Novell APPARMOR - AND Manual

Admin Guide

Novell AppArmor

User’s Guide

Introduction to AppArmor 3

Conventions Used in This User’s Guide 3

Manual Text 3

Examples, Notes and Warnings 4

Command 4

Filename 4

Computer Output 4

Prompts 5

Understanding This User’s Guide 5

Getting Started With AppArmor 5

AppArmor Installation 6

Launching AppArmor through the YaST GUI 6

AppArmor Basics 6

Why Immunize Programs? 9

How To Immunize With AppArmor 9

What Should You Immunize? 10

Immunizing SetUID Programs 11

Immunizing Cron Jobs 11

Immunizing Web Applications 11

Immunizing Network Agents 13

How to Build AppArmor Profiles 16

Profile Components and Syntax 16

Breaking Down the AppArmor Profile Into Its Parts 16

#include 18

Capability Entries (POSIX.1e) 19

Choosing the YaST GUI, YaST ncurses Console or Command-line

Interface 19

To Use the YaST GUI 20

To Use the YaST ncurses Console 20

To use the Command-line Interface 20

Building AppArmor Profiles With the YaST GUI 21

Using the Add Profile Wizard 23

Editing a AppArmor Profile 28

Deleting a Profile 31

Update Profiles From Syslog Entries 32

Manually Adding a Profile 36

Managing AppArmor and Security Event Status 41

Building AppArmor Profiles Using the Command-line Interface 43

Checking the SubDomain Module Status 44

Building AppArmor Profiles 45

Add or Create a AppArmor Profile 46

Edit AppArmor Profile 46

Delete AppArmor Profile. 47

Two Methods of Profiling 47

Standalone Profiling 48

Systemic Profiling 48

Summary of Profiling Tools 50

Enforce Mode 52

Path Names and Regular Expression Matching 66

File Permission Access Modes 66

Read Mode 67

Write Mode 67

Discrete Profile Execute Mode 67

Unconstrained Execute Mode 67

Inherit Execute Mode 68

Link Mode 68

Managing Profiled Applications 69

Monitoring Your Secured Applications 69

Setting Up Event Notification 69

Creating Reports 70

Maintaining Your Security Profiles 73

Backing Up Your Security Profiles 74

Changing Your Security Profiles 74

Introducing New Software Into Your Environment 74

Profiling Your Web Applications Using ChangeHat Apache 76

What is ChangeHat? 76

Apache ChangeHat 76

Tools for Managing ChangeHat Aware Applications 77

phpsysinfo Hat (Subprofile) 80

Adding Hats and Entries to Hats 81

Apache Configuration for mod_change_hat 83

vhosts Directives 84

Location and Directory Directives 84

Support 88

Updating AppArmor Online 88

Using the Man Pages 89

Troubleshooting Solutions 90

Getting Online Support 91

Using Mailing List Support 91

Glossary 92

User’s Guide

Chapter 1 Introduction to Novell

AppArmor

The Novell AppArmor, powered by Immunix TM (or Novell AppArmor) is

designed to provide application security for both servers and worksta-

tions that is easy to use. Novell AppArmor secures applications by dif-

ferentiating between “good” and “bad” behaviors, permitting the good

and preventing the bad. This works to defend your systems without

resorting to attack signatures, and thus can prevent attacks even if

they are exploiting previously unknown vulnerabilities.

Novell AppArmor is a mandatory access control system designed for

application firewalling, Novell AppArmor lets you specify per program

which files the program may read, write, and execute.

Novell AppArmor is comprised of:

•A library of Novell AppArmor profiles for common Linux applications

describing what files the program needs to access.

•A library of Novell AppArmor profile foundation classes (profile

building blocks) needed for common application activities such as

DNS lookup and user authentication.

•A tool suite for developing and enhancing Novell AppArmor profiles,

so that you can change the existing profiles to suit your needs, and

create new profiles for your own local and custom applications.

•Several specially modified applications that are Novell AppArmor-

enabled to provide enhanced security in the form of Novell AppAr-

mor’s unique sub-process confinement, including Apache.

•The Novell AppArmor loadable kernel module and associated con-

trol scripts to enforce Novell AppArmor policies on your SuSE

LINUX Enterprise Server 9 systems.

Conventions Used in This User’s Guide

Manual Text

When using GUIs, field names, menu and screen titles, and field val-

ues are shown as File.

Conventions Used in This User’s Guide

Key names are listed as they appear on your keyboard, as in Enter

and Esc (for Escape).

Examples, Notes and Warnings

Examples are focused with Example: when appropriate. Notes and

pertinent information are shown with a Note: or Warning! flag, as in:

Note:

Notes highlight information that might help you to better understand

previous paragraphs. Warnings provide important information that

might seriously affect the integrity of the product or your data.

Command

Linux commands (and other operating system commands, when used)

are represented this way. This style should indicate to you that you

can type the word or phrase on the command line and press [Enter] to

invoke a command.

Example: To use ls to view the contents in the current directory,

you would type ls in a terminal window.

Filename

Filenames, directory names, paths, and RPM package names are rep-

resented this way. This style should indicate that a particular file or

directory exists by that name on your Linux system.

Computer Output

When you see text in this style, it indicates text displayed by the

computer on the command line. You will see responses to commands

you typed in, error messages, and interactive prompts for your input

during scripts or programs shown this way.

Example: Use the ls command to display the contents of a direc-

tory:

$ ls

Desktop about.html logs

Mail backupfiles mail

User’s Guide

Prompts

A prompt, which is a computer's way of signifying that it is ready for you

to input something, will be shown in this style.

Example: puter login:

Understanding This User’s Guide

For installation instructions, please refer to the separate Novell AppAr-

mor Installation & Quickstart Guide.

Chapter 2: Why Immunize Programs? describes operation of the

Novell AppArmor, powered by Immunix.

Chapter 3: What Should You Immunize? describes the types and

details about a program that should have Novell AppArmor profiles cre-

ated for them.

Chapter 4: How to Build Novell AppArmor Profiles describes how

to use the Novell AppArmor tools to immunize your own programs and

3rd party programs that you may have installed on your SuSe Linux. It

also helps you to add, edit or delete profiles that have been created for

your applications.

Chapter 5: Managing Profiled Applications describes how to per-

form Novell AppArmor profile maintenance, which involves tracking

common issues and concerns.

Chapter 6: Profiling Your Web Applications Using ChangeHat

Apache enables you to create subprofiles that can be applied to sev-

eral applications, saving you a great deal of time and redundant efforts.

Chapter 8: Glossary indicates support options for this product.

Getting Started With Novell AppArmor

The Novell AppArmor, powered by Immunix (Novell AppArmor) pro-

vides you with technologies to protect your applications from their own

vulnerabilities by creating Novell AppArmor profiles for applications on

your SuSE LINUX Enterprise Server 9 (SLES 9).

Getting Started With Novell AppArmor

Novell AppArmor Installation

After Installing the SLES 9, including the required packages, you are

ready to install Novell AppArmor. Refer to the Novell AppArmor Instal-

lation Guide for detailed installation steps.

Once Novell AppArmor is installed, you are ready to use it to manage

Novell AppArmor profiles.You can do this through the graphical user

interface (GUI) or by using the command line (refer to “Building Novell

AppArmor Profiles Using the Command-line Interface” on page46).

Launching Novell AppArmor through the YaST GUI

The SuSE LINUX Enterprise Server 9 offers the SUSE utility, Yet

Another Setup Tool (YaST). Using YaST, you can launch the Novell

AppArmor interface. This is the recommended method for a novice

Linux user. For the other available methods, refer to “Choosing the

YaST GUI, YaST ncurses Console or Command-line Interface” on

page 20.

1. To launch YaST, from the SuSE Menu, select System.

2. From the System cascading menu, select YaST. The YaST GUI is

launched as shown in Novell AppArmor Basics, below.You can

refer to this section to navigate Novell AppArmor.

Note: Alternately, you can launch the YaST GUI by opening a termi-

nal window typing yast2 while logged in as root.

Novell AppArmor Basics

Novell AppArmor enables you to manage profiles through a simple

User’s Guide

user interface.

1. From the YaST GUI, click Novell AppArmor in the left panel. The dif-

ferent Novell AppArmor configuration options display.

2. Select the appropriate Novell AppArmor configuration option by

clicking the corresponding icon.

3. Depending on the configuration option you select, refer to one of

the following locations in this guide:

• Add Profile Wizard: For detailed steps, refer to “Using the Add Pro-

file Wizard” on page24.

• Edit Profile: Edits an existing Novell AppArmor profile on your sys-

tem. For detailed steps, refer to “Editing a Novell AppArmor Profile”

on page 29.

• Delete Profile: Deletes an existing Novell AppArmor profile from your

system. For detailed steps, refer to “Deleting a Profile” on page32.

• Update Profile Wizard: For detailed steps, refer to “Update Profiles

From Syslog Entries” on page33.

• Manually Add Profile:Adds Novell AppArmor profile for an applica-

tion on your system without the help of the wizard. For detailed steps,

refer to “Manually Adding a Profile” on page37.

Getting Started With Novell AppArmor

• Review Novell AppArmor Security Events: For detailed steps,

refer to “Creating Reports” on page74.

• Novell AppArmor Control Panel: For detailed steps, refer to “Man-

aging Novell AppArmor and Security Event Status” on page43.

User’s Guide

Chapter 2 Why Immunize Programs?

Novell AppArmor provides Immunization technologies that protect

SLES 9 applications from the inherent vulnerabilities they possess.

After installing Novell AppArmor, setting up Novell AppArmor profiles

and rebooting the PC, your system becomes Immunized because it

begins to enforce the Novell AppArmor security policies. Protecting

programs with Novell AppArmor is referred to as Immunizing. In the

following sections, we explain why and how to immunize your pro-

grams.

Novell AppArmor sets you up with a collection of default application

profiles to protect standard Linux services. To protect other applica-

tions, use the Novell AppArmor tools to create profiles for the applica-

tions that you want protected. This chapter introduces you to the

philosophy of Immunizing programs. Proceed to Chapter 4: How to

Build Novell AppArmor Profiles if you’re ready to build and manage

Novell AppArmor profiles.

How To Immunize With Novell AppArmor

Novell AppArmor provides streamlined access control for network

services by specifying which files each program is allowed to read,

write, and execute. This ensures that each program does what it is

supposed to do, and nothing else.

Novell AppArmor is host intrusion prevention or a mandatory access

control scheme that is optimized for servers. Previously, access control

schemes were centered around users because they were built for large

time-share systems. Alternatively, modern network servers largely do

not permit users to log in, and instead provide a variety of network ser-

vices for users such as web, mail, file, print, etc. Novell AppArmor con-

trols the access given to network services and other programs to

prevent weaknesses from being exploited.

Other manuals for APPARMOR - AND

Table of contents

Other Novell Software manuals

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - DEVELOPMENT CLIENT REFERENCE... Service manual

Novell

Novell GROUPWISE 8 - RESOURCES User manual

Novell

Novell ZENWORKS PATCH MANAGEMENT 6.4 - S Instruction Manual

Novell

Novell CLIENT FOR LINUX 2.0 SP1 - ADMINISTRATION User manual

Novell

Novell SENTINEL 6.1 SP2 - 02-2010 User manual

Novell

Novell CLIENT FOR LINUX 1.2 User manual

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - KDE 17-03-2009 User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... User manual

Novell

Novell IDENTITY MANAGER 3.6.1 User manual

Novell

Novell BUSINESS CONTINUITY CLUSTERING 1.1 SP1 - 9-21-2010 ADMINISTRATION GUIDE FOR OPEN ENTERPRISE SERVER 1 SP2... Instruction Manual

Novell

Novell APPARMOR 2.0.1 Instruction Manual

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 User manual

Novell

Novell ADMINSTUDIO 9.5 User manual

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... Instruction Manual

Novell

Novell APPARMOR 1.2 Instruction Manual

Novell

Novell ZENWORKS LINUX MANAGEMENT 7.2 IR2 - ... User manual

Novell

Novell BUSINESS CONTINUITY CLUSTERING 1.1 SP1 User manual

Novell

Novell LINUX ENTERPRISE DESKTOP 10 User manual

Novell

Novell SUPPORT ADVISOR - 04-2010 User manual

Novell

Novell EDIRECTORY 8.8 SP3 User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... User manual

Novell

Novell IDENTITY ASSURANCE SOLUTION 3.0.2 -... User manual

Novell

Novell IDENTITY MANAGER DRIVER FOR ID PROVIDER 3.6.1 -... User manual

Novell

Novell ZENWORKS ENDPOINT SECURITY MANAGEMENT 3.5 Instruction Manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual

Lexmark

Lexmark Apps Administrator's guide