Apparmor and its usage - Revision history

Srugam at 15:10, 2 May 2017

2017-05-02T15:10:03Z

← Older revision		Revision as of 18:10, 2 May 2017
Line 1:		Line 1:
	=== AppArmor and its ~~ussage~~ ===		=== AppArmor and its usage ===
	== Whats is AppArmor ==		== Whats is AppArmor ==
	[[File:Apparmor_logo.png\|right\|thumb\|Logo]]		[[File:Apparmor_logo.png\|right\|thumb\|Logo]]

Mteivens at 19:37, 28 April 2017

2017-04-28T19:37:49Z

← Older revision		Revision as of 22:37, 28 April 2017
Line 95:		Line 95:

	fsuid=0 ouid=0 // file system id and object owner uid		fsuid=0 ouid=0 // file system id and object owner uid
			</pre>

			=== Sample profile explained ===
			<pre>
			# Last Modified: Wed Apr 26 21:46:31 2017
			#include <tunables/global>

			/usr/sbin/nginx { // profile
			#include <abstractions/base> // includes basic base rules

			capability dac_override, // can override Discretionary access control
			network inet stream, // can create ipv4 socket

			/etc/group r, //
			/etc/nginx/conf.d/ r, //
			/etc/nginx/mime.types r, //
			/etc/nginx/nginx.conf r, // file read allowed
			/etc/nginx/sites-enabled/ r, //
			/etc/nsswitch.conf r, //
			/etc/passwd r, //
			/etc/ssl/openssl.cnf r, //
			/usr/sbin/nginx mr, // allows reading and writing files in memory
			/var/log/nginx/error.log w, // write to file allowed
			/var/www/html/** r, // read allowed recursively inside directory
			}
	</pre>		</pre>

Mteivens: /* Example log record in complain mode */

2017-04-28T19:05:07Z

Example log record in complain mode

← Older revision		Revision as of 22:05, 28 April 2017
Line 76:		Line 76:
	=== Example log record in complain mode ===		=== Example log record in complain mode ===
	<code>		<code>
	Apr 27 17:42:19 test kernel: [~~11852~~.~~194015~~] audit: type=1400 audit(~~1493304139~~.~~134~~:~~32425~~): apparmor="ALLOWED" operation="~~sendmsg~~" ~~info="Failed name lookup - disconnected path" error=-13~~ profile="/usr/~~lib~~/~~dovecot/log~~" name="~~run/systemd~~/~~journal~~/~~dev-log~~" pid=~~21375~~ comm="~~log~~" requested_mask="w" denied_mask="w" fsuid=0 ouid=0		Apr 27 17:35:30 test kernel: [11443.630597] audit: type=1400 audit(1493303730.576:1168): apparmor="ALLOWED" operation="open" profile="/usr/sbin/proftpd" name="/etc/protocols" pid=21403 comm="proftpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
	</code>		</code>

			<pre>
			apparmor="ALLOWED" operation="open" //allows action

	~~<code>~~		profile="/usr/sbin/proftpd" //program which is allowed to open
	~~Apr 27 17:35:30 test kernel: [11443.630597] audit: type=1400 audit(1493303730.576:1168): apparmor="ALLOWED" operation="open"~~ profile="/usr/sbin/proftpd" name="/etc/protocols" pid=21403 comm="proftpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
	</~~code~~>		name="/etc/protocols" // file which will be opened

			pid=21403 //process id

			comm="proftpd" // actual command

			requested_mask="r" // requested action read

			denied_mask="r" // action to be denied

			fsuid=0 ouid=0 // file system id and object owner uid
			</pre>

	== Creating new profiles ==		== Creating new profiles ==

Mteivens: /* Example log record in complain mode */

2017-04-28T18:05:49Z

Example log record in complain mode

← Older revision		Revision as of 21:05, 28 April 2017
Line 75:		Line 75:

	=== Example log record in complain mode ===		=== Example log record in complain mode ===
	<~~pre~~>		<code>
	Apr 27 17:42:19 test kernel: [11852.194015] audit: type=1400 audit(1493304139.134:32425): apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/log" name="run/systemd/journal/dev-log" pid=21375 comm="log" requested_mask="w" denied_mask="w" fsuid=0 ouid=0		Apr 27 17:42:19 test kernel: [11852.194015] audit: type=1400 audit(1493304139.134:32425): apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/log" name="run/systemd/journal/dev-log" pid=21375 comm="log" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
	</~~pre~~>		</code>


	<~~pre~~>		<code>
	Apr 27 17:35:30 test kernel: [11443.630597] audit: type=1400 audit(1493303730.576:1168): apparmor="ALLOWED" operation="open" profile="/usr/sbin/proftpd" name="/etc/protocols" pid=21403 comm="proftpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0		Apr 27 17:35:30 test kernel: [11443.630597] audit: type=1400 audit(1493303730.576:1168): apparmor="ALLOWED" operation="open" profile="/usr/sbin/proftpd" name="/etc/protocols" pid=21403 comm="proftpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
	</~~pre~~>		</code>

	== Creating new profiles ==		== Creating new profiles ==

Mteivens at 15:23, 27 April 2017

2017-04-27T15:23:29Z

← Older revision		Revision as of 18:23, 27 April 2017
Line 74:		Line 74:
	* k - lock		* k - lock

	=== Example log record in complain mode ==		=== Example log record in complain mode ===
	<pre>		<pre>
	Apr 27 17:42:19 test kernel: [11852.194015] audit: type=1400 audit(1493304139.134:32425): apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/log" name="run/systemd/journal/dev-log" pid=21375 comm="log" requested_mask="w" denied_mask="w" fsuid=0 ouid=0		Apr 27 17:42:19 test kernel: [11852.194015] audit: type=1400 audit(1493304139.134:32425): apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/log" name="run/systemd/journal/dev-log" pid=21375 comm="log" requested_mask="w" denied_mask="w" fsuid=0 ouid=0

Mteivens at 14:48, 27 April 2017

2017-04-27T14:48:57Z

@@ Line 73: / Line 73: @@
 * l    - link
 * k    - lock
 == Creating new profiles ==

Mteivens: /* Practical example by hardening server */

2017-04-27T14:46:22Z

Practical example by hardening server

← Older revision		Revision as of 17:46, 27 April 2017
Line 226:		Line 226:
	[[File:Aa-status.png\|80px]]		[[File:Aa-status.png\|80px]]

			Next, to actually enable profiling on new process, you need to install AppArmor tools <code>apt-get install apparmor-utils</code>
			Then put proftpd process in complaint mode
			<code>
			aa-autodep proftpd
			aa-complain proftpd
			</code>

			If you are running more than one program in complain mode, then by default kernel might limit messages logged, and this might not let you build complete profile. To temporarily circumvent this, execute this command <code>sysctl -w kernel.printk_ratelimit=0</code>

			Next we check which services are running and listening to network sockets, but does not have profiles defined yet by running <code>aa-unconfined</code>
			In output you can see that there are some unconfined programs running. We skip perl because that is too generic, also SSH for now, and enable profiling for ProFTPD and some Dovecot subprocesses (we need to use full path for master process, because it is not in out $PATH).
			<pre>
			aa-autodep proftpd
			aa-autodep /usr/lib/postfix/sbin/master
			aa-autodep dovecot

			Then run them in complain mode

			aa-complain dovecot
			aa-complain proftpd
			aa-complain /usr/lib/postfix/sbin/master

			Restart services

			systemctl restart postfix
			systemctl restart dovecot
			systemctl restart proftpd
			</pre>

			After that just proceed to do normal things, browse and send emails, create new folders in IMAP account, upload and download files thru ProFTPD. After you think you have done everything you wanted to allow, run <code>aa-logprof</code> and generate profiles.
			Lets mass enable generated profiles in enforce mode
			<pre>
			aa-enforce /etc/apparmor.d/usr.lib.dovecot.*
			aa-enforce /etc/apparmor.d/usr.lib.postfix*
			aa-enforce proftpd
			</pre>

			Reminder that enabling profiles in enforced mode might render your system unstable. You need to have a clear plan, what your system is going to do. How many users will be there, what will they want to do, etc.

	== Getting additional rules ==		== Getting additional rules ==

Mteivens at 12:09, 27 April 2017

2017-04-27T12:09:06Z

← Older revision		Revision as of 15:09, 27 April 2017
Line 223:		Line 223:

	By checking <code>aa-status</code> you can see that there are bunch of profiles already in enforce and complain mode.		By checking <code>aa-status</code> you can see that there are bunch of profiles already in enforce and complain mode.

			[[File:Aa-status.png\|80px]]


Line 229:		Line 231:
	<code>apt install apparmor-profiles</code>.		<code>apt install apparmor-profiles</code>.
	They are installed in same default directory /etc/apparmor.d as the rest of profiles.		They are installed in same default directory /etc/apparmor.d as the rest of profiles.
	~~[[File:Aa-status.png\|right\|thumb\|Logo]]~~

	== Additional resources ==		== Additional resources ==

Mteivens at 12:04, 27 April 2017

2017-04-27T12:04:36Z

@@ Line 210: / Line 210: @@
+}
 </pre>
 == Getting additional rules ==
@@ Line 215: / Line 229: @@
 <code>apt install apparmor-profiles</code>.
 They are installed in same default directory /etc/apparmor.d as the rest of profiles.
 == Additional resources ==

Mteivens: /* Getting additional rules */

2017-04-27T11:10:32Z

Getting additional rules

← Older revision		Revision as of 14:10, 27 April 2017
Line 213:		Line 213:
	== Getting additional rules ==		== Getting additional rules ==
	You can download precreated AppArmor rules for most popular services by installing additional package		You can download precreated AppArmor rules for most popular services by installing additional package
	<code>apt install apparmor-profiles</code>		<code>apt install apparmor-profiles</code>.
			They are installed in same default directory /etc/apparmor.d as the rest of profiles.

	== Additional resources ==		== Additional resources ==