Novell APPARMOR 2.0 Bedienungsanleitung

Novell AppArmor

www.novell.com2.0

August28,2006 Novell AppArmor 2.0 Administration Guide

Novell AppArmor 2.0 Administration Guide

List of Authors: Leona Beatrice Campbell, Jana Jaeger

This publication is intellectual property of Novell Inc.

Its contents can be duplicated, either in part or in whole, provided that a copyright label is visibly lo-

cated on each copy.

All information found in this book has been compiled with utmost attention to detail. However, this

does not guarantee complete accuracy. Neither SUSE LINUX GmbH, the authors, nor the translators

shall be held liable for possible errors or the consequences thereof.

Novell, the Novell logo, the N logo and SUSE are registered trademarks of Novell, Inc. in the United

States and other countries. * Linux is a registered trademark of Linus Torvalds. All other third party

trademarks are the property of their respective owners.

Contents

About This Guide v

1Immunizing Programs 9

2Selecting Programs to Immunize 11

2.1 Immunize Programs That Grant Privilege . . . . . . . . . . . . . . . 11

2.2 Inspect Open Ports to Immunize Programs . . . . . . . . . . . . . . 12

3Building Novell AppArmor Proles 19

3.1 Prole Components and Syntax . . . . . . . . . . . . . . . . . . . 19

3.2 Building and Managing Novell AppArmor Proles . . . . . . . . . . . 23

3.3 Building Novell AppArmor Proles with the YaST GUI . . . . . . . . . . 24

3.4 Building Novell AppArmor Proles Using the Command Line Interface . . 47

3.5 Two Methods of Proling . . . . . . . . . . . . . . . . . . . . . . 51

3.6 Pathnames and Globbing . . . . . . . . . . . . . . . . . . . . . . 69

3.7 File Permission Access Modes . . . . . . . . . . . . . . . . . . . . 71

4Managing Proled Applications 77

4.1 Monitoring Your Secured Applications . . . . . . . . . . . . . . . . 77

4.2 Setting Up Event Notication . . . . . . . . . . . . . . . . . . . . 78

4.3 Reports............................. 81

4.4 Reacting to Security Events . . . . . . . . . . . . . . . . . . . . 102

4.5 Maintaining Your Security Proles . . . . . . . . . . . . . . . . . 102

5Proling Your Web Applications Using ChangeHat Apache 105

5.1 ApacheChangeHat........................ 106

5.2 Apache Conguration for apache2-mod-apparmor . . . . . . . . . . 113

6Support 117

6.1 Updating Novell AppArmor Online . . . . . . . . . . . . . . . . . 117

6.2 Using the Man Pages . . . . . . . . . . . . . . . . . . . . . . . 117

6.3 For More Information . . . . . . . . . . . . . . . . . . . . . . 119

6.4 Troubleshooting......................... 120

6.5 Reporting Bugs for AppArmor . . . . . . . . . . . . . . . . . . . 121

ABackground Information on AppArmor Proling 123

Glossary 125

About This Guide

Novell® AppArmor is designed to provide easy-to-use application security for both

servers and workstations. Novell AppArmor is an access control system that lets you

specify per program which les the program may read, write, and execute. AppArmor

secures applications by enforcing good application behavior without relying on attack

signatures, so can prevent attacks even if they are exploiting previously unknown vul-

nerabilities.

Novell AppArmor consists of:

• A library of AppArmor proles for common Linux* applications describing what

les the program needs to access.

• A library of AppArmor prole foundation classes (prole building blocks) needed

for common application activities, such as DNS lookup and user authentication.

• A tool suite for developing and enhancing AppArmor proles, so that you can

change the existing proles to suit your needs and create new proles for your own

local and custom applications.

• Several specially modied applications that are AppArmor enabled to provide en-

hanced security in the form of unique subprocess connement, including Apache.

• The Novell AppArmor–loadable kernel module and associated control scripts to

enforce AppArmor policies on your SUSE® Linux system.

This guide covers the following topics:

Immunizing Programs

Describes the operation of Novell AppArmor.

Selecting Programs to Immunize

Describes the types of programs that should have Novell AppArmor proles created

for them.

Building Novell AppArmor Proles

Describes how to use the Novell AppArmor tools to immunize your own programs

and third-party programs that you may have installed on your SUSE Linux system.

It also helps you to add, edit, or delete proles that have been created for your ap-

plications.

Managing Proled Applications

Describes how to perform Novell AppArmor prole maintenance, which involves

tracking common issues and concerns.

Proling Your Web Applications Using ChangeHat Apache

Enables you to create subproles for the Apache Web server that allow you to

tightly conne small sections of Web application processing.

Support

Indicates support options for this product.

Glossary

Provides a list of terms and their denitions.

NOTE

Novell AppArmor ships with any SUSE Linux–based Novell operating system.

Text references to SUSE Linux apply to SUSE Linux OSS, the SUSE Linux retail

product, and the SUSE Linux Enterprise product family.

1 Feedback

We want to hear your comments and suggestions about this manual and the other doc-

umentation included with this product. Please use the User Comments feature at the

bottom of each page of the online documentation and enter your comments there.

2 Documentation Conventions

The following typographical conventions are used in this manual:

•/etc/passwd: lenames and directory names

•placeholder: replace placeholder with the actual value

vi Novell AppArmor 2.0 Administration Guide

•PATH: the environment variable PATH

•ls,--help: commands, options, and parameters

•user: users or groups

•Alt ,Alt +F1 : a key to press or a key combination; keys are shown in uppercase

as on a keyboard

•File,File →Save As: menu items, buttons

•Dancing Penguins (Chapter Penguins, ↑Reference): This is a reference to a chapter

in another book.

About This Guide vii

Immunizing Programs

Novell® AppArmor provides immunization technologies that protect SUSE Linux ap-

plications from the inherent vulnerabilities they possess. After installing Novell App-

Armor, setting up Novell AppArmor proles, and rebooting the computer, your system

becomes immunized because it begins to enforce the Novell AppArmor security policies.

Protecting programs with Novell AppArmor is referred to as immunizing.

Novell AppArmor sets up a collection of default application proles to protect standard

Linux services. To protect other applications, use the Novell AppArmor tools to create

proles for the applications that you want protected. This chapter introduces the philos-

ophy of immunizing programs. Proceed to Chapter 3, Building Novell AppArmor Proles

(page 19) if you are ready to build and manage Novell AppArmor proles.

Novell AppArmor provides streamlined access control for network services by specifying

which les each program is allowed to read, write, and execute. This ensures that each

program does what it is supposed to do and nothing else.

Novell AppArmor is host intrusion prevention, or mandatory access control scheme,

that is optimized for servers. Previously, access control schemes were centered around

users because they were built for large timeshare systems. Alternatively, modern network

servers largely do not permit users to log in, but instead provide a variety of network

services for users, such as Web, mail, le, and print. Novell AppArmor controls the

access given to network services and other programs to prevent weaknesses from being

exploited.

Immunizing Programs 9

TIP: Background Information for Novell AppArmor

To get a more in-depth overview of AppArmor and the overall concept behind

it, refer to Appendix A, Background Information on AppArmor Proling

(page 123).

10 Novell AppArmor 2.0 Administration Guide

Inhaltsverzeichnis

Andere Novell Software Handbücher

Novell

Novell IDENTITY MANAGER 3.6.1 - STAGING BEST PRACTICES GUIDE... Bedienungsanleitung

Novell

Novell Open Enterprise Server 2 Bedienungsanleitung

Novell

Novell GROUPWISE 8 - MONITOR Bedienungsanleitung

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0.2 - INTEGRATION AND STREAMING GUIDE... Bedienungsanleitung

Novell

Novell PRIVILEGED USER MANAGER EVALUATION - Bedienungsanleitung

Novell

Novell SENTINEL LOG MANAGER 1.0.0.5 - S Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE SERVER STARTER SYSTEM Bedienungsanleitung

Novell

Novell IDENTITY MANAGER 3.6.1 - CLIENT LOGIN EXTENSION... Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE SERVER 11 - STORAGE ADMINISTRATION GUIDE... Bedienungsanleitung

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0.2 - INTEGRATION AND STREAMING GUIDE... Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 Bedienungsanleitung

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 Bedienungsanleitung

Novell

Novell CLIENT FOR LINUX 2.0 SP1 - ADMINISTRATION Bedienungsanleitung

Novell

Novell IFOLDER 3.X - SECURITY ADMINISTRATOR GUIDE... Service-Handbuch

Novell

Novell GROUPWISE 8 - SECURITY POLICIES Bedienungsanleitung

Novell

Novell ZENWORKS 7.2 LINUX MANAGEMENT - SCENARIOS 2... Bedienungsanleitung

Novell

Novell GROUPWISE 7 - LIBRARIES AND DOCUMENTS Bedienungsanleitung

Novell

Novell XEN - ADMINISTRATION Bedienungsanleitung

Novell

Novell BUSINESS CONTINUITY CLUSTERING 1.1 SP1 Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE 11 - HIGH AVAILABILITY Bedienungsanleitung

Novell

Novell EDIRECTORY 8.8 - GUIDE 09-2006 Bedienungsanleitung

Novell

Novell GROUPWISE 7 GATEWAY FOR MICROSOFT EXCHANGE - INSTALLATION AND... Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION... Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE REAL TIME 10 SP1 Bedienungsanleitung

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung

Lexmark

Lexmark Apps Service-Handbuch