Novell APPARMOR 1.2 Instruction Manual

Novell AppArmor

Immunix

Administration

Guide

www.novell.com

1.2 09/29/2005

Novell AppArmor Powered by Immunix 1.2 Administra-

tion Guide

Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this docu-

mentation, and specically disclaims any express or implied warranties of merchantability or tness

for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to

make changes to its content, at any time, without obligation to notify any person or entity of such re-

visions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and

specically disclaims any express or implied warranties of merchantability or tness for any particular

purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software,

at any time, without any obligation to notify any person or entity of such changes.

You may not use, export, or re-export this product in violation of any applicable laws or regulations

including, without limitation, U.S. export regulations or the laws of the country in which you reside.

reproduced, photocopied, stored on a retrieval system, or transmitted without the express written

consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is

described in this document. In particular, and without limitation, these intellectual property rights

may include one or more of the U.S. patents listed at http://www.novell.com/company/

legal/patents/ and one or more additional patents or pending patent applications in the U.S.

and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the online documentation for this and other Novell products, and

to get updates, see www.novell.com/documentation.

Novell Trademarks

AppArmor is a registered trademark of Novell, Inc. in the United States and other countries.

Immunix is a trademark of Novell, Inc. in the United States and other countries.

Novell is a registered trademark of Novell, Inc. in the United States and other countries.

SUSE is a registered trademark of SUSE LINUX Products GmbH, a Novell business.

Third-Party Materials

All third-party trademarks are the property of their respective owners.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED

TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTIC-

ULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR CONTRIBUTORS BE

LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSE-

QUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTI-

TUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUP-

TION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CON-

TRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

POSSIBILITY OF SUCH DAMAGE.

Contents

Introduction to Novell AppArmor vii

1Immunizing Programs 13

2Selecting Programs to Immunize 15

2.1 Immunize Programs That Grant Privilege . . . . . . . . . . . . . . . 15

2.2 Inspect Open Ports to Immunize Programs . . . . . . . . . . . . . . 16

3Building Novell AppArmor Proles 21

3.1 Prole Components and Syntax . . . . . . . . . . . . . . . . . . . 21

3.2 Building and Managing Novell AppArmor Proles . . . . . . . . . . . 24

3.3 Building Novell AppArmor Proles with the YaST GUI . . . . . . . . . . 26

3.4 Building Novell AppArmor Proles Using the Command Line Interface . . 49

3.5 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 54

3.6 Pathnames and Globbing . . . . . . . . . . . . . . . . . . . . . . 73

3.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . . 74

4Managing Proled Applications 77

4.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 77

4.2 Setting Up Event Notication . . . . . . . . . . . . . . . . . . . . 78

4.3 Reports............................. 81

4.4 Reacting to Security Events . . . . . . . . . . . . . . . . . . . . 102

4.5 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 103

5Proling Your Web Applications Using ChangeHat Apache 105

5.1 ApacheChangeHat........................ 106

5.2 Apache Conguration for mod_change_hat . . . . . . . . . . . . . 113

6Support 117

6.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 117

6.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 117

6.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 119

6.4 Troubleshooting......................... 119

6.5 Support for SUSE Linux . . . . . . . . . . . . . . . . . . . . . . 121

6.6 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 126

Glossary 129

Introduction to Novell

AppArmor

Novell® AppArmor Powered by Immunix is designed to provide easy-to-use application

security for both servers and workstations. Novell AppArmor is an access control system

that lets you specify per program which les the program may read, write, and execute.

AppArmor secures applications by enforcing good application behavior without relying

on attack signatures, so can prevent attacks even if they are exploiting previously un-

known vulnerabilities.

Novell AppArmor consists of:

• A library of AppArmor proles for common Linux* applications describing what

les the program needs to access.

• A library of AppArmor prole foundation classes (prole building blocks) needed

for common application activities, such as DNS lookup and user authentication.

• A tool suite for developing and enhancing AppArmor proles, so that you can

change the existing proles to suit your needs and create new proles for your own

local and custom applications.

• Several specially modied applications that are AppArmor enabled to provide en-

hanced security in the form of unique subprocess connement, including Apache.

• The Novell AppArmor–loadable kernel module and associated control scripts to

enforce AppArmor policies on your SUSE® Linux system.

NOTE

Some distributions of SUSE Linux include a version of AppArmor that enforce

policies for a limited set of programs. These policies can be modied to suit

your particular environment using the included AppArmor tool set. To create

AppArmor proles for additional programs, an upgrade to the full version of

AppArmor is required.

1 Documentation Conventions

The following typographical conventions are used in this manual:

Menu Items, Field Names, and Screen Titles in GUIs

When using GUIs, eld names, menu and screen titles, and eld values are shown

as File.

Keys

Key names are listed as they appear on your keyboard, as in Enter and Esc .

Command

Linux commands (and other operating system commands, when used) are repre-

sented this way. This style should indicate to you that you can type the word

or phrase on the command line and press Enter to run the command.

Example 1 Command Environment

To use ls to view the contents in the current directory, enter ls in a terminal

window.

Filename

Filenames, directory names, paths, and RPM package names are represented this

way. This style should indicate that a particular le or directory exists by that name

on your Linux system.

Placeholders

Replace placeholder with the actual value that matches your setup.

Examples, Notes, and Warnings

Examples use Example: when appropriate. Notes and pertinent information are

shown with a Note or Warning ag, as in:

NOTE

Notes highlight information that might help better understand previous

paragraphs. Warnings provide important information that might seriously

affect the integrity of the product or your data.

viii

Computer Output

When you see text in this style, it indicates text displayed by the computer

on the command line. You see responses to typed commands, error messages, and

interactive prompts for your input during scripts or programs shown this way.

Example 2 Computer Output

Use the ls command to display the contents of a directory:

$ ls

Desktop about.html logs

Mail backupfiles mail

Trademarks

A trademark symbol (®, etc.) denotes a Novell trademark. An asterisk (*) denotes

a third-party trademark.

2 Understanding This Guide

Immunizing Programs

Describes operation of Novell AppArmor Powered by Immunix.

Selecting Programs to Immunize

Describes the types of programs that should have Novell AppArmor proles created

for them.

Building Novell AppArmor Proles

Describes how to use the Novell AppArmor tools to immunize your own programs

and third-party programs that you may have installed on your SUSE Linux system.

It also helps you to add, edit, or delete proles that have been created for your ap-

plications.

Managing Proled Applications

Describes how to perform Novell AppArmor prole maintenance, which involves

tracking common issues and concerns.

Proling Your Web Applications Using ChangeHat Apache

Enables you to create subproles for the Apache Web server that allow you to

tightly conne small sections of Web application processing.

Introduction to Novell AppArmor ix

Support

Indicates support options for this product.

Glossary

Provides a list of terms and their denitions.

3 Getting Started with Novell

AppArmor

Novell AppArmor Powered by Immunix (Novell AppArmor) provides you with tech-

nologies to protect your applications from their own vulnerabilities by creating Novell

AppArmor proles for applications on your SUSE Linux system.

3.1 Launching Novell AppArmor through

the YaST GUI

SUSE Linux offers the utility YaST. Using YaST, you can launch the Novell AppArmor

interface. This is the recommended method for a novice Linux user. For the other

available methods, refer to Section 3.2, “Building and Managing Novell AppArmor

Proles” (page 24).

•To start YaST, select System →Control Center (YaST) from the SUSE menu.

YaST is launched as shown in Section 3.2, “Novell AppArmor Basics” (page x),

below. You can refer to this section to navigate in Novell AppArmor.

NOTE

Alternately, you can launch the YaST GUI by opening a terminal window then

entering yast2 while logged in as root.

3.2 Novell AppArmor Basics

Novell AppArmor enables you to manage proles through a simple user interface.

Table of contents

Other Novell Software manuals

Novell

Novell INTERNET STORAGE NAME SERVICE 1.0 -... User manual

Novell

Novell CLIENT 1.0 FOR LINUX - README User manual

Novell

Novell GROUPWISE 8 - RESOURCES User manual

Novell

Novell DATA SYNCHRONIZER MOBILITY PACK - UPDATE 2 User manual

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - UPGARDE GUIDE... Installation and operation manual

Novell

Novell GROUPWISE 7 - TROUBLESHOOTING 2 User manual

Novell

Novell OPEN WORKGROUP SUITE SMALL BUSINESS EDITION 2.0 -... User manual

Novell

Novell OPEN ENTERPRISE SERVER CLUSTER SERVICES 1.8.2 -... User manual

Novell

Novell LINUX ENTERPRISE SERVER 10 SP2 - ARCHITECTURE-SPECIFIC INFORMATION... Manual

Novell

Novell GROUPWISE 7 - POST OFFICE AGENT User manual

Novell

Novell IDENTITY MANAGER 3.6.1 - CLIENT LOGIN EXTENSION... User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Programming manual

Novell

Novell IDENTITY AUDIT 1.0 - GUIDE User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Quick guide

Novell

Novell ZENWORKS 7.2 LINUX MANAGEMENT - SCENARIOS 2... User manual

Novell

Novell IDENTITY MANAGER 3.6.1 Installation guide

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 User manual

Novell

Novell LINUX ENTERPRISE SERVER 11 - VIRTUALIZATION User manual

Novell

Novell OPEN ENTERPRISE SERVER 2 SP 2 - CLUSTER SERVICES 1.8.7 FOR... User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... User manual

Novell

Novell GROUPWISE 7 - TROUBLESHOOTING 3 User manual

Novell

Novell PRIVILEGED USER MANAGER EVALUATION - User manual

Novell

Novell LOGIN SCRIPTS - 08-2008 User manual

Novell

Novell IFOLDER 3.8 - DEPLOYMENT Quick reference guide

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual

Lexmark

Lexmark Apps Administrator's guide