Novell APPARMOR 2.0 Instruction Manual

Novell AppArmor

www.novell.com2.0

August28,2006 Novell AppArmor 2.0 Administration Guide

Novell AppArmor 2.0 Administration Guide

List of Authors: Leona Beatrice Campbell, Jana Jaeger

This publication is intellectual property of Novell Inc.

Its contents can be duplicated, either in part or in whole, provided that a copyright label is visibly lo-

cated on each copy.

All information found in this book has been compiled with utmost attention to detail. However, this

does not guarantee complete accuracy. Neither SUSE LINUX GmbH, the authors, nor the translators

shall be held liable for possible errors or the consequences thereof.

Novell, the Novell logo, the N logo and SUSE are registered trademarks of Novell, Inc. in the United

States and other countries. * Linux is a registered trademark of Linus Torvalds. All other third party

trademarks are the property of their respective owners.

Contents

About This Guide v

1Immunizing Programs 9

2Selecting Programs to Immunize 11

2.1 Immunize Programs That Grant Privilege . . . . . . . . . . . . . . . 11

2.2 Inspect Open Ports to Immunize Programs . . . . . . . . . . . . . . 12

3Building Novell AppArmor Proles 19

3.1 Prole Components and Syntax . . . . . . . . . . . . . . . . . . . 19

3.2 Building and Managing Novell AppArmor Proles . . . . . . . . . . . 23

3.3 Building Novell AppArmor Proles with the YaST GUI . . . . . . . . . . 24

3.4 Building Novell AppArmor Proles Using the Command Line Interface . . 47

3.5 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 51

3.6 Pathnames and Globbing . . . . . . . . . . . . . . . . . . . . . . 69

3.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . . 71

4Managing Proled Applications 77

4.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 77

4.2 Setting Up Event Notication . . . . . . . . . . . . . . . . . . . . 78

4.3 Reports............................. 81

4.4 Reacting to Security Events . . . . . . . . . . . . . . . . . . . . 102

4.5 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 102

5Proling Your Web Applications Using ChangeHat Apache 105

5.1 ApacheChangeHat........................ 106

5.2 Apache Conguration for apache2-mod-apparmor . . . . . . . . . . 113

6Support 117

6.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 117

6.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 117

6.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 119

6.4 Troubleshooting......................... 120

6.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 121

ABackground Information on AppArmor Proling 123

Glossary 125

About This Guide

Novell® AppArmor is designed to provide easy-to-use application security for both

servers and workstations. Novell AppArmor is an access control system that lets you

specify per program which les the program may read, write, and execute. AppArmor

secures applications by enforcing good application behavior without relying on attack

signatures, so can prevent attacks even if they are exploiting previously unknown vul-

nerabilities.

Novell AppArmor consists of:

• A library of AppArmor proles for common Linux* applications describing what

les the program needs to access.

• A library of AppArmor prole foundation classes (prole building blocks) needed

for common application activities, such as DNS lookup and user authentication.

• A tool suite for developing and enhancing AppArmor proles, so that you can

change the existing proles to suit your needs and create new proles for your own

local and custom applications.

• Several specially modied applications that are AppArmor enabled to provide en-

hanced security in the form of unique subprocess connement, including Apache.

• The Novell AppArmor–loadable kernel module and associated control scripts to

enforce AppArmor policies on your SUSE® Linux system.

This guide covers the following topics:

Immunizing Programs

Describes the operation of Novell AppArmor.

Selecting Programs to Immunize

Describes the types of programs that should have Novell AppArmor proles created

for them.

Building Novell AppArmor Proles

Describes how to use the Novell AppArmor tools to immunize your own programs

and third-party programs that you may have installed on your SUSE Linux system.

It also helps you to add, edit, or delete proles that have been created for your ap-

plications.

Managing Proled Applications

Describes how to perform Novell AppArmor prole maintenance, which involves

tracking common issues and concerns.

Proling Your Web Applications Using ChangeHat Apache

Enables you to create subproles for the Apache Web server that allow you to

tightly conne small sections of Web application processing.

Support

Indicates support options for this product.

Glossary

Provides a list of terms and their denitions.

NOTE

Novell AppArmor ships with any SUSE Linux–based Novell operating system.

Text references to SUSE Linux apply to SUSE Linux OSS, the SUSE Linux retail

product, and the SUSE Linux Enterprise product family.

1 Feedback

We want to hear your comments and suggestions about this manual and the other doc-

umentation included with this product. Please use the User Comments feature at the

bottom of each page of the online documentation and enter your comments there.

2 Documentation Conventions

The following typographical conventions are used in this manual:

•/etc/passwd: lenames and directory names

•placeholder: replace placeholder with the actual value

vi Novell AppArmor 2.0 Administration Guide

•PATH: the environment variable PATH

•ls,--help: commands, options, and parameters

•user: users or groups

•Alt ,Alt +F1 : a key to press or a key combination; keys are shown in uppercase

as on a keyboard

•File,File →Save As: menu items, buttons

•Dancing Penguins (Chapter Penguins, ↑Reference): This is a reference to a chapter

in another book.

About This Guide vii

Immunizing Programs

Novell® AppArmor provides immunization technologies that protect SUSE Linux ap-

plications from the inherent vulnerabilities they possess. After installing Novell App-

Armor, setting up Novell AppArmor proles, and rebooting the computer, your system

becomes immunized because it begins to enforce the Novell AppArmor security policies.

Protecting programs with Novell AppArmor is referred to as immunizing.

Novell AppArmor sets up a collection of default application proles to protect standard

Linux services. To protect other applications, use the Novell AppArmor tools to create

proles for the applications that you want protected. This chapter introduces the philos-

ophy of immunizing programs. Proceed to Chapter 3, Building Novell AppArmor Proles

(page 19) if you are ready to build and manage Novell AppArmor proles.

Novell AppArmor provides streamlined access control for network services by specifying

which les each program is allowed to read, write, and execute. This ensures that each

program does what it is supposed to do and nothing else.

Novell AppArmor is host intrusion prevention, or mandatory access control scheme,

that is optimized for servers. Previously, access control schemes were centered around

users because they were built for large timeshare systems. Alternatively, modern network

servers largely do not permit users to log in, but instead provide a variety of network

services for users, such as Web, mail, le, and print. Novell AppArmor controls the

access given to network services and other programs to prevent weaknesses from being

exploited.

Immunizing Programs 9

TIP: Background Information for Novell AppArmor

To get a more in-depth overview of AppArmor and the overall concept behind

it, refer to Appendix A, Background Information on AppArmor Proling

(page 123).

10 Novell AppArmor 2.0 Administration Guide

Table of contents

Other Novell Software manuals

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - UPGARDE GUIDE... Operator's manual

Novell

Novell ZENWORKS LINUX MANAGEMENT 7.2 IR2 - ... User manual

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - VIRTUAL MACHINE MANAGEMENT GUIDE... Programming manual

Novell

Novell EDIRECTORY 8.8 SP5 - TUNING GUIDE FOR UNIX... Quick start guide

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Service manual

Novell

Novell GROUPWISE 7 - MESSAGE TRANSFERT AGENT User manual

Novell

Novell EDIRECTORY 8.8 - GUIDE User manual

Novell

Novell EDIRECTORY 8.8 SP5 - GUIDE 12-2009 User manual

Novell

Novell LINUX ENTERPRISE SERVER 10 - STORAGE ADMINISTRATION GUIDE FOR... Instruction Manual

Novell

Novell INTERNET STORAGE NAME SERVICE 1.0 -... User manual

Novell

Novell IDENTITY MANAGER 3.6.1 - CLIENT LOGIN EXTENSION... User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Installation and operation manual

Novell

Novell EDIRECTORY 8.8 SP5 User manual

Novell

Novell IDENTITY MANAGER 3.6.1 - TASK SERVICE DRIVER User manual

Novell

Novell APPARMOR 1.2 Instruction Manual

Novell

Novell IFOLDER 3.7 - SECURITY ADMINISTRATION Instruction Manual

Novell

Novell CLIENT LOGIN EXTENSION 3.7 - ADMINISTRATION Instruction Manual

Novell

Novell APPARMOR 2.1 - Instruction Manual

Novell

Novell GROUPWISE 7 GATEWAY FOR MICROSOFT EXCHANGE - INSTALLATION AND... Instruction Manual

Novell

Novell SENTINEL RAPID DEPLOYMENT 6.1 - INSTALLATION GUIDE... User manual

Novell

Novell GROUPWISE 8 - DATABASES User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Operating manual

Novell

Novell ACCESS MANAGER 3.1 SP2 - SSL VPN USER GUIDE... User manual

Novell

Novell IDENTITY MANAGER 3.6.1 - JOBS GUIDE User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual

Lexmark

Lexmark Apps Administrator's guide