Novell APPARMOR 2.0 Manuale di istruzioni

Novell AppArmor

www.novell.com2.0

August28,2006 Novell AppArmor 2.0 Administration Guide

Novell AppArmor 2.0 Administration Guide

List of Authors: Leona Beatrice Campbell, Jana Jaeger

This publication is intellectual property of Novell Inc.

Its contents can be duplicated, either in part or in whole, provided that a copyright label is visibly lo-

cated on each copy.

All information found in this book has been compiled with utmost attention to detail. However, this

does not guarantee complete accuracy. Neither SUSE LINUX GmbH, the authors, nor the translators

shall be held liable for possible errors or the consequences thereof.

Novell, the Novell logo, the N logo and SUSE are registered trademarks of Novell, Inc. in the United

States and other countries. * Linux is a registered trademark of Linus Torvalds. All other third party

trademarks are the property of their respective owners.

Contents

About This Guide v

1Immunizing Programs 9

2Selecting Programs to Immunize 11

2.1 Immunize Programs That Grant Privilege . . . . . . . . . . . . . . . 11

2.2 Inspect Open Ports to Immunize Programs . . . . . . . . . . . . . . 12

3Building Novell AppArmor Proles 19

3.1 Prole Components and Syntax . . . . . . . . . . . . . . . . . . . 19

3.2 Building and Managing Novell AppArmor Proles . . . . . . . . . . . 23

3.3 Building Novell AppArmor Proles with the YaST GUI . . . . . . . . . . 24

3.4 Building Novell AppArmor Proles Using the Command Line Interface . . 47

3.5 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 51

3.6 Pathnames and Globbing . . . . . . . . . . . . . . . . . . . . . . 69

3.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . . 71

4Managing Proled Applications 77

4.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 77

4.2 Setting Up Event Notication . . . . . . . . . . . . . . . . . . . . 78

4.3 Reports............................. 81

4.4 Reacting to Security Events . . . . . . . . . . . . . . . . . . . . 102

4.5 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 102

5Proling Your Web Applications Using ChangeHat Apache 105

5.1 ApacheChangeHat........................ 106

5.2 Apache Conguration for apache2-mod-apparmor . . . . . . . . . . 113

6Support 117

6.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 117

6.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 117

6.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 119

6.4 Troubleshooting......................... 120

6.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 121

ABackground Information on AppArmor Proling 123

Glossary 125

About This Guide

Novell® AppArmor is designed to provide easy-to-use application security for both

servers and workstations. Novell AppArmor is an access control system that lets you

specify per program which les the program may read, write, and execute. AppArmor

secures applications by enforcing good application behavior without relying on attack

signatures, so can prevent attacks even if they are exploiting previously unknown vul-

nerabilities.

Novell AppArmor consists of:

• A library of AppArmor proles for common Linux* applications describing what

les the program needs to access.

• A library of AppArmor prole foundation classes (prole building blocks) needed

for common application activities, such as DNS lookup and user authentication.

• A tool suite for developing and enhancing AppArmor proles, so that you can

change the existing proles to suit your needs and create new proles for your own

local and custom applications.

• Several specially modied applications that are AppArmor enabled to provide en-

hanced security in the form of unique subprocess connement, including Apache.

• The Novell AppArmor–loadable kernel module and associated control scripts to

enforce AppArmor policies on your SUSE® Linux system.

This guide covers the following topics:

Immunizing Programs

Describes the operation of Novell AppArmor.

Selecting Programs to Immunize

Describes the types of programs that should have Novell AppArmor proles created

for them.

Building Novell AppArmor Proles

Describes how to use the Novell AppArmor tools to immunize your own programs

and third-party programs that you may have installed on your SUSE Linux system.

It also helps you to add, edit, or delete proles that have been created for your ap-

plications.

Managing Proled Applications

Describes how to perform Novell AppArmor prole maintenance, which involves

tracking common issues and concerns.

Proling Your Web Applications Using ChangeHat Apache

Enables you to create subproles for the Apache Web server that allow you to

tightly conne small sections of Web application processing.

Support

Indicates support options for this product.

Glossary

Provides a list of terms and their denitions.

NOTE

Novell AppArmor ships with any SUSE Linux–based Novell operating system.

Text references to SUSE Linux apply to SUSE Linux OSS, the SUSE Linux retail

product, and the SUSE Linux Enterprise product family.

1 Feedback

We want to hear your comments and suggestions about this manual and the other doc-

umentation included with this product. Please use the User Comments feature at the

bottom of each page of the online documentation and enter your comments there.

2 Documentation Conventions

The following typographical conventions are used in this manual:

•/etc/passwd: lenames and directory names

•placeholder: replace placeholder with the actual value

vi Novell AppArmor 2.0 Administration Guide

•PATH: the environment variable PATH

•ls,--help: commands, options, and parameters

•user: users or groups

•Alt ,Alt +F1 : a key to press or a key combination; keys are shown in uppercase

as on a keyboard

•File,File →Save As: menu items, buttons

•Dancing Penguins (Chapter Penguins, ↑Reference): This is a reference to a chapter

in another book.

About This Guide vii

Immunizing Programs

Novell® AppArmor provides immunization technologies that protect SUSE Linux ap-

plications from the inherent vulnerabilities they possess. After installing Novell App-

Armor, setting up Novell AppArmor proles, and rebooting the computer, your system

becomes immunized because it begins to enforce the Novell AppArmor security policies.

Protecting programs with Novell AppArmor is referred to as immunizing.

Novell AppArmor sets up a collection of default application proles to protect standard

Linux services. To protect other applications, use the Novell AppArmor tools to create

proles for the applications that you want protected. This chapter introduces the philos-

ophy of immunizing programs. Proceed to Chapter 3, Building Novell AppArmor Proles

(page 19) if you are ready to build and manage Novell AppArmor proles.

Novell AppArmor provides streamlined access control for network services by specifying

which les each program is allowed to read, write, and execute. This ensures that each

program does what it is supposed to do and nothing else.

Novell AppArmor is host intrusion prevention, or mandatory access control scheme,

that is optimized for servers. Previously, access control schemes were centered around

users because they were built for large timeshare systems. Alternatively, modern network

servers largely do not permit users to log in, but instead provide a variety of network

services for users, such as Web, mail, le, and print. Novell AppArmor controls the

access given to network services and other programs to prevent weaknesses from being

exploited.

Immunizing Programs 9

TIP: Background Information for Novell AppArmor

To get a more in-depth overview of AppArmor and the overall concept behind

it, refer to Appendix A, Background Information on AppArmor Proling

(page 123).

10 Novell AppArmor 2.0 Administration Guide

Indice

Altri manuali Novell Software

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 Manuale utente

Novell

Novell ZENWORKS PATCH MANAGEMENT 6.3 - S Manuale di istruzioni

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manuale tecnico

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - OPENOFFICE Manuale utente

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP1 - START UP GUIDE... Manuale utente

Novell

Novell GROUPWISE 7 GATEWAY FOR MICROSOFT EXCHANGE - INSTALLATION AND... Manuale di istruzioni

Novell

Novell ZENWORKS LINUX MANAGEMENT 7.2 IR2 - ... Manuale utente

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 - GNOME... Manuale utente

Novell

Novell LINUX ENTERPRISE DESKTOP 11 Manuale utente

Novell

Novell IDENTITY MANAGER DRIVER FOR ID PROVIDER 3.6.1 -... Manuale utente

Novell

Novell GROUPWISE 8 - RESOURCES Manuale utente

Novell

Novell GROUPWISE 8 - MONITOR Manuale utente

Novell

Novell OPEN ENTERPRISE SERVER 2 SP2 - STORAGE SERVICES AUDITING CLIENT LOGGER UTILITY REFERENCE... Manuale di servizio

Novell

Novell GROUPWISE 8 - MONITOR Manuale utente

Novell

Novell GROUPWISE 7 WEBACCESS Manuale utente

Novell

Novell ENHANCED SMART CARD METHOD 3.0.1 - INSTALLATION... Manuale utente

Novell

Novell GROUPWISE 7 - DISTRIBUTION LISTS Manuale utente

Novell

Novell IFOLDER 3.6 - SECURITY ADMINISTRATION Manuale utente

Novell

Novell SUPPORT ADVISOR 2.0.1 Manuale di istruzioni

Novell

Novell CLIENT FOR LINUX 2.0 Manuale utente

Novell

Novell ACCESS MANAGER 3.1 SP2 - SSL VPN USER GUIDE... Manuale utente

Novell

Novell LINUX ENTERPRISE SERVER 10 SP1 - ARCHITECTURE-SPECIFIC INFORMATION... Manuale

Novell

Novell POLICY IN DESIGNER 3.5 - 09-18-2009 Manuale utente

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Guida di riferimento rapido

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente

Lexmark

Lexmark Apps Manuale di servizio