Novell APPARMOR 2.0.1 Mode d’emploi

Novell AppArmor

www.novell.com2.0.1

November29,2006 Novell AppArmor Administration Guide

Novell AppArmor Administration Guide

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU

Free Documentation License, Version 1.2 or any later version published by the Free Software Foun-

dation; with the Invariant Section being this copyright notice and license. A copy of the license is in-

cluded in the section entitled “GNU Free Documentation License”.

Novell, the Novell logo, the N logo, openSUSE, SUSE, and the SUSE “geeko” logo are registered

trademarks of Novell, Inc. in the United States and other countries. * Linux is a registered trademark

of Linus Torvalds. All other third party trademarks are the property of their respective owners.

All information found in this book has been compiled with utmost attention to detail. However, this

does not guarantee complete accuracy. Neither Novell, Inc., SUSE LINUX Products GmbH, the authors,

nor the translators shall be held liable for possible errors or the consequences thereof.

Contents

About This Guide v

1Immunizing Programs 9

1.1 Introducing the AppArmor Framework . . . . . . . . . . . . . . . . 10

1.2 Determining Programs to Immunize . . . . . . . . . . . . . . . . . 12

1.3 Immunizing Cron Jobs . . . . . . . . . . . . . . . . . . . . . . . 13

1.4 Immunizing Network Applications . . . . . . . . . . . . . . . . . . 13

2Prole Components and Syntax 19

2.1 Breaking a Novell AppArmor Prole into Its Parts . . . . . . . . . . . 19

2.2 #include Statements ...................... 21

2.3 Capability Entries (POSIX.1e) . . . . . . . . . . . . . . . . . . . . 22

3Building and Managing Proles With YaST 23

3.1 Adding a Prole Using the Wizard . . . . . . . . . . . . . . . . . . 25

3.2 Manually Adding a Prole . . . . . . . . . . . . . . . . . . . . . 32

3.3 EditingProles.......................... 33

3.4 DeletingaProle......................... 38

3.5 Updating Proles from Log Entries . . . . . . . . . . . . . . . . . . 39

3.6 Managing Novell AppArmor and Security Event Status . . . . . . . . . 40

4Building Proles via the Command Line 45

4.1 Checking the AppArmor Module Status . . . . . . . . . . . . . . . 45

4.2 Building Novell AppArmor Proles . . . . . . . . . . . . . . . . . . 47

4.3 Adding or Creating a Novell AppArmor Prole . . . . . . . . . . . . 48

4.4 Editing a Novell AppArmor Prole . . . . . . . . . . . . . . . . . . 48

4.5 Deleting a Novell AppArmor Prole . . . . . . . . . . . . . . . . . 48

4.6 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 49

4.7 Pathnames and Globbing . . . . . . . . . . . . . . . . . . . . . . 68

4.8 File Permission Access Modes . . . . . . . . . . . . . . . . . . . . 69

4.9 Important Filenames and Directories . . . . . . . . . . . . . . . . . 73

5Proling Your Web Applications Using ChangeHat 75

5.1 ApacheChangeHat........................ 76

5.2 Conguring Apache for mod_apparmor . . . . . . . . . . . . . . . 83

6Managing Proled Applications 87

6.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 87

6.2 Conguring Security Event Notication . . . . . . . . . . . . . . . . 88

6.3 Conguring Reports . . . . . . . . . . . . . . . . . . . . . . . . 91

6.4 Reacting to Security Event Rejections . . . . . . . . . . . . . . . . 110

6.5 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 111

7Support 113

7.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 113

7.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 113

7.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 115

7.4 Troubleshooting......................... 116

7.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 117

ABackground Information on AppArmor Proling 119

BGNU Licenses 121

B.1 GNU General Public License . . . . . . . . . . . . . . . . . . . . 121

B.2 GNU Free Documentation License . . . . . . . . . . . . . . . . . 129

Glossary 139

About This Guide

Novell® AppArmor is designed to provide easy-to-use application security for both

servers and workstations. Novell AppArmor is an access control system that lets you

specify per program which les the program may read, write, and execute. AppArmor

secures applications by enforcing good application behavior without relying on attack

signatures, so can prevent attacks even if they are exploiting previously unknown vul-

nerabilities.

Novell AppArmor consists of:

• A library of AppArmor proles for common Linux* applications describing what

les the program needs to access.

• A library of AppArmor prole foundation classes (prole building blocks) needed

for common application activities, such as DNS lookup and user authentication.

• A tool suite for developing and enhancing AppArmor proles, so that you can

change the existing proles to suit your needs and create new proles for your own

local and custom applications.

• Several specially modied applications that are AppArmor enabled to provide en-

hanced security in the form of unique subprocess connement, including Apache

and Tomcat.

• The Novell AppArmor–loadable kernel module and associated control scripts to

enforce AppArmor policies on your openSUSE™ system.

This guide covers the following topics:

Immunizing Programs

Describes the operation of Novell AppArmor and describes the types of programs

that should have Novell AppArmor proles created for them.

Prole Components and Syntax

Introduces the prole components and syntax.

Building and Managing Proles With YaST

Describes how to use the AppArmor YaST modules to build, maintain and update

proles.

Building Proles via the Command Line

Describes how to use the AppArmor command line tools to build, maintain and

update proles.

Proling Your Web Applications Using ChangeHat

Enables you to create subproles for the Apache Web server that allow you to

tightly conne small sections of Web application processing.

Managing Proled Applications

Describes how to perform Novell AppArmor prole maintenance, which involves

tracking common issues and concerns.

Support

Indicates support options for this product.

Glossary

Provides a list of terms and their denitions.

1 Feedback

We want to hear your comments and suggestions about this manual and the other doc-

umentation included with this product. Please use the User Comments feature at the

bottom of each page of the online documentation and enter your comments there.

2 Documentation Conventions

The following typographical conventions are used in this manual:

•/etc/passwd: lenames and directory names

•placeholder: replace placeholder with the actual value

•PATH: the environment variable PATH

•ls,--help: commands, options, and parameters

•user: users or groups

vi Novell AppArmor Administration Guide

•Alt,Alt +F1: a key to press or a key combination; keys are shown in uppercase as

on a keyboard

•File,File →Save As: menu items, buttons

•Dancing Penguins (Chapter Penguins, ↑Reference): This is a reference to a chapter

in another book.

3 Source Code

The source code of openSUSE is publicly available. To download the source code,

proceed as outlined under http://www.novell.com/products/suselinux/

source_code.html. If requested we send you the source code on a DVD. We need

to charge a $15 or €15 fee for creation, handling and postage. To request a DVD of the

source code, send an e-mail to [email protected] [mailto:sourcedvd@suse

.de] or mail the request to:

SUSE Linux Products GmbH

Product Management openSUSE

Maxfeldstr. 5

D-90409 Nürnberg

Germany

About This Guide vii

Immunizing Programs

Novell® AppArmor provides immunization technologies that protect applications from

the inherent vulnerabilities they possess. After installing Novell AppArmor, setting up

Novell AppArmor proles, and rebooting the computer, your system becomes immu-

nized because it begins to enforce the Novell AppArmor security policies. Protecting

programs with Novell AppArmor is referred to as immunizing.

Novell AppArmor sets up a collection of default application proles to protect standard

Linux services. In order to protect other applications, use the Novell AppArmor tools

to create proles for the applications that you want protected. This chapter introduces

the philosophy of immunizing programs. Proceed to Chapter 2, Prole Components

and Syntax (page 19), Chapter 3, Building and Managing Proles With YaST (page 23),

or Chapter 4, Building Proles via the Command Line (page 45) if you are ready to

build and manage Novell AppArmor proles.

Novell AppArmor provides streamlined access control for network services by specifying

which les each program is allowed to read, write, and execute. This ensures that each

program does what it is supposed to do and nothing else. Novell AppArmor quarantines

programs to protect the rest of the system from being damaged by a compromised

process.

Novell AppArmor is a host intrusion prevention, or mandatory access control scheme.

Previously, access control schemes were centered around users because they were built

for large timeshare systems. Alternatively, modern network servers largely do not permit

users to log in, but instead provide a variety of network services for users, such as Web,

mail, le, and print. Novell AppArmor controls the access given to network services

and other programs to prevent weaknesses from being exploited.

Immunizing Programs 9

TIP: Background Information for Novell AppArmor

To get a more in-depth overview of AppArmor and the overall concept behind

it, refer to Appendix A, Background Information on AppArmor Proling

(page 119).

1.1 Introducing the AppArmor

Framework

The following section provides you with a very basic understanding of what is happening

“behind the scenes” (and under the hood of the YaST interface) when you run App-

Armor.

An AppArmor prole is a plain text le containing path entries and access permissions,

see Section 2.1, “Breaking a Novell AppArmor Prole into Its Parts” (page 19) for a

detailed reference prole. The directives contained in this text le are then enforced

by the AppArmor routines to quarantine the process/program.

The following tools interact in the building and enforcement of AppArmor proles and

policies:

aa-unconned

aa-unconned detects any application running on your system that listens for net-

work connections and is not protected by an AppArmor prole. Refer to Section

“aa-unconned—Identifying Unprotected Processes” (page 67) for detailed infor-

mation on this tool.

aa-autodep

aa-autodep creates a basic skeleton of a prole that needs to be eshed out before

it is put to productive use. The resulting prole is loaded and put into complain

mode, reporting any behavior of the application that is not (yet) covered by App-

Armor rules. Refer to Section “aa-autodep—Creating Approximate Proles”

(page 52) for detailed information on this tool.

aa-genprof

aa-genprof generates a basic prole and asks you to rene this prole by executing

the application and thus generating log events that need to be taken care of by

10 Novell AppArmor Administration Guide

Table des matières

Autres manuels Novell Logiciel

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Manuel utilisateur

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 Manuel utilisateur

Novell

Novell CLIENT 1.0 FOR LINUX - README Manuel utilisateur

Novell

Novell GROUPWISE 8 - WEBACCESS Manuel utilisateur

Novell

Novell EDIRECTORY 8.8 SP3 Mode d’emploi

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0 - INTEGRATION AND STREAMING GUIDE... Manuel utilisateur

Novell

Novell GROUPWISE 8 - DISTRIBUTION LISTS Manuel utilisateur

Novell

Novell EDIRECTORY 8.8 - GUIDE Manuel utilisateur

Novell

Novell ZENWORKS ENDPOINT SECURITY MANAGEMENT 3.5 Manuel utilisateur

Novell

Novell GROUPWISE 7 - 04-2007 Manuel utilisateur

Novell

Novell OPEN WORKGROUP SUITE SMALL BUSINESS EDITION 9.3 - ADMINISTRATION... Manuel utilisateur

Novell

Novell GROUPWISE 8 - INTEROPERABILITY Manuel utilisateur

Novell

Novell DATA SYNCHRONIZER MOBILITY PACK - UPDATE 2 Manuel utilisateur

Novell

Novell LINUX ENTERPRISE 11 - SUBSCRIPTION MANAGEMENT TOOL GUIDE... Manuel utilisateur

Novell

Novell DATA SYNCHRONIZER - 07-2010 Manuel utilisateur

Novell

Novell APPARMOR 1.2 Mode d’emploi

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - KDE 17-03-2009 Manuel utilisateur

Novell

Novell OPEN ENTERPRISE SERVER 2 SP2 -... Manuel utilisateur

Novell

Novell PRIVILEGED USER MANAGER 2.2.1 - ADMINISTRATION GUIDE... Mode d’emploi

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Manuel utilisateur

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - KDE Manuel utilisateur

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 Manuel utilisateur

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Manuel de programmation

Novell

Novell IDENTITY MANAGER 3.6.1 - PASSWORD MANAGEMENT Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur

Lexmark

Lexmark Apps Manuel de service