Contents
What do you need to know about an Apparmor profile?
Introduction to AppArmor Profiles AppArmor profiles are simple text files. Absolute paths as well as file globbing can be used when specifying file access.
Can a fake Directory be added to an Apparmor profile?
While AppArmor profiles are default-deny by default, adding explicit deny rules can guard against profile mistakes: The fake directory doesn’t exist on this system, but the policy rule is still valid and AppArmor will enforce rules on it if it ever gets created someday.
How does AppArmor work in the Ubuntu operating system?
It uses Linux Security Module to restrict programs. AppArmor sets up a collection of default application profiles to protect Linux services. You can also protect any other applications running on your system by creating profile files yourself. In Ubuntu, AppArmor is installed and enabled by default.
How to create a skeleton profile in AppArmor?
Generating a basic profile The easiest way to get started is to create a skeleton profile, set AppArmor to complain mode for your target and then use the aa-logprof tool to evaluate the denials. Trying to run certspotter, results in an immediate (safe) crash.
How to check AppArmor denials in certspotter?
For example, will show any AppArmor denials within the last day. We are going to take the easy route to develop this profile and use the aa-logprof tool to evaluate the log entries that AppArmor makes in complain mode, so let’s set the AppArmor profile for certspotter to complain mode for this policy so that we can see what is happening.
Where are AppArmor denials and complain mode denials logged?
AppArmor Denials and Complain Mode AppArmor denials are logged to /var/log/syslog (or /var/log/audit/audit.log for non-DBus policy violations if auditd is installed). The kernel will rate limit AppArmor denials which can cause problems while profiling.