Novell APPARMOR 1.2 Bedienungsanleitung
Novell AppArmor
Powered by
Immunix
Administration
Guide
www.novell.com
1.2 09/29/2005
Novell AppArmor Powered by Immunix 1.2 Administra-
tion Guide
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this docu-
mentation, and specically disclaims any express or implied warranties of merchantability or tness
for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to
make changes to its content, at any time, without obligation to notify any person or entity of such re-
visions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and
specically disclaims any express or implied warranties of merchantability or tness for any particular
purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software,
at any time, without any obligation to notify any person or entity of such changes.
You may not use, export, or re-export this product in violation of any applicable laws or regulations
including, without limitation, U.S. export regulations or the laws of the country in which you reside.
Copyright © 2000 - 2004, 2005 Novell, Inc. All rights reserved. No part of this publication may be
reproduced, photocopied, stored on a retrieval system, or transmitted without the express written
consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is
described in this document. In particular, and without limitation, these intellectual property rights
may include one or more of the U.S. patents listed at http://www.novell.com/company/
legal/patents/ and one or more additional patents or pending patent applications in the U.S.
and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the online documentation for this and other Novell products, and
to get updates, see www.novell.com/documentation.
Novell Trademarks
AppArmor is a registered trademark of Novell, Inc. in the United States and other countries.
Immunix is a trademark of Novell, Inc. in the United States and other countries.
Novell is a registered trademark of Novell, Inc. in the United States and other countries.
SUSE is a registered trademark of SUSE LINUX Products GmbH, a Novell business.
Third-Party Materials
All third-party trademarks are the property of their respective owners.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTIC-
ULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSE-
QUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTI-
TUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUP-
TION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CON-
TRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
Contents
Introduction to Novell AppArmor vii
1Immunizing Programs 13
2Selecting Programs to Immunize 15
2.1 Immunize Programs That Grant Privilege . . . . . . . . . . . . . . . 15
2.2 Inspect Open Ports to Immunize Programs . . . . . . . . . . . . . . 16
3Building Novell AppArmor Proles 21
3.1 Prole Components and Syntax . . . . . . . . . . . . . . . . . . . 21
3.2 Building and Managing Novell AppArmor Proles . . . . . . . . . . . 24
3.3 Building Novell AppArmor Proles with the YaST GUI . . . . . . . . . . 26
3.4 Building Novell AppArmor Proles Using the Command Line Interface . . 49
3.5 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 54
3.6 Pathnames and Globbing . . . . . . . . . . . . . . . . . . . . . . 73
3.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . . 74
4Managing Proled Applications 77
4.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 77
4.2 Setting Up Event Notication . . . . . . . . . . . . . . . . . . . . 78
4.3 Reports............................. 81
4.4 Reacting to Security Events . . . . . . . . . . . . . . . . . . . . 102
4.5 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 103
5Proling Your Web Applications Using ChangeHat Apache 105
5.1 ApacheChangeHat........................ 106
5.2 Apache Conguration for mod_change_hat . . . . . . . . . . . . . 113
6Support 117
6.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 117
6.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 117
6.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 119
6.4 Troubleshooting......................... 119
6.5 Support for SUSE Linux . . . . . . . . . . . . . . . . . . . . . . 121
6.6 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 126
Glossary 129
vi
Introduction to Novell
AppArmor
Novell® AppArmor Powered by Immunix is designed to provide easy-to-use application
security for both servers and workstations. Novell AppArmor is an access control system
that lets you specify per program which les the program may read, write, and execute.
AppArmor secures applications by enforcing good application behavior without relying
on attack signatures, so can prevent attacks even if they are exploiting previously un-
known vulnerabilities.
Novell AppArmor consists of:
• A library of AppArmor proles for common Linux* applications describing what
les the program needs to access.
• A library of AppArmor prole foundation classes (prole building blocks) needed
for common application activities, such as DNS lookup and user authentication.
• A tool suite for developing and enhancing AppArmor proles, so that you can
change the existing proles to suit your needs and create new proles for your own
local and custom applications.
• Several specially modied applications that are AppArmor enabled to provide en-
hanced security in the form of unique subprocess connement, including Apache.
• The Novell AppArmor–loadable kernel module and associated control scripts to
enforce AppArmor policies on your SUSE® Linux system.
NOTE
Some distributions of SUSE Linux include a version of AppArmor that enforce
policies for a limited set of programs. These policies can be modied to suit
your particular environment using the included AppArmor tool set. To create
AppArmor proles for additional programs, an upgrade to the full version of
AppArmor is required.
1 Documentation Conventions
The following typographical conventions are used in this manual:
Menu Items, Field Names, and Screen Titles in GUIs
When using GUIs, eld names, menu and screen titles, and eld values are shown
as File.
Keys
Key names are listed as they appear on your keyboard, as in Enter and Esc .
Command
Linux commands (and other operating system commands, when used) are repre-
sented this way. This style should indicate to you that you can type the word
or phrase on the command line and press Enter to run the command.
Example 1 Command Environment
To use ls to view the contents in the current directory, enter ls in a terminal
window.
Filename
Filenames, directory names, paths, and RPM package names are represented this
way. This style should indicate that a particular le or directory exists by that name
on your Linux system.
Placeholders
Replace placeholder with the actual value that matches your setup.
Examples, Notes, and Warnings
Examples use Example: when appropriate. Notes and pertinent information are
shown with a Note or Warning ag, as in:
NOTE
Notes highlight information that might help better understand previous
paragraphs. Warnings provide important information that might seriously
affect the integrity of the product or your data.
viii
Computer Output
When you see text in this style, it indicates text displayed by the computer
on the command line. You see responses to typed commands, error messages, and
interactive prompts for your input during scripts or programs shown this way.
Example 2 Computer Output
Use the ls command to display the contents of a directory:
$ ls
Desktop about.html logs
Mail backupfiles mail
Trademarks
A trademark symbol (®, etc.) denotes a Novell trademark. An asterisk (*) denotes
a third-party trademark.
2 Understanding This Guide
Immunizing Programs
Describes operation of Novell AppArmor Powered by Immunix.
Selecting Programs to Immunize
Describes the types of programs that should have Novell AppArmor proles created
for them.
Building Novell AppArmor Proles
Describes how to use the Novell AppArmor tools to immunize your own programs
and third-party programs that you may have installed on your SUSE Linux system.
It also helps you to add, edit, or delete proles that have been created for your ap-
plications.
Managing Proled Applications
Describes how to perform Novell AppArmor prole maintenance, which involves
tracking common issues and concerns.
Proling Your Web Applications Using ChangeHat Apache
Enables you to create subproles for the Apache Web server that allow you to
tightly conne small sections of Web application processing.
Introduction to Novell AppArmor ix
Support
Indicates support options for this product.
Glossary
Provides a list of terms and their denitions.
3 Getting Started with Novell
AppArmor
Novell AppArmor Powered by Immunix (Novell AppArmor) provides you with tech-
nologies to protect your applications from their own vulnerabilities by creating Novell
AppArmor proles for applications on your SUSE Linux system.
3.1 Launching Novell AppArmor through
the YaST GUI
SUSE Linux offers the utility YaST. Using YaST, you can launch the Novell AppArmor
interface. This is the recommended method for a novice Linux user. For the other
available methods, refer to Section 3.2, “Building and Managing Novell AppArmor
Proles” (page 24).
•To start YaST, select System →Control Center (YaST) from the SUSE menu.
YaST is launched as shown in Section 3.2, “Novell AppArmor Basics” (page x),
below. You can refer to this section to navigate in Novell AppArmor.
NOTE
Alternately, you can launch the YaST GUI by opening a terminal window then
entering yast2 while logged in as root.
3.2 Novell AppArmor Basics
Novell AppArmor enables you to manage proles through a simple user interface.
x
Inhaltsverzeichnis
Andere Novell Software Handbücher
Novell
Novell GROUPWISE 7 - SECURITY POLICIES Bedienungsanleitung
Novell
Novell GROUPWISE 8 - WEBACCESS Bedienungsanleitung
Novell
Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0.2 - INTEGRATION AND STREAMING GUIDE... Bedienungsanleitung
Novell
Novell SENTINEL LOG MANAGER 1.0.0.5 - S Bedienungsanleitung
Novell
Novell PRIVILEGED USER MANAGER EVALUATION - Bedienungsanleitung
Novell
Novell IFOLDER 3.7 - SECURITY ADMINISTRATION Bedienungsanleitung
Novell
Novell IDENTITY MANAGER 3.6.1 - CLIENT LOGIN EXTENSION... Bedienungsanleitung
Novell
Novell IDENTITY MANAGER 3.6.1 - STAGING BEST PRACTICES GUIDE... Bedienungsanleitung
Novell
Novell GROUPWISE 7 - SECURITY POLICIES Bedienungsanleitung
Novell
Novell GROUPWISE 8 - DATABASES Bedienungsanleitung
Novell
Novell GROUPWISE 7 - USERS Bedienungsanleitung
Novell
Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0 -... Bedienungsanleitung
Novell
Novell GROUPWISE 7 GATEWAY FOR MICROSOFT EXCHANGE - INSTALLATION AND... Bedienungsanleitung
Novell
Novell ZENWORKS ENDPOINT SECURITY MANAGEMENT 3.5 Bedienungsanleitung
Novell
Novell ZENWORKS LINUX MANAGEMENT 7.2 IR2 - ... Bedienungsanleitung
Novell
Novell IDENTITY MANAGER DRIVER FOR ID PROVIDER 3.6.1 -... Bedienungsanleitung
Novell
Novell LINUX ENTERPRISE DESKTOP 10 - KDE 21-06-2006 Bedienungsanleitung
Novell
Novell SP2 - S Bedienungsanleitung
Novell
Novell LINUX ENTERPRISE SERVER 10 SP2 - VIRTUALIZATION WITH... Bedienungsanleitung
Novell
Novell ACCESS MANAGER 3.1 SP2 - README 2010 Bedienungsanleitung
Beliebte Software Handbücher anderer Marken
COMPRO
COMPRO COMPROFM Bedienungsanleitung
Muratec
Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung
Oracle
Oracle Contact Center Anywhere 8.1 Bedienungsanleitung
Adobe
Adobe 65007312 - Photoshop Lightroom Handbuch
Avaya
Avaya NULL One-X for RIM Blackberry Bedienungsanleitung
HP
HP ProLiant BL420c Bedienungsanleitung
Canon
Canon Vixia HF21 Bedienungsanleitung
Canon
Canon ZR950 Bedienungsanleitung
Samsung
Samsung Auto Backup Bedienungsanleitung
Polycom
Polycom Vortex EF2201 Montage- und Bedienungsanleitung
Brocade Communications Systems
Brocade Communications Systems Brocade 8/12c Bedienungsanleitung
Lexmark
Lexmark Apps Service-Handbuch