/etc/apparmor.d/ に保存され、プロファイルには各プログラムが使うことができるリソースに対するアクセス制御規則のリストが含まれています。プロファイルは apparmor_parser コマンドによってコンパイルされてカーネルに読み込まれます。各プロファイルは enforce または complain モードで読み込みます。enforce モードではポリシーの遵守を強制され、ポリシー違反の試行を報告されます。これに対して、complain モードではポリシーの遵守を強制されませんが、ポリシー違反で拒否されうるシステムコールを記録されます。
apt install apparmor apparmor-profiles apparmor-profiles-extra apparmor-utils with root privileges.
aa-status will confirm it quickly:
#aa-statusapparmor module is loaded. 40 profiles are loaded. 18 profiles are in enforce mode. /usr/bin/man [..] 22 profiles are in complain mode. [..] dnsmasq [..] 0 profiles are in kill mode. 0 profiles are in unconfined mode. 1 processes have profiles defined. 1 processes are in enforce mode. /usr/sbin/dhclient (473) /{,usr/}sbin/dhclient 0 processes are in complain mode. 0 processes are unconfined but have a profile defined. 0 processes are in mixed mode. 0 processes are in kill mode.
aa-enforce and aa-complain giving as parameter either the path of the executable or the path to the policy file. Additionally a profile can be entirely disabled with aa-disable or put in audit mode (to log accepted system calls too) with aa-audit.
#aa-enforce /usr/bin/pidginSetting /usr/bin/pidgin to enforce mode.#aa-complain /usr/sbin/dnsmasqSetting /usr/sbin/dnsmasq to complain mode.
aa-unconfined コマンドが用意されています。aa-unconfined コマンドは関連するプロファイルが存在せず開かれたネットワークソケットを公開しているプログラムを表示します。aa-unconfined に --paranoid オプションを付けて実行すれば、少なくとも 1 つ以上のアクティブなネットワーク接続を持つアクセス制限を設けていないプロセスがすべて表示されます。
#aa-unconfined473 /usr/sbin/dhclient confined by '/{,usr/}sbin/dhclient (enforce)' 521 /usr/sbin/sshd (sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups) not confined 1206 /usr/sbin/squid not confined 9931 /usr/bin/containerd not confined 11171 /usr/sbin/exim4 not confined
/sbin/dhclient (there already is a profile shipped by apparmor-profiles, so you can compare your results to the official one). For this we will use aa-genprof dhclient. It will invite you to use the application in another window and when done to come back to aa-genprof to scan for AppArmor events in the system logs and convert those logs into access rules. For each logged event, it will make one or more rule suggestions that you can either approve or further edit in multiple ways:
#aa-genprof dhclientUpdating AppArmor profiles in /etc/apparmor.d. Writing updated profile for /usr/sbin/dhclient. Setting /usr/sbin/dhclient to complain mode. Before you begin, you may wish to check if a profile already exists for the application you wish to confine. See the following wiki page for more information: https://gitlab.com/apparmor/apparmor/wikis/Profiles Profiling: /usr/sbin/dhclient Please start the application to be profiled in another window and exercise its functionality now. Once completed, select the "Scan" option below in order to scan the system logs for AppArmor events. For each AppArmor event, you will be given the opportunity to choose whether the access should be allowed or denied. [(S)can system log for AppArmor events] / (F)inishSReading log entries from /var/log/syslog. Profile: /usr/sbin/dhclientExecute: /usr/sbin/dhclient-script Severity: unknown (I)nherit / (C)hild / (P)rofile / (N)amed / (U)nconfined / (X) ix On / (D)eny / Abo(r)t / (F)inish
PShould AppArmor sanitise the environment when switching profiles? Sanitising environment is more secure, but some applications depend on the presence of LD_PRELOAD or LD_LIBRARY_PATH. [(Y)es] / (N)oYWriting updated profile for /usr/sbin/dhclient-script. WARNING: Ignoring exec event in /usr/sbin/dhclient//null-/usr/sbin/dhclient-script//null-/usr/bin/systemctl, nested profiles are not supported yet. Complain-mode changes: Profile: /usr/sbin/dhclientCapability: net_raw Severity: 8 [1 - capability net_raw,] (A)llow / [(D)eny] / (I)gnore / Audi(t) / Abo(r)t / (F)inish
AAdding capability net_raw, to profile. Profile: /usr/sbin/dhclient Capability: net_bind_service Severity: 8 [1 - include <abstractions/nis>] 2 - capability net_bind_service, (A)llow / [(D)eny] / (I)gnore / Audi(t) / Abo(r)t / (F)inishAAdding include <abstractions/nis> to profile. Profile: /usr/sbin/dhclientPath: /etc/dhcp/dhclient.conf New Mode: owner r Severity: unknown [1 - owner /etc/dhcp/dhclient.conf r,] (A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish
AAdding owner /etc/dhcp/dhclient.conf r, to profile. Profile: /usr/sbin/dhclientPath: /var/lib/dhcp/dhclient.leases New Mode: owner rw Severity: unknown [1 - owner /var/lib/dhcp/dhclient.leases rw,] (A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish
AAdding owner /var/lib/dhcp/dhclient.leases rw, to profile. [..] Profile: /usr/sbin/dhclient-scriptPath: /usr/bin/dash New Mode: owner r Severity: unknown [1 - include <abstractions/gvfs-open>] 2 - include <abstractions/ubuntu-browsers.d/plugins-common> 3 - include <abstractions/xdg-open> 4 - owner /usr/bin/dash r, (A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish
2Profile: /usr/sbin/dhclient-script Path: /usr/bin/dash New Mode: owner r Severity: unknown 1 - include <abstractions/gvfs-open> [2 - include <abstractions/ubuntu-browsers.d/plugins-common>] 3 - include <abstractions/xdg-open> 4 - owner /usr/bin/dash r, (A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inishAAdding include <abstractions/ubuntu-browsers.d/plugins-common> to profile. [..] Enforce-mode changes: = Changed Local Profiles = The following local profiles were changed. Would you like to save them? [1 - /usr/sbin/dhclient] 2 - /usr/sbin/dhclient-script (S)ave Changes / Save Selec(t)ed Profile / [(V)iew Changes] / View Changes b/w (C)lean profiles / Abo(r)tSWriting updated profile for /usr/sbin/dhclient. Writing updated profile for /usr/sbin/dhclient-script. Profiling: /usr/sbin/dhclient Please start the application to be profiled in another window and exercise its functionality now. Once completed, select the "Scan" option below in order to scan the system logs for AppArmor events. For each AppArmor event, you will be given the opportunity to choose whether the access should be allowed or denied. [(S)can system log for AppArmor events] / (F)inishFSetting /usr/sbin/dhclient to enforce mode. Setting /usr/sbin/dhclient-script to enforce mode. Reloaded AppArmor profiles in enforce mode. Please consider contributing your new profile! See the following wiki page for more information: https://gitlab.com/apparmor/apparmor/wikis/Profiles Finished generating profile for /usr/sbin/dhclient.
|
最初に別のプログラムである nm-dhcp-helper の実行イベントが検出されています。この場合、ユーザに対していくつかの選択肢が示されます。ユーザは dhclient のプロファイルを適用して nm-dhcp-helper を実行したり (「Inherit」を選んだ場合)、専用のプロファイルを適用して nm-dhcp-helper を実行したり (「Profile」と「Named」を選んだ場合。両者の違いは任意のプロファイル名を使用する可能性があるか否かです)、dhclient のサブプロファイルを適用して nm-dhcp-helper を実行したり (「Child」を選んだ場合)、プロファイルを適用せずに nm-dhcp-helper を実行したり (「Unconfined」を選んだ場合)、nm-dhcp-helper の実行を拒否したり (「Deny」を選んだ場合) することも可能です。
ここでまだ存在しない専用プロファイルを適用して nm-dhcp-helper を実行することを選んだ場合、 aa-genprof ツールは不足しているプロファイルを作成し、さらにこのプロファイルに対する規則を提案します。この点に注意してください。
|
|
カーネルレベルでは root ユーザの特権が「capability」に分割されます。dhclient からのシステムコールが特定の「capability」を要求する場合、AppArmor はプロファイルの中でプログラムがその「capability」を使うことを許可されているかを確認します。
|
|
Here the program seeks read permissions for its configuration file /etc/dhcp/dhclient.conf.
|
|
Here the program seeks read and write permissions to write the lease into /var/lib/dhcp/dhclient.leases.
|
|
Notice that this access request is not part of the dhclient profile but of the new profile that we created when we allowed /usr/sbin/dhclient-script to run with its own profile.
aa-genprof detected that this permission was also granted by multiple “abstractions” and offers them as alternative choices. An abstraction provides a reusable set of access rules grouping together multiple resources that are commonly used together. In this specific case, we opted for selection “2” to first select the “#include <abstractions/ubuntu-browsers.d/plugins-common>” choice and then “A” to allow it.
ログ記録されたすべてのイベントを検討した後、 aa-genprof プログラムは実行中に作成されたすべてのプロファイルを保存することを提案します。今回の場合、2 つのプロファイルを「Save」を使って一度に保存した後 (1 つずつ保存することも可能です)、「Finish」でプログラムを終了しています。
|
aa-genprof は aa-logprof の洗練されたラッパーに過ぎません。すなわち aa-genprof は空のプロファイルを作成し、complain モードでそのプロファイルを読み込み、aa-logprof を実行しているだけです。aa-logprof はログ記録されたプロファイル違反に基づいてプロファイルを更新するツールです。このため、たった今作成したプロファイルを改良するために aa-genprof をもう一度実行することが可能です。
/etc/apparmor.d/usr.sbin.dhclient close to the profile shipped by apparmor-profiles in /usr/share/apparmor/extra-profiles/sbin.dhclient.
/etc/apparmor.d/usr.sbin.dhclient-script might be similar to /usr/share/apparmor/extra-profiles/sbin.dhclient, shipped in apparmor-profiles too.