArmor
The Novell AppArmor, powered by Immunix (Novell AppArmor) pro-
vides you with technologies to protect your applications from their own
vulnerabilities by creating Novell AppArmor profiles for applications on
your SuSE LINUX Enterprise Server 9 (SLES 9).

7
Getting Started With Novell AppArmor
Novell AppArmor Installation
After Installing the SLES 9, including the required packages, you are
ready to install Novell AppArmor. Refer to the Novell AppArmor Instal-
lation Guide for detailed installation steps.
Once Novell AppArmor is installed, you are ready to use it to manage
Novell AppArmor profiles.You can do this through the graphical user
interface (GUI) or by using the command line (refer to “Building Novell
AppArmor Profiles Using the Command-line Interface” on page46).
Launching Novell AppArmor through the YaST GUI
The SuSE LINUX Enterprise Server 9 offers the SUSE utility, Yet
Another Setup Tool (YaST). Using YaST, you can launch the Novell
AppArmor interface. This is the recommended method for a novice
Linux user. For the other available methods, refer to “Choosing the
YaST GUI, YaST ncurses Console or Command-line Interface” on
page 20.
1. To launch YaST, from the SuSE Menu, select System.
2. From the System cascading menu, select YaST. The YaST GUI is
launched as shown in Novell AppArmor Basics, below.You can
refer to this section to navigate Novell AppArmor.
Note: Alternately, you can launch the YaST GUI by opening a termi-
nal window typing yast2 while logged in as root.
Novell AppArmor Basics
Novell AppArmor enables you to manage profiles through a simple

User’s Guide
8
user interface.
1. From the YaST GUI, click Novell AppArmor in the left panel. The dif-
ferent Novell AppArmor configuration options display.
2. Select the appropriate Novell AppArmor configuration option by
clicking the corresponding icon.
3. Depending on the configuration option you select, refer to one of
the following locations in this guide:
• Add Profile Wizard: For detailed steps, refer to “Using the Add Pro-
file Wizard” on page24.
• Edit Profile: Edits an existing Novell AppArmor profile on your sys-
tem. For detailed steps, refer to “Editing a Novell AppArmor Profile”
on page 29.
• Delete Profile: Deletes an existing Novell AppArmor profile from your
system. For detailed steps, refer to “Deleting a Profile” on page32.
• Update Profile Wizard: For detailed steps, refer to “Update Profiles
From Syslog Entries” on page33.
• Manually Add Profile:Adds Novell AppArmor profile for an applica-
tion on your system without the help of the wizard. For detailed steps,
refer to “Manually Adding a Profile” on page37.

9
Getting Started With Novell AppArmor
• Review Novell AppArmor Security Events: For detailed steps,
refer to “Creating Reports” on page74.
• Novell AppArmor Control Panel: For detailed steps, refer to “Man-
aging Novell AppArmor and Security Event Status” on page43.

User’s Guide
10
Chapter 2 Why Immunize Programs?
Novell AppArmor provides Immunization technologies that protect
SLES 9 applications from the inherent vulnerabilities they possess.
After installing Novell AppArmor, setting up Novell AppArmor profiles
and rebooting the PC, your system becomes Immunized because it
begins to enforce the Novell AppArmor security policies. Protecting
programs with Novell AppArmor is referred to as Immunizing. In the
following sections, we explain why and how to immunize your pro-
grams.
Novell AppArmor sets you up with a collection of default application
profiles to protect standard Linux services. To protect other applica-
tions, use the Novell AppArmor tools to create profiles for the applica-
tions that you want protected. This chapter introduces you to the
philosophy of Immunizing programs. Proceed to Chapter 4: How to
Build Novell AppArmor Profiles if you’re ready to build and manage
Novell AppArmor profiles.
How To Immunize With Novell AppArmor
Novell AppArmor provides streamlined access control for network
services by specifying which files each program is allowed to read,
write, and execute. This ensures that each program does what it is
supposed to do, and nothing else.
Novell AppArmor is host intrusion prevention or a mandatory access
control scheme that is optimized for servers. Previously, access control
schemes were centered around users because they were built for large
time-share systems. Alternatively, modern network servers largely do
not permit users to log in, and instead provide a variety of network ser-
vices for users such as web, mail, file, print, etc. Novell AppArmor con-
trols the access given to network services and other programs to
prevent weaknesses from being exploited.