Contents
You are ready to build Novell AppArmor
profiles after you select the programs to profile. To do so, it is important
to understand the components and syntax of profiles. AppArmor profiles contain
several building blocks that help build simple and reusable profile code:
#include
files, abstractions, program chunks, and
capability entries. #include
statements are used to pull
in parts of other AppArmor profiles to simplify the structure of new profiles.
Abstractions are #include
statements grouped by common
application tasks. Program chunks are chunks of profiles that are specific to
program suites. Capability entries are profile entries for any of the
POSIX.1e Linux capabilities.
For help determining the programs to profile, refer to Section 1.2, “Determining Programs to Immunize”. To start building AppArmor profiles with YaST, proceed to Chapter 3, Building and Managing Profiles with YaST. To build profiles using the AppArmor command line interface, proceed to Chapter 4, Building Profiles from the Command Line.
Novell AppArmor profile components are called Novell AppArmor rules. Currently there are two main types of Novell AppArmor rules, path entries and capability entries. Path entries specify what the process can access in the file system and capability entries provide a more fine-grained control over what a confined process is allowed to do through other system calls that require privileges. Includes are a type of meta rule or directives that pull in path and capability entries from other files.
The easiest way of explaining what a profile consists of and how to
create one is to show the details of a sample profile. Consider, for
example, the following shortened profile for the program
/usr/lib/postfix/flush
(for the complete version,
refer to /etc/apparmor.d/usr.lib.postfix.flush
):
# profile to confine postfix/flush#include <tunables/global>
/usr/lib/postfix/flush
{
#include <abstractions/base>
... capability setgid
, ... /usr/lib/postfix/flush rix, /{var/spool/postfix/,}
deferred r, ... /{var/spool/postfix/,}flush rwl, ... /{var/spool/postfix/,}incoming r, ... /{var/spool/postfix/,}public/qmgr w, /etc/mtab
r, /etc/postfix/main.cf r, /etc/postfix/virtual.db r, @{HOME}
/.forward r, /proc/stat r, /proc/sys/kernel/ngroups_max r, /var/spool/postfix/pid/unix.flush rw, }
![]() | A comment naming the program that is
confined by this profile. Always precede comments like this with the
|
![]() | This loads a file containing variable definitions. |
![]() | The absolute path to the program that is confined. |
![]() | The curly braces ( |
![]() | This directive pulls in components of Novell AppArmor profiles to simplify profiles. |
![]() | Capability entry statements enable each of the 29 POSIX.1e draft capabilities. |
![]() | The curly braces ( |
![]() | A path entry specifying what areas of the file system the program
can access. The first part of a path entry specifies the absolute path of
a file (including regular expression globbing) and the second part
indicates permissible access modes ( |
![]() | This variable expands to a value that can be changed without changing the entire profile. |
![]() | Using Variables in Profiles |
---|---|
With the current AppArmor tools, variables as presented in the above example can only be used when manually editing and maintaining a profile. A typical example when variables come in handy are network scenarios
in which user home directories are not mounted in the standard location
|
When a profile is created for a program, the program can access only the files, modes, and POSIX capabilities specified in the profile. These restrictions are in addition to the native Linux access controls.
Example: .
To gain the capability CAP_CHOWN
, the program
must have both access to CAP_CHOWN
under
conventional Linux access controls (typically, be a root
-owned
process)
and have the capability chown in its profile. Similarly, to be able to write
to the file /foo/bar
the program must have both the
correct user ID and mode bits set in the files attributes (see the
chmod
and chown
man
pages) and have /foo/bar w
in its profile.
Attempts to violate Novell AppArmor rules are recorded in
/var/log/audit/audit.log
if the audit
package is installed or otherwise in
/var/log/messages
. In many cases, Novell AppArmor rules prevent
an attack from working because necessary files are not accessible and, in
all cases, Novell AppArmor confinement restricts the damage that the attacker can do
to the set of files permitted by Novell AppArmor.