Contents
How do I write a AppArmor profile?
Build an AppArmor profile for a group of applications as follows:
- Create profiles for the individual programs that make up your application.
- Put relevant profiles into learning or complain mode.
- Exercise your application.
- Analyze the log.
- Repeat Step 3 and Step 4.
- Edit the profiles.
- Return to enforce mode.
What is an AppArmor profile?
AppArmor is a Mandatory Access Control (MAC) system which confines programs to a limited set of resources. AppArmor confinement is provided via profiles loaded into the kernel. AppArmor can be set to either enforce the profile or complain when profile rules are violated.
How do I set up AppArmor?
To set a profile in complain mode, first install apparmor-utils package if it is not already installed. Use aa-complain command to set a profile in complain mode. For example, do the following to enable complain mode for mysqld. $ sudo aa-complain /usr/sbin/mysqld Setting /usr/sbin/mysqld to complain mode.
Do I really need AppArmor?
While they work differently, both AppArmor and SELinux provide “mandatory access control” (MAC) security. With AppArmor, it only has access to things that a PDF viewer needs access to. AppArmor is particularly useful for restricting software that may be exploited, such as a web browser or server software.
How to create a skeleton profile in AppArmor?
Generating a basic profile The easiest way to get started is to create a skeleton profile, set AppArmor to complain mode for your target and then use the aa-logprof tool to evaluate the denials. Trying to run certspotter, results in an immediate (safe) crash.
What happens if there is no Apparmor profile?
If the AppArmor profile does not exist, the pod will fail to be created. Each profile can be run in either enforce mode, which blocks access to disallowed resources, or complain mode, which only reports violations. After building an AppArmor profile, it is good practice to apply it with the complain mode first and let the workload run for a while.
How to create an Apparmor profile for Nginx?
This general process for enabling AppArmor for a new application is as follows: 1 Create a new blank profile for the application 2 Put it into complain mode 3 Take normal actions with the application so appropriate entries get added to the logs 4 Run the AppArmor utility to go through the logs and approve or disapprove various application actions
How to create an Apparmor profile in Ubuntu 17.10?
For this tutorial, we will generate an AppArmor profile for certspotter. certspotter is a new utility in Ubuntu as of 17.10 and no profile yet exists. certspotter monitors certificate transparency logs to see if new certificates have been generated for domains listed in a watchlist.