Novell APPARMOR 2.0 Manual de instrucciones

Novell AppArmor

www.novell.com2.0

August28,2006 Novell AppArmor 2.0 Administration Guide

Novell AppArmor 2.0 Administration Guide

List of Authors: Leona Beatrice Campbell, Jana Jaeger

This publication is intellectual property of Novell Inc.

Its contents can be duplicated, either in part or in whole, provided that a copyright label is visibly lo-

cated on each copy.

All information found in this book has been compiled with utmost attention to detail. However, this

does not guarantee complete accuracy. Neither SUSE LINUX GmbH, the authors, nor the translators

shall be held liable for possible errors or the consequences thereof.

Novell, the Novell logo, the N logo and SUSE are registered trademarks of Novell, Inc. in the United

States and other countries. * Linux is a registered trademark of Linus Torvalds. All other third party

trademarks are the property of their respective owners.

Contents

About This Guide v

1Immunizing Programs 9

2Selecting Programs to Immunize 11

2.1 Immunize Programs That Grant Privilege . . . . . . . . . . . . . . . 11

2.2 Inspect Open Ports to Immunize Programs . . . . . . . . . . . . . . 12

3Building Novell AppArmor Proles 19

3.1 Prole Components and Syntax . . . . . . . . . . . . . . . . . . . 19

3.2 Building and Managing Novell AppArmor Proles . . . . . . . . . . . 23

3.3 Building Novell AppArmor Proles with the YaST GUI . . . . . . . . . . 24

3.4 Building Novell AppArmor Proles Using the Command Line Interface . . 47

3.5 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 51

3.6 Pathnames and Globbing . . . . . . . . . . . . . . . . . . . . . . 69

3.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . . 71

4Managing Proled Applications 77

4.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 77

4.2 Setting Up Event Notication . . . . . . . . . . . . . . . . . . . . 78

4.3 Reports............................. 81

4.4 Reacting to Security Events . . . . . . . . . . . . . . . . . . . . 102

4.5 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 102

5Proling Your Web Applications Using ChangeHat Apache 105

5.1 ApacheChangeHat........................ 106

5.2 Apache Conguration for apache2-mod-apparmor . . . . . . . . . . 113

6Support 117

6.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 117

6.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 117

6.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 119

6.4 Troubleshooting......................... 120

6.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 121

ABackground Information on AppArmor Proling 123

Glossary 125

About This Guide

Novell® AppArmor is designed to provide easy-to-use application security for both

servers and workstations. Novell AppArmor is an access control system that lets you

specify per program which les the program may read, write, and execute. AppArmor

secures applications by enforcing good application behavior without relying on attack

signatures, so can prevent attacks even if they are exploiting previously unknown vul-

nerabilities.

Novell AppArmor consists of:

• A library of AppArmor proles for common Linux* applications describing what

les the program needs to access.

• A library of AppArmor prole foundation classes (prole building blocks) needed

for common application activities, such as DNS lookup and user authentication.

• A tool suite for developing and enhancing AppArmor proles, so that you can

change the existing proles to suit your needs and create new proles for your own

local and custom applications.

• Several specially modied applications that are AppArmor enabled to provide en-

hanced security in the form of unique subprocess connement, including Apache.

• The Novell AppArmor–loadable kernel module and associated control scripts to

enforce AppArmor policies on your SUSE® Linux system.

This guide covers the following topics:

Immunizing Programs

Describes the operation of Novell AppArmor.

Selecting Programs to Immunize

Describes the types of programs that should have Novell AppArmor proles created

for them.

Building Novell AppArmor Proles

Describes how to use the Novell AppArmor tools to immunize your own programs

and third-party programs that you may have installed on your SUSE Linux system.

It also helps you to add, edit, or delete proles that have been created for your ap-

plications.

Managing Proled Applications

Describes how to perform Novell AppArmor prole maintenance, which involves

tracking common issues and concerns.

Proling Your Web Applications Using ChangeHat Apache

Enables you to create subproles for the Apache Web server that allow you to

tightly conne small sections of Web application processing.

Support

Indicates support options for this product.

Glossary

Provides a list of terms and their denitions.

NOTE

Novell AppArmor ships with any SUSE Linux–based Novell operating system.

Text references to SUSE Linux apply to SUSE Linux OSS, the SUSE Linux retail

product, and the SUSE Linux Enterprise product family.

1 Feedback

We want to hear your comments and suggestions about this manual and the other doc-

umentation included with this product. Please use the User Comments feature at the

bottom of each page of the online documentation and enter your comments there.

2 Documentation Conventions

The following typographical conventions are used in this manual:

•/etc/passwd: lenames and directory names

•placeholder: replace placeholder with the actual value

vi Novell AppArmor 2.0 Administration Guide

•PATH: the environment variable PATH

•ls,--help: commands, options, and parameters

•user: users or groups

•Alt ,Alt +F1 : a key to press or a key combination; keys are shown in uppercase

as on a keyboard

•File,File →Save As: menu items, buttons

•Dancing Penguins (Chapter Penguins, ↑Reference): This is a reference to a chapter

in another book.

About This Guide vii

Immunizing Programs

Novell® AppArmor provides immunization technologies that protect SUSE Linux ap-

plications from the inherent vulnerabilities they possess. After installing Novell App-

Armor, setting up Novell AppArmor proles, and rebooting the computer, your system

becomes immunized because it begins to enforce the Novell AppArmor security policies.

Protecting programs with Novell AppArmor is referred to as immunizing.

Novell AppArmor sets up a collection of default application proles to protect standard

Linux services. To protect other applications, use the Novell AppArmor tools to create

proles for the applications that you want protected. This chapter introduces the philos-

ophy of immunizing programs. Proceed to Chapter 3, Building Novell AppArmor Proles

(page 19) if you are ready to build and manage Novell AppArmor proles.

Novell AppArmor provides streamlined access control for network services by specifying

which les each program is allowed to read, write, and execute. This ensures that each

program does what it is supposed to do and nothing else.

Novell AppArmor is host intrusion prevention, or mandatory access control scheme,

that is optimized for servers. Previously, access control schemes were centered around

users because they were built for large timeshare systems. Alternatively, modern network

servers largely do not permit users to log in, but instead provide a variety of network

services for users, such as Web, mail, le, and print. Novell AppArmor controls the

access given to network services and other programs to prevent weaknesses from being

exploited.

Immunizing Programs 9

TIP: Background Information for Novell AppArmor

To get a more in-depth overview of AppArmor and the overall concept behind

it, refer to Appendix A, Background Information on AppArmor Proling

(page 123).

10 Novell AppArmor 2.0 Administration Guide

Tabla de contenidos

Otros manuales de Software de Novell

Novell

Novell SENTINEL 6.1 SP2 - 02-2010 Manual de usuario

Novell

Novell GROUPWISE 8 - DATABASES Manual de usuario

Novell

Novell IFOLDER 3.8 - CROSS-PLATFORM Manual de usuario

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Manual de programación

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 - KDE... Manual de usuario

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - PREBOOT SERVICES AND IMAGING REFERENCE 10.3... Manual de instrucciones

Novell

Novell EDIRECTORY 8.8 - GUIDE Manual de usuario

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - HIGH AVAILABILITY CONFIGURATION GUIDE... Manual de usuario

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 Manual de usuario

Novell

Novell SENTINEL LOG MANAGER 1.0.0.5 - S Manual de instrucciones

Novell

Novell IDENTITY MANAGER ENTITLEMENTS SERVICE DRIVER 3.6.1 -... Manual de usuario

Novell

Novell GROUPWISE 8 - INTEROPERABILITY Manual de usuario

Novell

Novell LINUX ENTERPRISE DESKTOP 10 - KDE 21-06-2006 Manual de usuario

Novell

Novell GROUPWISE 8 - POST OFFICE AGENT Manual de usuario

Novell

Novell EDIRECTORY 8.8 SP5 - GUIDE 12-2009 Manual de usuario

Novell

Novell ZENWORKS LINUX MANAGEMENT 7.2 IR2 - ... Manual de usuario

Novell

Novell LINUX ENTERPRISE DESKTOP 10 - GNOME... Manual de usuario

Novell

Novell CLIENT FOR LINUX 2.0 Manual de usuario

Novell

Novell LINUX ENTERPRISE SERVER 10 SP2 - VIRTUALIZATION WITH... Manual de usuario

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manual de instalación y operación

Novell

Novell SUSE LINUX ENTERPRISE DESKTOP 11 SP1 - 8-18-2010 VIRTUALIZATION WITH... Manual de usuario

Novell

Novell GROUPWISE 7 - DATABASES Manual de usuario

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0.2 - INTEGRATION AND STREAMING GUIDE... Manual de usuario

Novell

Novell GROUPWISE 8 - SECURITY POLICIES Manual de usuario

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

HP ProLiant BL420c Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario

Lexmark

Lexmark Apps Manual de servicio