Novell APPARMOR 2.0 Mode d’emploi

Novell AppArmor

www.novell.com2.0

August28,2006 Novell AppArmor 2.0 Administration Guide

Novell AppArmor 2.0 Administration Guide

List of Authors: Leona Beatrice Campbell, Jana Jaeger

This publication is intellectual property of Novell Inc.

Its contents can be duplicated, either in part or in whole, provided that a copyright label is visibly lo-

cated on each copy.

All information found in this book has been compiled with utmost attention to detail. However, this

does not guarantee complete accuracy. Neither SUSE LINUX GmbH, the authors, nor the translators

shall be held liable for possible errors or the consequences thereof.

Novell, the Novell logo, the N logo and SUSE are registered trademarks of Novell, Inc. in the United

States and other countries. * Linux is a registered trademark of Linus Torvalds. All other third party

trademarks are the property of their respective owners.

Contents

About This Guide v

1Immunizing Programs 9

2Selecting Programs to Immunize 11

2.1 Immunize Programs That Grant Privilege . . . . . . . . . . . . . . . 11

2.2 Inspect Open Ports to Immunize Programs . . . . . . . . . . . . . . 12

3Building Novell AppArmor Proles 19

3.1 Prole Components and Syntax . . . . . . . . . . . . . . . . . . . 19

3.2 Building and Managing Novell AppArmor Proles . . . . . . . . . . . 23

3.3 Building Novell AppArmor Proles with the YaST GUI . . . . . . . . . . 24

3.4 Building Novell AppArmor Proles Using the Command Line Interface . . 47

3.5 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 51

3.6 Pathnames and Globbing . . . . . . . . . . . . . . . . . . . . . . 69

3.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . . 71

4Managing Proled Applications 77

4.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 77

4.2 Setting Up Event Notication . . . . . . . . . . . . . . . . . . . . 78

4.3 Reports............................. 81

4.4 Reacting to Security Events . . . . . . . . . . . . . . . . . . . . 102

4.5 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 102

5Proling Your Web Applications Using ChangeHat Apache 105

5.1 ApacheChangeHat........................ 106

5.2 Apache Conguration for apache2-mod-apparmor . . . . . . . . . . 113

6Support 117

6.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 117

6.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 117

6.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 119

6.4 Troubleshooting......................... 120

6.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 121

ABackground Information on AppArmor Proling 123

Glossary 125

About This Guide

Novell® AppArmor is designed to provide easy-to-use application security for both

servers and workstations. Novell AppArmor is an access control system that lets you

specify per program which les the program may read, write, and execute. AppArmor

secures applications by enforcing good application behavior without relying on attack

signatures, so can prevent attacks even if they are exploiting previously unknown vul-

nerabilities.

Novell AppArmor consists of:

• A library of AppArmor proles for common Linux* applications describing what

les the program needs to access.

• A library of AppArmor prole foundation classes (prole building blocks) needed

for common application activities, such as DNS lookup and user authentication.

• A tool suite for developing and enhancing AppArmor proles, so that you can

change the existing proles to suit your needs and create new proles for your own

local and custom applications.

• Several specially modied applications that are AppArmor enabled to provide en-

hanced security in the form of unique subprocess connement, including Apache.

• The Novell AppArmor–loadable kernel module and associated control scripts to

enforce AppArmor policies on your SUSE® Linux system.

This guide covers the following topics:

Immunizing Programs

Describes the operation of Novell AppArmor.

Selecting Programs to Immunize

Describes the types of programs that should have Novell AppArmor proles created

for them.

Building Novell AppArmor Proles

Describes how to use the Novell AppArmor tools to immunize your own programs

and third-party programs that you may have installed on your SUSE Linux system.

It also helps you to add, edit, or delete proles that have been created for your ap-

plications.

Managing Proled Applications

Describes how to perform Novell AppArmor prole maintenance, which involves

tracking common issues and concerns.

Proling Your Web Applications Using ChangeHat Apache

Enables you to create subproles for the Apache Web server that allow you to

tightly conne small sections of Web application processing.

Support

Indicates support options for this product.

Glossary

Provides a list of terms and their denitions.

NOTE

Novell AppArmor ships with any SUSE Linux–based Novell operating system.

Text references to SUSE Linux apply to SUSE Linux OSS, the SUSE Linux retail

product, and the SUSE Linux Enterprise product family.

1 Feedback

We want to hear your comments and suggestions about this manual and the other doc-

umentation included with this product. Please use the User Comments feature at the

bottom of each page of the online documentation and enter your comments there.

2 Documentation Conventions

The following typographical conventions are used in this manual:

•/etc/passwd: lenames and directory names

•placeholder: replace placeholder with the actual value

vi Novell AppArmor 2.0 Administration Guide

•PATH: the environment variable PATH

•ls,--help: commands, options, and parameters

•user: users or groups

•Alt ,Alt +F1 : a key to press or a key combination; keys are shown in uppercase

as on a keyboard

•File,File →Save As: menu items, buttons

•Dancing Penguins (Chapter Penguins, ↑Reference): This is a reference to a chapter

in another book.

About This Guide vii

Immunizing Programs

Novell® AppArmor provides immunization technologies that protect SUSE Linux ap-

plications from the inherent vulnerabilities they possess. After installing Novell App-

Armor, setting up Novell AppArmor proles, and rebooting the computer, your system

becomes immunized because it begins to enforce the Novell AppArmor security policies.

Protecting programs with Novell AppArmor is referred to as immunizing.

Novell AppArmor sets up a collection of default application proles to protect standard

Linux services. To protect other applications, use the Novell AppArmor tools to create

proles for the applications that you want protected. This chapter introduces the philos-

ophy of immunizing programs. Proceed to Chapter 3, Building Novell AppArmor Proles

(page 19) if you are ready to build and manage Novell AppArmor proles.

Novell AppArmor provides streamlined access control for network services by specifying

which les each program is allowed to read, write, and execute. This ensures that each

program does what it is supposed to do and nothing else.

Novell AppArmor is host intrusion prevention, or mandatory access control scheme,

that is optimized for servers. Previously, access control schemes were centered around

users because they were built for large timeshare systems. Alternatively, modern network

servers largely do not permit users to log in, but instead provide a variety of network

services for users, such as Web, mail, le, and print. Novell AppArmor controls the

access given to network services and other programs to prevent weaknesses from being

exploited.

Immunizing Programs 9

TIP: Background Information for Novell AppArmor

To get a more in-depth overview of AppArmor and the overall concept behind

it, refer to Appendix A, Background Information on AppArmor Proling

(page 123).

10 Novell AppArmor 2.0 Administration Guide

Table des matières

Autres manuels Novell Logiciel

Novell

Novell ZENWORKS LINUX MANAGEMENT 7.2 IR2 - ADMINISTRATION GUIDE... Mode d’emploi

Novell

Novell IDENTITY MANAGER 3.6.1 - NULL SERVICE AND LOOPBACK SERVICE... Manuel utilisateur

Novell

Novell IDENTITY ASSURANCE SOLUTION 3.0.2 -... Manuel utilisateur

Novell

Novell EDIRECTORY 8.8 - GUIDE Manuel utilisateur

Novell

Novell GROUPWISE 7 - DOMAINS Manuel utilisateur

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Guide rapide

Novell

Novell SERVER CONSOLIDATION MIGRATION TOOLKIT 1.2 - ADMINISTRATION GUIDE... Mode d’emploi

Novell

Novell GROUPWISE 8 - WEBACCESS Manuel utilisateur

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - KDE 17-03-2009 Manuel utilisateur

Novell

Novell GROUPWISE 7 - DISTRIBUTION LISTS Manuel utilisateur

Novell

Novell GROUPWISE 7 - RESOURCES Manuel utilisateur

Novell

Novell GROUPWISE 7 GATEWAY FOR MICROSOFT EXCHANGE - INSTALLATION AND... Mode d’emploi

Novell

Novell ZENWORKS SUITE 7SP1 IR4 - GETTING STARTED GUIDE... Manuel utilisateur

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manuel d'installation et d'exploitation

Novell

Novell ACCESS MANAGER 3.1 SP2 - J2EE AGENT GUIDE... Manuel utilisateur

Novell

Novell EDIRECTORY 8.8 SP5 - GUIDE 12-2009 Manuel utilisateur

Novell

Novell IDENTITY MANAGER 3.6.1 - WORKORDER DRIVER IMPLEMENTATION GUIDE... Manuel utilisateur

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Guide rapide

Novell

Novell LINUX ENTERPRISE 11 - HIGH AVAILABILITY Manuel utilisateur

Novell

Novell LINUX ENTERPRISE DESKTOP 10 - KDE 21-06-2006 Manuel utilisateur

Novell

Novell GROUPWISE 7 - MULTI-SYSTEM ADMINISTRATION Manuel utilisateur

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manuel technique

Novell

Novell PRODUCT NAME 10.3 - DEPLOYING ZENWORKS ON CITRIX SERVER BEST PRACTICES GUIDE... Manuel utilisateur

Novell

Novell EDIRECTORY 8.8 - GUIDE Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur

Lexmark

Lexmark Apps Manuel de service