Product SiteDocumentation Site

14.4. Pengantar AppArmor

14.4.1. Prinsip-prinsip

AppArmor adalah sebuah sistem Mandatory Access Control (MAC) yang dibangun di atas antarmuka LSM (Linux Security Modules) Linux. Dalam prakteknya, kernel meng-query AppArmor sebelum setiap panggilan sistem untuk mengetahui apakah proses berwenang untuk melakukan operasi tertentu. Melalui mekanisme ini, AppArmor mengungkung program ke set terbatas sumber daya.
AppArmor applies a set of rules (known as “profile”) on each program. The profile applied by the kernel depends on the installation path of the program being executed. Contrary to SELinux (discussed in Bagian 14.5, “Pengantar SELinux”), the rules applied do not depend on the user. All users face the same set of rules when they are executing the same program (but traditional user permissions still apply and might result in different behavior!).
Profil AppArmor disimpan dalam /etc/apparmor.d/ dan mereka berisi daftar aturan kontrol akses pada sumber daya yang dapat digunakan oleh masing-masing program. Profil dikompail dan dimuat ke kernel dengan perintah apparmor_parser. Setiap profil dapat dimuat dalam mode pemaksaan atau komplain. Yang pertama memberlakukan kebijakan dan melaporkan upaya pelanggaran, sementara yang kedua tidak menegakkan kebijakan tapi masih mencatat log panggilan sistem yang mestinya ditolak.

14.4.2. Memfungsikan AppArmor dan mengelola profil AppArmor

AppArmor support is built into the standard kernels provided by Debian. Enabling AppArmor is thus just a matter of installing some packages by executing apt install apparmor apparmor-profiles apparmor-utils with root privileges.
AppArmor is functional after the installation, and aa-status will confirm it quickly:
# aa-status
apparmor module is loaded.
40 profiles are loaded.
23 profiles are in enforce mode.
   /usr/bin/evince
   /usr/bin/evince-previewer
[...]
17 profiles are in complain mode.
   /usr/sbin/dnsmasq
[...]
14 processes have profiles defined.
12 processes are in enforce mode.
   /usr/bin/evince (3462)
[...]
2 processes are in complain mode.
   /usr/sbin/avahi-daemon (429) avahi-daemon
   /usr/sbin/avahi-daemon (511) avahi-daemon
0 processes are unconfined but have a profile defined.
The state of each profile can be switched between enforcing and complaining with calls to aa-enforce and aa-complain giving as parameter either the path of the executable or the path to the policy file. Additionally a profile can be entirely disabled with aa-disable or put in audit mode (to log accepted system calls too) with aa-audit.
# aa-enforce /usr/bin/pidgin
Setting /usr/bin/pidgin to enforce mode.
# aa-complain /usr/sbin/dnsmasq
Setting /usr/sbin/dnsmasq to complain mode.

14.4.3. Membuat profil baru

Meskipun membuat profil AppArmor agak mudah, kebanyakan program tidak memilikinya. Bagian ini akan menunjukkan kepada Anda bagaimana membuat profil baru dari awal dengan menggunakan program target dan membiarkan AppArmor memonitor panggilan sistem yang dilakukannya dan sumber daya yang diakses.
Program yang paling penting yang perlu dibatasi adalah program yang menghadapi jaringan karena mereka adalah target yang paling mungkin dari penyerang remote. Itu sebabnya AppArmor menyediakan perintah aa-unconfined untuk menampilkan daftar program yang tidak memiliki profil terkait dan yang mengekspos soket jaringan terbuka. Dengan pilihan --paranoid Anda mendapatkan semua proses yang tak dibatasi yang memiliki setidaknya satu koneksi jaringan yang aktif.
# aa-unconfined
801 /sbin/dhclient not confined
409 /usr/sbin/NetworkManager not confined
411 /usr/sbin/cupsd confined by '/usr/sbin/cupsd (enforce)'
429 /usr/sbin/avahi-daemon confined by 'avahi-daemon (enforce)'
516 /usr/sbin/cups-browsed confined by '/usr/sbin/cups-browsed (enforce)'
538 /usr/sbin/zebra not confined
591 /usr/sbin/named not confined
847 /usr/sbin/mysqld not confined
849 /usr/sbin/sshd not confined
1013 /usr/sbin/dhclient (/sbin/dhclient) not confined
1276 /usr/sbin/apache2 not confined
1322 /usr/sbin/apache2 not confined
1323 /usr/sbin/apache2 not confined
1324 /usr/sbin/apache2 not confined
1325 /usr/sbin/apache2 not confined
1327 /usr/sbin/apache2 not confined
1829 /usr/lib/ipsec/charon confined by '/usr/lib/ipsec/charon (enforce)'
2132 /usr/sbin/exim4 not confined
12865 /usr/bin/python3.7 (/usr/bin/python3) not confined
12873 /usr/bin/python3.7 (/usr/bin/python3) not confined
In the following example, we will thus try to create a profile for /sbin/dhclient. For this we will use aa-genprof dhclient. In Debian Buster there is a known bug[6] that makes the previous command fail with the following error: ERROR: Include file /etc/apparmor.d/local/usr.lib.dovecot.deliver not found. To fix it create the missing files with touch file. It will invite you to use the application in another window and when done to come back to aa-genprof to scan for AppArmor events in the system logs and convert those logs into access rules. For each logged event, it will make one or more rule suggestions that you can either approve or further edit in multiple ways:
# aa-genprof dhclient
Writing updated profile for /usr/sbin/dhclient.
Setting /usr/sbin/dhclient to complain mode.

Before you begin, you may wish to check if a
profile already exists for the application you
wish to confine. See the following wiki page for
more information:
https://gitlab.com/apparmor/apparmor/wikis/Profiles

Profiling: /usr/sbin/dhclient

Please start the application to be profiled in
another window and exercise its functionality now.

Once completed, select the "Scan" option below in
order to scan the system logs for AppArmor events.

For each AppArmor event, you will be given the
opportunity to choose whether the access should be
allowed or denied.

[(S)can system log for AppArmor events] / (F)inish
Reading log entries from /var/log/syslog.
Updating AppArmor profiles in /etc/apparmor.d.

Profile:  /usr/sbin/dhclient 1
Execute:  /usr/sbin/dhclient-script
Severity: unknown

(I)nherit / (C)hild / (P)rofile / (N)amed / (U)nconfined / (X) ix On / (D)eny / Abo(r)t / (F)inish
P
Should AppArmor sanitise the environment when
switching profiles?

Sanitising environment is more secure,
but some applications depend on the presence
of LD_PRELOAD or LD_LIBRARY_PATH.

(Y)es / [(N)o]
Y
Writing updated profile for /usr/sbin/dhclient-script.
Complain-mode changes:

Profile:    /usr/sbin/dhclient 2
Capability: net_raw
Severity:   8

 [1 - capability net_raw,]
[(A)llow] / (D)eny / (I)gnore / Audi(t) / Abo(r)t / (F)inish
A
Adding capability net_raw to profile.

Profile:  /sbin/dhclient
Capability: net_bind_service
Severity:   8

 [1 - #include <abstractions/nis> ]
  2 - capability net_bind_service,
(A)llow / [(D)eny] / (I)gnore / Audi(t) / Abo(r)t / (F)inish
A
Adding #include <abstractions/nis> to profile.

Profile:  /usr/sbin/dhclient 3
Path:     /etc/ssl/openssl.cnf
New Mode: owner r
Severity: 2

 [1 - #include <abstractions/lightdm>]
  2 - #include <abstractions/openssl>
  3 - #include <abstractions/ssl_keys>
  4 - owner /etc/ssl/openssl.cnf r,
(A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish
2

Profile:  /usr/sbin/dhclient
Path:     /etc/ssl/openssl.cnf
New Mode: owner r
Severity: 2

  1 - #include <abstractions/lightdm>
 [2 - #include <abstractions/openssl>]
  3 - #include <abstractions/ssl_keys>
  4 - owner /etc/ssl/openssl.cnf r,
[(A)llow] / (D)eny / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Abo(r)t / (F)inish / (M)ore
A
[...]
Profile:  /usr/sbin/dhclient-script 4
Path:     /usr/bin/dash
New Mode: owner r
Severity: unknown

 [1 - #include <abstractions/lightdm>]
  2 - #include <abstractions/ubuntu-browsers.d/plugins-common>
  3 - owner /usr/bin/dash r,
(A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish
A
Adding #include <abstractions/lightdm> to profile.
Deleted 2 previous matching profile entries.

= Changed Local Profiles =

The following local profiles were changed. Would you like to save them?

 [1 - /usr/sbin/dhclient]
  2 - /usr/sbin/dhclient-script
(S)ave Changes / Save Selec(t)ed Profile / [(V)iew Changes] / View Changes b/w (C)lean profiles / Abo(r)t
S
Writing updated profile for /usr/sbin/dhclient.
Writing updated profile for /usr/sbin/dhclient-script.

Profiling: /usr/sbin/dhclient

Please start the application to be profiled in
another window and exercise its functionality now.

Once completed, select the "Scan" option below in
order to scan the system logs for AppArmor events.

For each AppArmor event, you will be given the
opportunity to choose whether the access should be
allowed or denied.

[(S)can system log for AppArmor events] / (F)inish
F
Reloaded AppArmor profiles in enforce mode.

Please consider contributing your new profile!
See the following wiki page for more information:
https://gitlab.com/apparmor/apparmor/wikis/Profiles

Finished generating profile for /usr/sbin/dhclient.
Perhatikan bahwa program tidak menampilkan kembali karakter kontrol yang Anda ketik tapi untuk kejelasan penjelasan saya telah menyertakan mereka di transkrip sebelumnya.

1

Kejadian pertama yang terdeteksi adalah eksekusi program lain. Dalam hal ini, Anda memiliki beberapa pilihan: Anda dapat menjalankan program dengan profil proses induk (pilihan "Mewarisi"), Anda dapat menjalankannya sendiri dengan profil khusus (pilihan "Profile" dan "Named", hanya berbeda pada kemungkinan untuk menggunakan nama profil sebarang), Anda dapat menjalankannya dengan profil sub proses induk (pilihan "Child"), Anda dapat menjalankannya tanpa profil (pilihan "Unconfined"), atau Anda dapat memutuskan untuk tidak menjalankannya sama sekali (pilihan "Deny").
Perhatikan bahwa ketika Anda memilih untuk menjalankannya di bawah profil berdedikasi yang belum ada, alat akan membuat profil yang kurang untuk Anda dan akan membuat saran aturan untuk profil itu pada eksekusi yang sama.

2

Di tingkat kernel, kekuatan khusus pengguna root telah dibagi dalam "capabilities". Ketika panggilan sistem membutuhkan kemampuan tertentu, AppArmor akan memverifikasi apakah profil mengizinkan program untuk memanfaatkan kemampuan ini.

3

Here the program seeks read permissions for /etc/ssl/openssl.cnf. aa-genprof detected that this permission was also granted by multiple “abstractions” and offers them as alternative choices. An abstraction provides a reusable set of access rules grouping together multiple resources that are commonly used together. In this specific case, the file is generally accessed through the nameservice related functions of the C library and we type “2” to first select the “#include <abstractions/openssl>” choice and then “A” to allow it.

4

Notice that this access request is not part of the dhclient profile but of the new profile that we created when we allowed /usr/sbin/dhclient-script to run with its own profile.
Setelah setelah melihat semua peristiwa yang dilog, program ini menawarkan untuk menyimpan semua profil yang diciptakan selama berjalan. Dalam kasus ini, kita memiliki dua profil yang kami simpan sekaligus dengan "Save" (tapi Anda dapat menyimpan mereka secara individual juga) sebelum meninggalkan program dengan "Finish".
aa-genprof sebenarnya hanya pembungkus cerdas untuk aa-logprof: itu menciptakan profil kosong, memuatnya dalam mode komplain dan kemudian menjalankan aa-logprof yang merupakan alat untuk memperbarui profil berdasarkan pelanggaran profil yang telah dicatat. Jadi Anda dapat kembali menjalankan alat tersebut kemudian untuk meningkatkan profil yang baru Anda buat.
If you want the generated profile to be complete, you should use the program in all the ways that it is legitimately used. In the case of dhclient, it means running it via Network Manager, running it via ifupdown, running it manually, etc. In the end, you might get a /etc/apparmor.d/usr.sbin.dhclient close to this:
# Last Modified: Fri Jul  5 00:51:02 2019
#include <tunables/global>

/usr/sbin/dhclient {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability net_bind_service,
  capability net_raw,

  /bin/dash r,
  /etc/dhcp/* r,
  /etc/dhcp/dhclient-enter-hooks.d/* r,
  /etc/dhcp/dhclient-exit-hooks.d/* r,
  /etc/resolv.conf.* w,
  /etc/samba/dhcp.conf.* w,
  /proc/*/net/dev r,
  /proc/filesystems r,
  /run/dhclient*.pid w,
  /sbin/dhclient mr,
  /sbin/dhclient-script rCx,
  /usr/lib/NetworkManager/nm-dhcp-helper Px,
  /var/lib/NetworkManager/* r,
  /var/lib/NetworkManager/*.lease rw,
  /var/lib/dhcp/*.leases rw,

  owner /etc/** mrwk,
  owner /var/** mrwk,
  owner /{,var/}run/** mrwk,
}
And /etc/apparmor.d/usr.sbin.dhclient-script might be similar to this:
# Last Modified: Fri Jul  5 00:51:55 2019
#include <tunables/global>

/usr/sbin/dhclient-script {
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/lightdm>
}