/etc/apparmor.d/ and they contain a list of access control rules on resources that each program can make use of. The profiles are compiled and loaded into the kernel by the apparmor_parser command. Each profile can be loaded either in enforcing or complaining mode. The former enforces the policy and reports violation attempts, while the latter does not enforce the policy but still logs the system calls that would have been denied.
apt install apparmor apparmor-profiles apparmor-utils with root privileges.
aa-status will confirm it quickly:
#aa-statusapparmor module is loaded. 40 profiles are loaded. 23 profiles are in enforce mode. /usr/bin/evince /usr/bin/evince-previewer [...] 17 profiles are in complain mode. /usr/sbin/dnsmasq [...] 14 processes have profiles defined. 12 processes are in enforce mode. /usr/bin/evince (3462) [...] 2 processes are in complain mode. /usr/sbin/avahi-daemon (429) avahi-daemon /usr/sbin/avahi-daemon (511) avahi-daemon 0 processes are unconfined but have a profile defined.
aa-enforce and aa-complain giving as parameter either the path of the executable or the path to the policy file. Additionally a profile can be entirely disabled with aa-disable or put in audit mode (to log accepted system calls too) with aa-audit.
#aa-enforce /usr/bin/pidginSetting /usr/bin/pidgin to enforce mode.#aa-complain /usr/sbin/dnsmasqSetting /usr/sbin/dnsmasq to complain mode.
aa-unconfined command to list the programs which have no associated profile and which expose an open network socket. With the --paranoid option you get all unconfined processes that have at least one active network connection.
#aa-unconfined801 /sbin/dhclient not confined 409 /usr/sbin/NetworkManager not confined 411 /usr/sbin/cupsd confined by '/usr/sbin/cupsd (enforce)' 429 /usr/sbin/avahi-daemon confined by 'avahi-daemon (enforce)' 516 /usr/sbin/cups-browsed confined by '/usr/sbin/cups-browsed (enforce)' 538 /usr/sbin/zebra not confined 591 /usr/sbin/named not confined 847 /usr/sbin/mysqld not confined 849 /usr/sbin/sshd not confined 1013 /usr/sbin/dhclient (/sbin/dhclient) not confined 1276 /usr/sbin/apache2 not confined 1322 /usr/sbin/apache2 not confined 1323 /usr/sbin/apache2 not confined 1324 /usr/sbin/apache2 not confined 1325 /usr/sbin/apache2 not confined 1327 /usr/sbin/apache2 not confined 1829 /usr/lib/ipsec/charon confined by '/usr/lib/ipsec/charon (enforce)' 2132 /usr/sbin/exim4 not confined 12865 /usr/bin/python3.7 (/usr/bin/python3) not confined 12873 /usr/bin/python3.7 (/usr/bin/python3) not confined
/sbin/dhclient. For this we will use aa-genprof dhclient. In Debian Buster there is a known bug[6] that makes the previous command fail with the following error: ERROR: Include file /etc/apparmor.d/local/usr.lib.dovecot.deliver not found. To fix it create the missing files with touch file. It will invite you to use the application in another window and when done to come back to aa-genprof to scan for AppArmor events in the system logs and convert those logs into access rules. For each logged event, it will make one or more rule suggestions that you can either approve or further edit in multiple ways:
#aa-genprof dhclientWriting updated profile for /usr/sbin/dhclient. Setting /usr/sbin/dhclient to complain mode. Before you begin, you may wish to check if a profile already exists for the application you wish to confine. See the following wiki page for more information: https://gitlab.com/apparmor/apparmor/wikis/Profiles Profiling: /usr/sbin/dhclient Please start the application to be profiled in another window and exercise its functionality now. Once completed, select the "Scan" option below in order to scan the system logs for AppArmor events. For each AppArmor event, you will be given the opportunity to choose whether the access should be allowed or denied. [(S)can system log for AppArmor events] / (F)inish Reading log entries from /var/log/syslog. Updating AppArmor profiles in /etc/apparmor.d. Profile: /usr/sbin/dhclientExecute: /usr/sbin/dhclient-script Severity: unknown (I)nherit / (C)hild / (P)rofile / (N)amed / (U)nconfined / (X) ix On / (D)eny / Abo(r)t / (F)inish
PShould AppArmor sanitise the environment when switching profiles? Sanitising environment is more secure, but some applications depend on the presence of LD_PRELOAD or LD_LIBRARY_PATH. (Y)es / [(N)o]YWriting updated profile for /usr/sbin/dhclient-script. Complain-mode changes: Profile: /usr/sbin/dhclientCapability: net_raw Severity: 8 [1 - capability net_raw,] [(A)llow] / (D)eny / (I)gnore / Audi(t) / Abo(r)t / (F)inish
AAdding capability net_raw to profile. Profile: /sbin/dhclient Capability: net_bind_service Severity: 8 [1 - #include <abstractions/nis> ] 2 - capability net_bind_service, (A)llow / [(D)eny] / (I)gnore / Audi(t) / Abo(r)t / (F)inishAAdding #include <abstractions/nis> to profile. Profile: /usr/sbin/dhclientPath: /etc/ssl/openssl.cnf New Mode: owner r Severity: 2 [1 - #include <abstractions/lightdm>] 2 - #include <abstractions/openssl> 3 - #include <abstractions/ssl_keys> 4 - owner /etc/ssl/openssl.cnf r, (A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish
2Profile: /usr/sbin/dhclient Path: /etc/ssl/openssl.cnf New Mode: owner r Severity: 2 1 - #include <abstractions/lightdm> [2 - #include <abstractions/openssl>] 3 - #include <abstractions/ssl_keys> 4 - owner /etc/ssl/openssl.cnf r, [(A)llow] / (D)eny / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Abo(r)t / (F)inish / (M)oreA[...] Profile: /usr/sbin/dhclient-scriptPath: /usr/bin/dash New Mode: owner r Severity: unknown [1 - #include <abstractions/lightdm>] 2 - #include <abstractions/ubuntu-browsers.d/plugins-common> 3 - owner /usr/bin/dash r, (A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish
AAdding #include <abstractions/lightdm> to profile. Deleted 2 previous matching profile entries. = Changed Local Profiles = The following local profiles were changed. Would you like to save them? [1 - /usr/sbin/dhclient] 2 - /usr/sbin/dhclient-script (S)ave Changes / Save Selec(t)ed Profile / [(V)iew Changes] / View Changes b/w (C)lean profiles / Abo(r)tSWriting updated profile for /usr/sbin/dhclient. Writing updated profile for /usr/sbin/dhclient-script. Profiling: /usr/sbin/dhclient Please start the application to be profiled in another window and exercise its functionality now. Once completed, select the "Scan" option below in order to scan the system logs for AppArmor events. For each AppArmor event, you will be given the opportunity to choose whether the access should be allowed or denied. [(S)can system log for AppArmor events] / (F)inishFReloaded AppArmor profiles in enforce mode. Please consider contributing your new profile! See the following wiki page for more information: https://gitlab.com/apparmor/apparmor/wikis/Profiles Finished generating profile for /usr/sbin/dhclient.
|
The first event detected is the execution of another program. In that case, you have multiple choices: you can run the program with the profile of the parent process (the “Inherit” choice), you can run it with its own dedicated profile (the “Profile” and the “Named” choices, differing only by the possibility to use an arbitrary profile name), you can run it with a sub-profile of the parent process (the “Child” choice), you can run it without any profile (the “Unconfined” choice) or you can decide to not run it at all (the “Deny” choice).
Note that when you opt to run it under a dedicated profile that doesn't exist yet, the tool will create the missing profile for you and will make rule suggestions for that profile in the same run.
|
|
At the kernel level, the special powers of the root user have been split in “capabilities”. When a system call requires a specific capability, AppArmor will verify whether the profile allows the program to make use of this capability.
|
|
Here the program seeks read permissions for /etc/ssl/openssl.cnf. aa-genprof detected that this permission was also granted by multiple “abstractions” and offers them as alternative choices. An abstraction provides a reusable set of access rules grouping together multiple resources that are commonly used together. In this specific case, the file is generally accessed through the nameservice related functions of the C library and we type “2” to first select the “#include <abstractions/openssl>” choice and then “A” to allow it.
|
|
Notice that this access request is not part of the dhclient profile but of the new profile that we created when we allowed /usr/sbin/dhclient-script to run with its own profile.
After having gone through all the logged events, the program offers to save all the profiles that were created during the run. In this case, we have two profiles that we save at once with “Save” (but you can save them individually too) before leaving the program with “Finish”.
|
aa-genprof is in fact only a smart wrapper around aa-logprof: it creates an empty profile, loads it in complain mode and then run aa-logprof which is a tool to update a profile based on the profile violations that have been logged. So you can re-run that tool later to improve the profile that you just created.
/etc/apparmor.d/usr.sbin.dhclient close to this:
# Last Modified: Fri Jul 5 00:51:02 2019
#include <tunables/global>
/usr/sbin/dhclient {
#include <abstractions/base>
#include <abstractions/nameservice>
capability net_bind_service,
capability net_raw,
/bin/dash r,
/etc/dhcp/* r,
/etc/dhcp/dhclient-enter-hooks.d/* r,
/etc/dhcp/dhclient-exit-hooks.d/* r,
/etc/resolv.conf.* w,
/etc/samba/dhcp.conf.* w,
/proc/*/net/dev r,
/proc/filesystems r,
/run/dhclient*.pid w,
/sbin/dhclient mr,
/sbin/dhclient-script rCx,
/usr/lib/NetworkManager/nm-dhcp-helper Px,
/var/lib/NetworkManager/* r,
/var/lib/NetworkManager/*.lease rw,
/var/lib/dhcp/*.leases rw,
owner /etc/** mrwk,
owner /var/** mrwk,
owner /{,var/}run/** mrwk,
}
/etc/apparmor.d/usr.sbin.dhclient-script might be similar to this:
# Last Modified: Fri Jul 5 00:51:55 2019
#include <tunables/global>
/usr/sbin/dhclient-script {
#include <abstractions/base>
#include <abstractions/bash>
#include <abstractions/lightdm>
}