Novell APPARMOR 1.2 - QUICK GUIDE AND Datenblatt

Novell AppArmor

Immunix

Installation and

QuickStart Guide

www.novell.com

1.2 09/29/2005

Novell AppArmor Powered by Immunix 1.2 Installation

and QuickStart Guide

Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this docu-

mentation, and specically disclaims any express or implied warranties of merchantability or tness

for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to

make changes to its content, at any time, without obligation to notify any person or entity of such re-

visions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and

specically disclaims any express or implied warranties of merchantability or tness for any particular

purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software,

at any time, without any obligation to notify any person or entity of such changes.

You may not use, export, or re-export this product in violation of any applicable laws or regulations

including, without limitation, U.S. export regulations or the laws of the country in which you reside.

reproduced, photocopied, stored on a retrieval system, or transmitted without the express written

consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is

described in this document. In particular, and without limitation, these intellectual property rights

may include one or more of the U.S. patents listed at http://www.novell.com/company/

legal/patents/ and one or more additional patents or pending patent applications in the U.S.

and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the online documentation for this and other Novell products, and

to get updates, see www.novell.com/documentation.

Novell Trademarks

AppArmor is a registered trademark of Novell, Inc. in the United States and other countries.

Immunix is a trademark of Novell, Inc. in the United States and other countries.

Novell is a registered trademark of Novell, Inc. in the United States and other countries.

SUSE is a registered trademark of SUSE LINUX Products GmbH, a Novell business.

Third-Party Materials

All third-party trademarks are the property of their respective owners.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED

TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTIC-

ULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR CONTRIBUTORS BE

LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSE-

QUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTI-

TUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUP-

TION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CON-

TRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

POSSIBILITY OF SUCH DAMAGE.

Contents

1Introduction to Novell AppArmor 7

2Installing Novell AppArmor 9

3Enabling Novell AppArmor 11

4Getting Started with Proling Applications 13

4.1 Choosing the Applications to Prole . . . . . . . . . . . . . . . . . 13

4.2 Building and Modifying Proles . . . . . . . . . . . . . . . . . . . 14

4.3 Conguring Novell AppArmor Event Notication and Reports . . . . . . 16

4.4 Updating Your Proles . . . . . . . . . . . . . . . . . . . . . . . 18

Introduction to Novell AppArmor

Many security vulnerabilities result from bugs in trusted programs. A trusted program

runs with privilege that some attacker would like to have and the program fails to keep

that trust if there is a bug in the program that allows the attacker to acquire that privilege.

Novell AppArmor is an application security solution designed specically to provide

least privilege connement to suspect programs. AppArmor allows the administrator

to specify the domain of activities the program can perform by developing a security

prole for that application—a listing of les that the program may access and the oper-

ations the program may perform.

Effective hardening of a computer system requires minimizing the number of programs

that mediate privilege then securing the programs as much as possible. With Novell

AppArmor, you only need to prole the programs that are exposed to attack in your

environment, which drastically reduces the amount of work required to harden your

computer. AppArmor proles enforce policies to make sure that programs do what they

are supposed to do, but nothing else.

Administrators only need to care about the applications that are vulnerable to attacks

and generate proles for these. Hardening a system thus comes down to building and

maintaining the AppArmor prole set and monitoring any policy violations or exceptions

logged by AppArmor's reporting facility.

Building AppArmor proles to conne an application is very straightforward and intu-

itive. AppArmor ships with several tools that assist in prole creation. AppArmor does

not require you to do any programming or script handling. The only task that is required

from the administrator is to determine a policy of strictest access and execute permissions

for each application that needs to be hardened.

Introduction to Novell AppArmor 7

Updates or modications to the application proles are only required if the software

conguration or the desired range of activities changes. AppArmor offers intuitive tools

to handle prole updates or modications.

Users will not notice AppArmor at all. It runs “behind the scenes” and does not require

any user interaction. Performance will not be affected noticeably by AppArmor. If some

activity of the application is not covered by an AppArmor prole or if some activity

of the application is prevented by AppArmor, the administrator needs to adjust the

prole of this application to cover this kind of behavior.

This guide outlines the basic tasks that need to be performed with AppArmor to effec-

tively harden a system. For more in-depth information, refer to Novell AppArmor

Installing Novell AppArmor

Users installing either a GNOME or the KDE desktop selection can skip this section,

because Novell® AppArmor is installed by default as part of these selections.

If installing neither of these desktops or even going for en entirely text-based environ-

ment, do the following to install the required packages using the YaST package manager.

1Log in as root and start YaST.

2In the YaST Control Center, select Software →Software Management.

3Use the search functionality of YaST (keywords “AppArmor” and “subdomain”)

to install the following packages:

• subdomain-parser-demo

• subdomain-parser-common

• libimmunix

• libimnxcert

• subdomain-docs

• yast2-subdomain

• subdomain-proles

• subdomain-leaf-cert

• subdomain-utils

Installing Novell AppArmor 9

4Select all these packages for installation then select Accept. YaST resolves any

dependencies and installs all the packages for you.

5After YaST has nished updating the system conguration, select Finish to leave

the package manager.

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Novell Software Handbücher

Novell

Novell ACCESS MANAGER 3.1 SP1 - ADMINISTRATION Bedienungsanleitung

Novell

Novell PRODUCT NAME 10.3 - DEPLOYING ZENWORKS ON CITRIX SERVER BEST PRACTICES GUIDE... Bedienungsanleitung

Novell

Novell GROUPWISE 7 - POST OFFICE AGENT Bedienungsanleitung

Novell

Novell BUSINESS CONTINUITY CLUSTERING 1.2 -... Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE SERVER 10 SP2 - STORAGE ADMINISTRATION GUIDE... Bedienungsanleitung

Novell

Novell IDENTITY MANAGER 3.6.1 - UNDERSTANDING POLICIES... Bedienungsanleitung

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0 -... Bedienungsanleitung

Novell

Novell CLIENT 1.0 FOR LINUX - README Bedienungsanleitung

Novell

Novell CUSTOMER CENTER 2.3 - GUIDE 4-8-2009 Bedienungsanleitung

Novell

Novell ZENWORKS NETWORK ACCESS CONTROL 5.0 - ... Bedienungsanleitung

Novell

Novell INTERNET STORAGE NAME SERVICE 1.0 -... Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE DESKTOP 11 Bedienungsanleitung

Novell

Novell EDIRECTORY 8.8 SP3 Bedienungsanleitung

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 Bedienungsanleitung

Novell

Novell GROUPWISE 7 - TROUBLESHOOTING 2 Bedienungsanleitung

Novell

Novell GROUPWISE 8 - DATABASES Bedienungsanleitung

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - DEVELOPMENT CLIENT REFERENCE... Service-Handbuch

Novell

Novell OPEN ENTERPRISE SERVER 2 SP2 -... Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 Handbuch

Novell

Novell IDENTITY MANAGER 3.6.1 - CLIENT LOGIN EXTENSION... Bedienungsanleitung

Novell

Novell CONSOLE ONE 1.3.X Bedienungsanleitung

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Service-Handbuch

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - KDE 17-03-2009 Bedienungsanleitung

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung

Lexmark

Lexmark Apps Service-Handbuch