Novell APPARMOR 2.0 Instruction Manual
Novell AppArmor
www.novell.com2.0
August28,2006 Novell AppArmor 2.0 Administration Guide
Novell AppArmor 2.0 Administration Guide
List of Authors: Leona Beatrice Campbell, Jana Jaeger
This publication is intellectual property of Novell Inc.
Its contents can be duplicated, either in part or in whole, provided that a copyright label is visibly lo-
cated on each copy.
All information found in this book has been compiled with utmost attention to detail. However, this
does not guarantee complete accuracy. Neither SUSE LINUX GmbH, the authors, nor the translators
shall be held liable for possible errors or the consequences thereof.
Novell, the Novell logo, the N logo and SUSE are registered trademarks of Novell, Inc. in the United
States and other countries. * Linux is a registered trademark of Linus Torvalds. All other third party
trademarks are the property of their respective owners.
Contents
About This Guide v
1Immunizing Programs 9
2Selecting Programs to Immunize 11
2.1 Immunize Programs That Grant Privilege . . . . . . . . . . . . . . . 11
2.2 Inspect Open Ports to Immunize Programs . . . . . . . . . . . . . . 12
3Building Novell AppArmor Proles 19
3.1 Prole Components and Syntax . . . . . . . . . . . . . . . . . . . 19
3.2 Building and Managing Novell AppArmor Proles . . . . . . . . . . . 23
3.3 Building Novell AppArmor Proles with the YaST GUI . . . . . . . . . . 24
3.4 Building Novell AppArmor Proles Using the Command Line Interface . . 47
3.5 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 51
3.6 Pathnames and Globbing . . . . . . . . . . . . . . . . . . . . . . 69
3.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . . 71
4Managing Proled Applications 77
4.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 77
4.2 Setting Up Event Notication . . . . . . . . . . . . . . . . . . . . 78
4.3 Reports............................. 81
4.4 Reacting to Security Events . . . . . . . . . . . . . . . . . . . . 102
4.5 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 102
5Proling Your Web Applications Using ChangeHat Apache 105
5.1 ApacheChangeHat........................ 106
5.2 Apache Conguration for apache2-mod-apparmor . . . . . . . . . . 113
6Support 117
6.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 117
6.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 117
6.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 119
6.4 Troubleshooting......................... 120
6.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 121
ABackground Information on AppArmor Proling 123
Glossary 125
About This Guide
Novell® AppArmor is designed to provide easy-to-use application security for both
servers and workstations. Novell AppArmor is an access control system that lets you
specify per program which les the program may read, write, and execute. AppArmor
secures applications by enforcing good application behavior without relying on attack
signatures, so can prevent attacks even if they are exploiting previously unknown vul-
nerabilities.
Novell AppArmor consists of:
• A library of AppArmor proles for common Linux* applications describing what
les the program needs to access.
• A library of AppArmor prole foundation classes (prole building blocks) needed
for common application activities, such as DNS lookup and user authentication.
• A tool suite for developing and enhancing AppArmor proles, so that you can
change the existing proles to suit your needs and create new proles for your own
local and custom applications.
• Several specially modied applications that are AppArmor enabled to provide en-
hanced security in the form of unique subprocess connement, including Apache.
• The Novell AppArmor–loadable kernel module and associated control scripts to
enforce AppArmor policies on your SUSE® Linux system.
This guide covers the following topics:
Immunizing Programs
Describes the operation of Novell AppArmor.
Selecting Programs to Immunize
Describes the types of programs that should have Novell AppArmor proles created
for them.
Building Novell AppArmor Proles
Describes how to use the Novell AppArmor tools to immunize your own programs
and third-party programs that you may have installed on your SUSE Linux system.
It also helps you to add, edit, or delete proles that have been created for your ap-
plications.
Managing Proled Applications
Describes how to perform Novell AppArmor prole maintenance, which involves
tracking common issues and concerns.
Proling Your Web Applications Using ChangeHat Apache
Enables you to create subproles for the Apache Web server that allow you to
tightly conne small sections of Web application processing.
Support
Indicates support options for this product.
Glossary
Provides a list of terms and their denitions.
NOTE
Novell AppArmor ships with any SUSE Linux–based Novell operating system.
Text references to SUSE Linux apply to SUSE Linux OSS, the SUSE Linux retail
product, and the SUSE Linux Enterprise product family.
1 Feedback
We want to hear your comments and suggestions about this manual and the other doc-
umentation included with this product. Please use the User Comments feature at the
bottom of each page of the online documentation and enter your comments there.
2 Documentation Conventions
The following typographical conventions are used in this manual:
•/etc/passwd: lenames and directory names
•placeholder: replace placeholder with the actual value
vi Novell AppArmor 2.0 Administration Guide
•PATH: the environment variable PATH
•ls,--help: commands, options, and parameters
•user: users or groups
•Alt ,Alt +F1 : a key to press or a key combination; keys are shown in uppercase
as on a keyboard
•File,File →Save As: menu items, buttons
•Dancing Penguins (Chapter Penguins, ↑Reference): This is a reference to a chapter
in another book.
About This Guide vii
1
Immunizing Programs
Novell® AppArmor provides immunization technologies that protect SUSE Linux ap-
plications from the inherent vulnerabilities they possess. After installing Novell App-
Armor, setting up Novell AppArmor proles, and rebooting the computer, your system
becomes immunized because it begins to enforce the Novell AppArmor security policies.
Protecting programs with Novell AppArmor is referred to as immunizing.
Novell AppArmor sets up a collection of default application proles to protect standard
Linux services. To protect other applications, use the Novell AppArmor tools to create
proles for the applications that you want protected. This chapter introduces the philos-
ophy of immunizing programs. Proceed to Chapter 3, Building Novell AppArmor Proles
(page 19) if you are ready to build and manage Novell AppArmor proles.
Novell AppArmor provides streamlined access control for network services by specifying
which les each program is allowed to read, write, and execute. This ensures that each
program does what it is supposed to do and nothing else.
Novell AppArmor is host intrusion prevention, or mandatory access control scheme,
that is optimized for servers. Previously, access control schemes were centered around
users because they were built for large timeshare systems. Alternatively, modern network
servers largely do not permit users to log in, but instead provide a variety of network
services for users, such as Web, mail, le, and print. Novell AppArmor controls the
access given to network services and other programs to prevent weaknesses from being
exploited.
Immunizing Programs 9
TIP: Background Information for Novell AppArmor
To get a more in-depth overview of AppArmor and the overall concept behind
it, refer to Appendix A, Background Information on AppArmor Proling
(page 123).
10 Novell AppArmor 2.0 Administration Guide
Table of contents
Other Novell Software manuals
Novell
Novell GROUPWISE 8 - MONITOR User manual
Novell
Novell LINUX ENTERPRISE SERVER 10 SP1 - ARCHITECTURE-SPECIFIC INFORMATION... Manual
Novell
Novell iFOLDER 3.6 - READ ME 05-2008 User manual
Novell
Novell ZENWORKS LINUX MANAGEMENT 7.3 IR2 - ADMINISTRATION GUIDE... Instruction Manual
Novell
Novell XEN - ADMINISTRATION User manual
Novell
Novell GROUPWISE 8 - TROUBLESHOOTING 3 User manual
Novell
Novell GROUPWISE 7 - SECURITY POLICIES User manual
Novell
Novell PRIVILEGED USER MANAGER 2.2.1 - ADMINISTRATION GUIDE... User manual
Novell
Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - PREBOOT SERVICES AND IMAGING REFERENCE 10.3... Instruction Manual
Novell
Novell LINUX ENTERPRISE 11 SP1 - LINUX AUDIT User manual
Novell
Novell GROUPWISE 7 - CROSS-PLATFORM User manual
Novell
Novell ACCESS MANAGER 3.1 SP2 BETA 1 - SCENARIOS... User manual
Novell
Novell LINUX ENTERPRISE DESKTOP 10 SP2 - KDE... User manual
Novell
Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Technical manual
Novell
Novell GROUPWISE 8 - MONITOR User manual
Novell
Novell SERVER CONSOLIDATION MIGRATION TOOLKIT 1.2 - ADMINISTRATION GUIDE... Instruction Manual
Novell
Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0 -... User manual
Novell
Novell FILE SYSTEM FACTORY 1.2.1 - ADMINISTRATION User manual
Novell
Novell LINUX ENTERPRISE DESKTOP 10 - KDE 21-06-2006 User manual
Novell
Novell OPEN ENTERPRISE SERVER - CONVERSION GUIDE... User manual
Novell
Novell GROUPWISE 7 WEBACCESS User manual
Novell
Novell BUSINESS CONTINUITY CLUSTERING 1.1 SP1 - 9-21-2010 ADMINISTRATION GUIDE FOR OPEN ENTERPRISE SERVER 1 SP2... Instruction Manual
Novell
Novell GROUPWISE 7 - INTERNET AGENT User manual
Novell
Novell PLATESPIN ORCHESTRATE 2.0.2 - UPGARDE GUIDE... Operator's manual
