AppArmor

Copyright © 2006-2007 Novell, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with the Invariant Section being this copyright notice and license. A copy of the license is included in the section entitled “GNU Free Documentation License”.

SUSE®, openSUSE®, the openSUSE® logo, Novell®, the Novell® logo, the N® logo, are registered trademarks of Novell, Inc. in the United States and other countries. Linux* is a registered trademark of Linus Torvalds. All other third party trademarks are the property of their respective owners. A trademark symbol (® , ™, etc.) denotes a Novell trademark; an asterisk (*) denotes a third-party trademark.

All information found in this book has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Neither Novell, Inc., SUSE LINUX Products GmbH, the authors, nor the translators shall be held liable for possible errors or the consequences thereof.


Contents

About This Guide
1. Feedback
2. Documentation Conventions
3. Source Code
1. Immunizing Programs
1.1. Introducing the AppArmor Framework
1.2. Determining Programs to Immunize
1.3. Immunizing cron Jobs
1.4. Immunizing Network Applications
2. Profile Components and Syntax
2.1. Breaking a Novell AppArmor Profile into Its Parts
2.2. #include Statements
2.3. Capability Entries (POSIX.1e)
2.4. Using the Local AppArmor Profile Repository
2.5. Using the Remote AppArmor Profile Repository
2.6. Important Filenames and Directories
3. Building and Managing Profiles with YaST
3.1. Adding a Profile Using the Wizard
3.2. Manually Adding a Profile
3.3. Editing Profiles
3.4. Deleting a Profile
3.5. Updating Profiles from Log Entries
3.6. Managing Novell AppArmor and Security Event Status
4. Building Profiles from the Command Line
4.1. Checking the AppArmor Module Status
4.2. Building AppArmor Profiles
4.3. Adding or Creating an AppArmor Profile
4.4. Editing an AppArmor Profile
4.5. Deleting an AppArmor Profile
4.6. Two Methods of Profiling
5. Profiling Your Web Applications Using ChangeHat
5.1. Apache ChangeHat
5.2. Configuring Apache for mod_apparmor
6. Managing Profiled Applications
6.1. Monitoring Your Secured Applications
6.2. Configuring Security Event Notification
6.3. Configuring Reports
6.4. Configuring and Using the AppArmor Desktop Monitor Applet
6.5. Reacting to Security Event Rejections
6.6. Maintaining Your Security Profiles
7. Support
7.1. Updating Novell AppArmor Online
7.2. Using the Man Pages
7.3. For More Information
7.4. Troubleshooting
7.5. Reporting Bugs for AppArmor
A. Background Information on AppArmor Profiling
B. GNU Licenses
B.1. GNU General Public License
B.2. GNU Free Documentation License
Glossary

List of Figures

3.1. YaST Controls for AppArmor
3.2. Learning Mode Exception: Controlling Access to Specific Resources
3.3. Learning Mode Exception: Defining Execute Permissions for an Entry

List of Tables

7.1. Man Pages: Sections and Categories

List of Examples

4.1. Learning Mode Exception: Controlling Access to Specific Resources
4.2. Learning Mode Exception: Defining Execute Permissions for an Entry
5.1. Example phpsysinfo-dev Hat