AppArmor - Revision history

Zcrayfish: Use path template. Remove HTML fluff.

2024-12-21T02:28:04Z

Use path template. Remove HTML fluff.

← Older revision		Revision as of 02:28, 21 December 2024
Line 7:		Line 7:
	{{Cmd\|# apk add {{Pkg\|apparmor}}}}		{{Cmd\|# apk add {{Pkg\|apparmor}}}}

	~~<br>~~

	You should also install <code>apparmor-utils</code> if you want to use the <code>aa</code> command to interact with AppArmor.		You should also install <code>apparmor-utils</code> if you want to use the <code>aa</code> command to interact with AppArmor.
Line 13:		Line 13:
	{{Cmd\|# apk add {{Pkg\|apparmor-utils}}}}		{{Cmd\|# apk add {{Pkg\|apparmor-utils}}}}

	~~<br>~~

	==Setup==		==Setup==
Line 19:		Line 19:
	Run the command {{Cmd\|# cat /sys/kernel/security/lsm}} to see what linux security modules are currently setup.		Run the command {{Cmd\|# cat /sys/kernel/security/lsm}} to see what linux security modules are currently setup.

	~~<br>~~

	=== With SYSLINUX ===		=== With SYSLINUX ===

	Use a text editor of your choice (preferably a TUI based one since some GUI setups don't work with privilege escalation, unless you use sudo -e) to edit ~~<pre>~~/boot/extlinux.conf~~</pre>~~ such that the <code>'''APPEND'''</code> line ends with the following:		Use a text editor of your choice (preferably a TUI based one since some GUI setups don't work with privilege escalation, unless you use sudo -e) to edit {{path\|/boot/extlinux.conf}} such that the <code>'''APPEND'''</code> line ends with the following:

	<pre>		<pre>
Line 31:		Line 31:
	Note that because you're including lsm in this .conf file you are overriding the default lsm. Thus, you should include any lsm that you saw previously running in the above cat command. Additionally, lsm initializes these modules in order, so their position is important in regards to major/minor modules. Ensure that apparmor is placed first among major modules. Note for convenience that yama, capability, and landlock, which come with Alpine Linux, are not major modules, and apparmor can be placed after them. The module called capability is automatically included and does not need to be written in.		Note that because you're including lsm in this .conf file you are overriding the default lsm. Thus, you should include any lsm that you saw previously running in the above cat command. Additionally, lsm initializes these modules in order, so their position is important in regards to major/minor modules. Ensure that apparmor is placed first among major modules. Note for convenience that yama, capability, and landlock, which come with Alpine Linux, are not major modules, and apparmor can be placed after them. The module called capability is automatically included and does not need to be written in.

	To persist your changes between kernel updates (which overwrite ~~<code>~~/boot/extlinux.conf~~</code>~~), edit ~~<code>~~/etc/update-extlinux.conf~~</code>~~, and append your <code>lsm=landlock,yama,apparmor</code> parameter to <code>default_kernel_opts</code>.		To persist your changes between kernel updates (which overwrite {{path\|/boot/extlinux.conf}}), edit {{path\|/etc/update-extlinux.conf}}, and append your <code>lsm=landlock,yama,apparmor</code> parameter to <code>default_kernel_opts</code>.

	=== With GRUB ===		=== With GRUB ===

	Add the following at the end of the value for key <code>'''GRUB_CMDLINE_LINUX_DEFAULT'''</code> to ~~<code>~~/etc/default/grub~~</code>~~:		Add the following at the end of the value for key <code>'''GRUB_CMDLINE_LINUX_DEFAULT'''</code> to {{path\|/etc/default/grub}}:

	<pre>		<pre>
Line 45:		Line 45:
	{{Cmd\|# grub-mkconfig -o /boot/grub/grub.cfg}}		{{Cmd\|# grub-mkconfig -o /boot/grub/grub.cfg}}

	~~<br>~~

	== Running ==		== Running ==
Line 95:		Line 95:
	{{Cmd\|# rc-update add auditd}}		{{Cmd\|# rc-update add auditd}}

	~~<br>~~

	Now you can generate your own profiles with		Now you can generate your own profiles with
Line 105:		Line 105:
	{{Cmd\|# aa-genprof /path/to/binary}}		{{Cmd\|# aa-genprof /path/to/binary}}

	~~<br>~~

	Note that for this to work you'll probably need to set a more verbose [https://linuxconfig.org/introduction-to-the-linux-kernel-log-levels kernel log level]. For improved security, set it back to a higher level afterwards.		Note that for this to work you'll probably need to set a more verbose [https://linuxconfig.org/introduction-to-the-linux-kernel-log-levels kernel log level]. For improved security, set it back to a higher level afterwards.
Line 120:		Line 120:
	== Troubleshooting ==		== Troubleshooting ==

	If you notice a bunch of AppArmor errors on boot, try running <code>aa-status</code> and <code>aa-enabled</code> in the terminal. If the output mentions AppArmor being disabled at boot, re-open your ~~<code>~~/boot/extlinux.conf~~</code>~~ file and make sure the '''APPEND''' line still ends with <code>lsm=landlock,yama,apparmor</code>		If you notice a bunch of AppArmor errors on boot, try running <code>aa-status</code> and <code>aa-enabled</code> in the terminal. If the output mentions AppArmor being disabled at boot, re-open your {{path\|/boot/extlinux.conf}} file and make sure the '''APPEND''' line still ends with <code>lsm=landlock,yama,apparmor</code>

Revsuine: persisting syslinux boot parameters between kernel updates

2024-12-19T13:59:03Z

persisting syslinux boot parameters between kernel updates

← Older revision		Revision as of 13:59, 19 December 2024
Line 29:		Line 29:
	</pre>		</pre>

	Note that because you're including lsm in this .conf file you are overriding the default lsm. Thus, you should include any lsm that you saw previously running in the above cat command. Additionally, lsm initializes these modules in order, so their position is important in regards to major/minor modules. Ensure that apparmor is placed first among major modules. Note for convenience that yama, capability, and landlock, which come with Alpine Linux, are not major modules, and apparmor can be placed after them. The module called capability is automatically included and does not need to be written in.		Note that because you're including lsm in this .conf file you are overriding the default lsm. Thus, you should include any lsm that you saw previously running in the above cat command. Additionally, lsm initializes these modules in order, so their position is important in regards to major/minor modules. Ensure that apparmor is placed first among major modules. Note for convenience that yama, capability, and landlock, which come with Alpine Linux, are not major modules, and apparmor can be placed after them. The module called capability is automatically included and does not need to be written in.

			To persist your changes between kernel updates (which overwrite <code>/boot/extlinux.conf</code>), edit <code>/etc/update-extlinux.conf</code>, and append your <code>lsm=landlock,yama,apparmor</code> parameter to <code>default_kernel_opts</code>.

	=== With GRUB ===		=== With GRUB ===

Gresskar: Added Audit as a dependency when generating AppArmor profiles with the aa-* commands

2024-06-12T20:47:20Z

Added Audit as a dependency when generating AppArmor profiles with the aa-* commands

← Older revision		Revision as of 20:47, 12 June 2024
Line 84:		Line 84:
	=== Creating additional profiles ===		=== Creating additional profiles ===

	~~The profiles provided by the apparmor-profiles package are just a starter. You can create your own profiles by running~~

	{{Cmd\|# aa-easyprof <binary ~~name>~~}}		The profiles provided by the apparmor-profiles package are just a starter. You can create your own profiles, but first you must install and start <code>audit</code>

			{{Cmd\|# apk add {{Pkg\|audit}}}}

			{{Cmd\|# rc-service auditd start}}

			{{Cmd\|# rc-update add auditd}}

			<br>

			Now you can generate your own profiles with

			{{Cmd\|# aa-easyprof /path/to/binary}}

	or		or

	{{Cmd\|# aa-genprof <binary ~~name>~~}}		{{Cmd\|# aa-genprof /path/to/binary}}

	<br>		<br>

154pinkchairs: /* Creating additional profiles */ mention that kernel log level should be set back to less verbose afterwards

2023-10-25T06:20:03Z

Creating additional profiles: mention that kernel log level should be set back to less verbose afterwards

← Older revision		Revision as of 06:20, 25 October 2023
Line 93:		Line 93:
	<br>		<br>

	Note that for this to work you'll probably need to set a more verbose [https://linuxconfig.org/introduction-to-the-linux-kernel-log-levels kernel log level].		Note that for this to work you'll probably need to set a more verbose [https://linuxconfig.org/introduction-to-the-linux-kernel-log-levels kernel log level]. For improved security, set it back to a higher level afterwards.


	== Use ==		== Use ==

Bbbhltz: /* See Also = */ typo

2023-05-14T16:24:24Z

Bbbhltz: Formatting, added resource links

2023-05-14T16:24:01Z

Formatting, added resource links

← Older revision		Revision as of 16:24, 14 May 2023
Line 82:		Line 82:
	{{Note\|Use <code>aa-enforce</code> to set it to enforce mode, '''but beware that this could break functionality'''.}}		{{Note\|Use <code>aa-enforce</code> to set it to enforce mode, '''but beware that this could break functionality'''.}}

	== ~~Additional~~ profiles ==		=== Creating additional profiles ===

	The profiles provided by the apparmor-profiles package are just a starter. You can create your own profiles by running		The profiles provided by the apparmor-profiles package are just a starter. You can create your own profiles by running
Line 108:		Line 108:

	If you notice a bunch of AppArmor errors on boot, try running <code>aa-status</code> and <code>aa-enabled</code> in the terminal. If the output mentions AppArmor being disabled at boot, re-open your <code>/boot/extlinux.conf</code> file and make sure the '''APPEND''' line still ends with <code>lsm=landlock,yama,apparmor</code>		If you notice a bunch of AppArmor errors on boot, try running <code>aa-status</code> and <code>aa-enabled</code> in the terminal. If the output mentions AppArmor being disabled at boot, re-open your <code>/boot/extlinux.conf</code> file and make sure the '''APPEND''' line still ends with <code>lsm=landlock,yama,apparmor</code>


			== See Also ===

			* [https://wiki.apparmor.net/ AppArmor Wiki]
			* [https://wiki.debian.org/AppArmor/HowToUse Debian Wiki: How to use AppArmor]
			* [https://wiki.archlinux.org/title/AppArmor AppArmor entry on ArchWiki]

	[[Category:Security]]		[[Category:Security]]
	[[Category:Kernel]]		[[Category:Kernel]]

Bbbhltz: /* Configuration */ added Extra Profile instructions

2023-05-14T16:14:21Z

Configuration: added Extra Profile instructions

@@ Line 65: / Line 65: @@
 {{Cmd|# apk add {{Pkg|apparmor-profiles}}}}
-Reboot.
+Reboot following installation
 == Additional profiles ==

Bbbhltz: moved TOC, small change to Use section

2023-04-22T20:57:58Z

moved TOC, small change to Use section

← Older revision		Revision as of 20:57, 22 April 2023
Line 1:		Line 1:
			{{TOC right}}

	AppArmor is a kernel security module that restricts individual programs' capabilities. This can allow administrators to prevent programs accessing system resources in malicious ways according to per-applications specifications. AppArmor works by following profiles, which dictate what each application is and is not allowed to do.		AppArmor is a kernel security module that restricts individual programs' capabilities. This can allow administrators to prevent programs accessing system resources in malicious ways according to per-applications specifications. AppArmor works by following profiles, which dictate what each application is and is not allowed to do.

	~~<br>~~

	== Installation ==		== Installation ==
Line 84:		Line 84:
	== Use ==		== Use ==

	View AppArmor's report ~~with the command aa-status~~		View AppArmor's report:

	{{Cmd\|# aa-status}}		{{Cmd\|# aa-status}}

Bbbhltz: Added to 'Kernel' category and some very minor formatting/styling changes

2023-04-20T11:14:38Z

Added to 'Kernel' category and some very minor formatting/styling changes

← Older revision		Revision as of 11:14, 20 April 2023
Line 9:		Line 9:
	<br>		<br>

	You should also install apparmor-utils if you want to use the aa command to interact with AppArmor.		You should also install <code>apparmor-utils</code> if you want to use the <code>aa</code> command to interact with AppArmor.

	{{Cmd\|# apk add {{Pkg\|apparmor-utils}}}}		{{Cmd\|# apk add {{Pkg\|apparmor-utils}}}}
Line 23:		Line 23:
	=== With SYSLINUX ===		=== With SYSLINUX ===

	Use a text editor of your choice (preferably a TUI based one since some GUI setups don't work with privilege escalation, unless you use sudo -e) to edit <pre>/boot/extlinux.conf</pre> such that the APPEND line ends with the following:		Use a text editor of your choice (preferably a TUI based one since some GUI setups don't work with privilege escalation, unless you use sudo -e) to edit <pre>/boot/extlinux.conf</pre> such that the <code>'''APPEND'''</code> line ends with the following:

	<pre>		<pre>
Line 30:		Line 30:

	Note that because you're including lsm in this .conf file you are overriding the default lsm. Thus, you should include any lsm that you saw previously running in the above cat command. Additionally, lsm initializes these modules in order, so their position is important in regards to major/minor modules. Ensure that apparmor is placed first among major modules. Note for convenience that yama, capability, and landlock, which come with Alpine Linux, are not major modules, and apparmor can be placed after them. The module called capability is automatically included and does not need to be written in.		Note that because you're including lsm in this .conf file you are overriding the default lsm. Thus, you should include any lsm that you saw previously running in the above cat command. Additionally, lsm initializes these modules in order, so their position is important in regards to major/minor modules. Ensure that apparmor is placed first among major modules. Note for convenience that yama, capability, and landlock, which come with Alpine Linux, are not major modules, and apparmor can be placed after them. The module called capability is automatically included and does not need to be written in.

	~~<br>~~

	=== With GRUB ===		=== With GRUB ===

	Add the following at the end of the value for key '''GRUB_CMDLINE_LINUX_DEFAULT''' to /etc/default/grub:		Add the following at the end of the value for key <code>'''GRUB_CMDLINE_LINUX_DEFAULT'''</code> to <code>/etc/default/grub</code>:

	<pre>		<pre>
Line 42:		Line 40:

	Then apply with:		Then apply with:

	{{Cmd\|# grub-mkconfig -o /boot/grub/grub.cfg}}		{{Cmd\|# grub-mkconfig -o /boot/grub/grub.cfg}}

Line 48:		Line 47:
	== Running ==		== Running ==

	Next, start AppArmor and tell ~~openrc~~ to start it on boot.		Next, start AppArmor and tell [[OpenRC]] to start it on boot.


	{{Cmd\|# rc-service apparmor start}}		{{Cmd\|# rc-service apparmor start}}

	{{Cmd\|# rc-update add apparmor boot}}		{{Cmd\|# rc-update add apparmor boot}}

	~~<br>~~		You can check if AppArmor is running with the command <code>aa-enabled</code>

	You can check if AppArmor is running with the command aa-enabled

	{{Cmd\|# aa-enabled}}		{{Cmd\|# aa-enabled}}

	~~<br>~~

	==Configuration==		== Configuration ==

	AppArmor works using rules established in profiles. A set of pre-made profiles is available for ease of use:		AppArmor works using rules established in profiles. A set of pre-made profiles is available for ease of use:
Line 68:		Line 66:

	Reboot.		Reboot.


	== Additional profiles ==		== Additional profiles ==
Line 74:		Line 73:

	{{Cmd\|# aa-easyprof <binary name>}}		{{Cmd\|# aa-easyprof <binary name>}}

	or		or

	{{Cmd\|# aa-genprof <binary name>}}		{{Cmd\|# aa-genprof <binary name>}}
	<br>		<br>

	Note that for this to work you'll probably need to set a more verbose [https://linuxconfig.org/introduction-to-the-linux-kernel-log-levels kernel log level.]		Note that for this to work you'll probably need to set a more verbose [https://linuxconfig.org/introduction-to-the-linux-kernel-log-levels kernel log level].

	==Use==
			== Use ==

	View AppArmor's report with the command aa-status		View AppArmor's report with the command aa-status
Line 88:		Line 90:
	This details how many and what profiles are in use as well as relevant findings, such as how many profiles are in complain mode or in kill mode.		This details how many and what profiles are in use as well as relevant findings, such as how many profiles are in complain mode or in kill mode.

	~~==Troubleshoot==~~

	If you notice a bunch of AppArmor errors on boot, try running aa-status and aa-enabled in the terminal. If the output mentions AppArmor being disabled at boot, re-open your /boot/extlinux.conf file and make sure the APPEND line still ends with lsm=landlock,yama,apparmor		== Troubleshooting ==

			If you notice a bunch of AppArmor errors on boot, try running <code>aa-status</code> and <code>aa-enabled</code> in the terminal. If the output mentions AppArmor being disabled at boot, re-open your <code>/boot/extlinux.conf</code> file and make sure the '''APPEND''' line still ends with <code>lsm=landlock,yama,apparmor</code>

	[[Category:Security]]		[[Category:Security]]
			[[Category:Kernel]]

154pinkchairs: /* Additional profiles */ fix spelling

2023-04-11T01:24:11Z

Additional profiles: fix spelling

← Older revision		Revision as of 01:24, 11 April 2023
Line 78:		Line 78:
	<br>		<br>

	Note that for this to work you'll probably need to set a more ~~vebose~~ [https://linuxconfig.org/introduction-to-the-linux-kernel-log-levels kernel log level.]		Note that for this to work you'll probably need to set a more verbose [https://linuxconfig.org/introduction-to-the-linux-kernel-log-levels kernel log level.]

	==Use==		==Use==

← Older revision		Revision as of 16:24, 14 May 2023
Line 110:		Line 110:


	== See Also ===		== See Also ==

	* [https://wiki.apparmor.net/ AppArmor Wiki]		* [https://wiki.apparmor.net/ AppArmor Wiki]