== Open Week -- Introduction to AppArmor -- John Johansen -- Wed, May 4 == {{{#!IRC [18:02] Logs for this session will be available at http://irclogs.ubuntu.com/2011/05/04/%23ubuntu-classroom.html following the conclusion of the session. [18:05] well lets get started [18:05] Hello and welcome to the AppArmor session. [18:05] My name is John Johansen and I am a Kernel Engineer for Canonical [18:06] For those not familiar with AppArmor it is a mandatory access control (MAC) style security system. Basically it limits an application to a preset list of resources, [18:06] whether it is run as root or not, and it is always gets applied ie. the user doesn't get to change it. [18:06] Today I plan to walk through the basics of AppArmor, feel free to ask questions at anytime, though if they don't fit into the current discussion I may wait until later to answer them. [18:07] We are going to need a terminal open as AppArmor currently does not have [18:07] any GUI based tools. [18:07] In unity you can do this by pressing the meta (windows) key and typing terminal [18:07] or in the classic gnome environment Applications >> Accessories >> Terminal [18:08] First up we will look do some basic introspection of AppArmor [18:08] To see if apparmor is enabled from the terminal type [18:08] aa-status [18:09] if enabled it will return [18:09] apparmor module is loaded. [18:09] You do not have enough privilege to read the profile set. [18:09] that is enough to tell apparmor is loaded and active but not see what it is doing [18:10] to get a full picture we need to use sudo [18:10] sudo aa-status [18:10] will return a much larger list of items [18:11] eg. [18:11] apparmor module is loaded. [18:11] 47 profiles are loaded. [18:11] 12 profiles are in enforce mode. [18:11] /sbin/dhclient [18:11] /usr/bin/evince [18:11] /usr/bin/evince-previewer [18:11] /usr/bin/evince-thumbnailer [18:11] /usr/lib/NetworkManager/nm-dhcp-client.action [18:11] /usr/lib/chromium-browser/chromium-browser//browser_java [18:11] /usr/lib/chromium-browser/chromium-browser//browser_openjdk [18:11] /usr/lib/connman/scripts/dhclient-script [18:11] /usr/lib/cups/backend/cups-pdf [18:11] /usr/sbin/cupsd [18:11] /usr/sbin/tcpdump [18:11] /usr/share/gdm/guest-session/Xsession [18:11] 35 profiles are in complain mode. [18:11] that is just part of my listing [18:12] so on my example system, there are 47 profiles loaded into the kernel [18:13] of those 47 profiles only 12 of them are being enforced [18:13] this means that applications confined by those programs, can only do what is specified by the profile [18:14] if they try to do anything not specified by the profile the access will denied the application with EPERM or EACCES [18:14] the rest of the loaded profiles are in complain mode [18:15] this is a special "learning" mode where profiles confined by a profile don't have access listed in a profile fail [18:16] instead, the access is logged and allowed, so the application runs normally but the behavior and accesses are logged so they can be learned and a profile developed [18:18] the information aa-status spits out can also be obtained using ps -Z, but it won't be organized near as nice [18:18] but can be useful to know if you need to do something with shell scripting [18:18] eg. [18:19] pidof cupsd | xargs ps -Z [18:19] LABEL PID TTY STAT TIME COMMAND [18:19] /usr/sbin/cupsd 939 ? Ss 0:00 /usr/sbin/cupsd -F [18:19] shows that cupsd is confined by the /usr/sbin/cupsd profile [18:20] the LABEL column provided by the -Z option to ps is the profile listing [18:20] applications that are not confined by a profile are listed as unconfined [18:21] unconfined 4497 pts/1 00:00:00 bash [18:22] there is another useful command for introspecting network facing programs [18:22] aa-unconfined [18:22] it will show programs that are unconfined and have open network sockets [18:22] eg. [18:23] sudo aa-unconfined [18:23] 825 /usr/sbin/avahi-daemon confined by '/usr/sbin/avahi-daemon (complain)' [18:23] 825 /usr/sbin/avahi-daemon confined by '/usr/sbin/avahi-daemon (complain)' [18:23] 939 /usr/sbin/cupsd confined by '/usr/sbin/cupsd (enforce)' [18:23] 1671 /sbin/dhclient confined by '/sbin/dhclient (enforce)' [18:23] 1970 /usr/bin/mumble not confined [18:24] this can be real nice to help find applications that you would like to limit, as internet facing applications are generally the ones you need to worry about being hacked [18:25] aa-unconfined does have a limitation in that it only picks up applications with current connections, if an application is opening and closing connections (eg firefox), it may not list it [18:26] QUESTION: Why does sudo aa-unconfined show me multiple programs with the same pid? [18:27] well good question, it is likely because there are multiple threads, which share the pid [18:31] aa-unconfined, and aa-status both have man pages that are worth looking at [18:31] man aa-unconfined [18:31] man aa-status [18:32] both commands get their information mostly from 2 places (for those who like nitty gritty details) [18:32] /proc//attr/current [18:32] /sys/kernel/security/apparmor/profiles [18:33] they are worth poking at if you like figuring things out, btw should be replaced with a processes pid [18:33] eg. /proc/825/attr/current [18:34] so if you are using apparmor, I find one of the most useful things is the notifier [18:35] its in the apparmor-notifier package if you don't have it installed [18:36] from the command line you can install it using [18:36] sudo apt-get install apparmor-notifier [18:36] or you can search for it in the software center [18:37] this will install the aa-notify program and in natty turn it on by default [18:38] the notifier will pop up notifications when apparmor denies access to something [18:39] this can be real nice to have [18:40] either because it reminds you that apparmor is confining the application and that is possibly why you are getting unexpected behavior [18:41] or well because something happend that wasn't expected and apparmor stopped it [18:41] man aa-notify [18:41] for more details [18:42] actually one more detail [18:43] it doesn't start on its own, the enabled bit just allows it to get the information from the log files [18:43] I have it added to my startup applications [18:43] Name: AppArmor Notify [18:43] Command: /usr/sbin/apparmor-notify -p [18:43] Comment: startup apparmor notifications [18:45] so we have covered basic introspection, I want to switch gears for a minute and mention how to disable apparmor [18:46] generally I wouldn't but if it is causing problems, there are multiple ways to get it out of your way [18:47] the best is just disabling a profile, if you just have apparmor interfering with a single application that you need [18:48] you can run [18:48] sudo aa-disable [18:48] or if you like doing things manually [18:49] sudo ln -s /etc/apparmor.d/ /etc/apparmor.d/disable/ [18:49] where is the file name for the profile causing problems [18:50] however if you don't use aa-disable you will need to manually reload the profile set [18:50] /etc/init.d/apparmor reload [18:51] will do that for you [18:51] you can verify that the profile is gone with aa-status [18:52] disabling a single profile is the recommended way of working around a problem as it still leaves other applications protected by apparmor [18:52] There are 10 minutes remaining in the current session. [18:52] if you want to stop apparmor for all applications for the current session [18:53] /etc/init.d/apparmor teardown [18:53] will remove all current profiles, making every process unconfined [18:54] on reboot apparmor will be back to normal [18:54] if you want to disable apparmor on boot, you can enter [18:54] apparmor=0 [18:54] on the grub command line, [18:55] hopefully nobody will need those but it always seems to come up in bug reports [18:56] Alright switching back, so as you might have inferred apparmor stores its policy in [18:56] /etc/apparmor.d/ [18:56] these are simple text files, that get compiled by the apparmor_parser and loaded into the kernel for enforcement [18:57] the file names in the directory are actually arbitrary [18:57] There are 5 minutes remaining in the current session. [18:57] they don't have to be named after the applications that are being confined [18:57] it is just done by convention [18:58] also a file can contain multiple profiles, that is not usually done however unless they are related [19:02] Logs for this session will be available at http://irclogs.ubuntu.com/2011/05/04/%23ubuntu-classroom.html }}}