854
Comment: Initial instructions draft.
|
1993
Point to profiles-extra, mention aa-status, update URL for usertagged bugs.
|
Deletions are marked like this. | Additions are marked like this. |
Line 1: | Line 1: |
Install AppArmor userspace tools and some contributed profiles: | #language en ~-[[DebianWiki/EditorGuide#translation|Translation(s)]]: none-~ ---- == Requirements == A Debian 7 "Wheezy" or newer GNU/Linux system is required. If you are using wheezy, upgrading to systemd 204-14 from wheezy-backports is recommended, but not mandatory. == Install software == Install !AppArmor userspace tools and some contributed profiles: |
Line 7: | Line 18: |
Enable the AppArmor LSM: | == Enable AppArmor == Enable the !AppArmor LSM: |
Line 15: | Line 28: |
See what running executable is currently confined by an AppArmor profile: | == Inspect the current state == See what running executables are currently confined by an !AppArmor profile: |
Line 19: | Line 34: |
$ sudo aa-status | |
Line 21: | Line 37: |
One place to find more profiles is [[http://bugs.debian.org/cgi-bin/pkgreport.cgi?tag=new-profile;users=apparmor@packages.debian.org|the patches, with new profiles included, that were submitted to Debian]]. | == Enable / install more profiles == |
Line 23: | Line 39: |
Once you've dropped the new profile into `/etc/apparmor.d/`, use `apparmor_parser(8)` to insert it into the kernel. | Find more profiles: |
Line 25: | Line 41: |
AppArmor audit logs can be found in `/var/log/kern.log`. | * in the DebianPkg:apparmor-profiles package; * in the DebianPkg:apparmor-profiles-extra package (2014-08-28: waiting in the NEW queue); * in [[https://udd.debian.org/cgi-bin/bts-usertags.cgi?user=pkg-aa-profiles-team@lists.alioth.debian.org|the patches, with new profiles included]], that were submitted to Debian; * in Ubuntu. Once you've dropped the new profile into `/etc/apparmor.d/`, use [[DebianMan:8/apparmor_parser|apparmor_parser(8)]] to insert it into the kernel. For example, to set all "extra" profiles (provided in the apparmor-profiles package) to complain mode (security policy is not enforced, but corresponding access violations are logged), do the following: {{{ cd /usr/share/doc/apparmor-profiles/extras cp -i *.* /etc/apparmor.d/ for f in *.* ; do aa-complain /etc/apparmor.d/$f; done }}} To set these profiles to enforce mode, use `aa-enforce` instead of `aa-complain`. !AppArmor audit logs can be found in `/var/log/syslog`. == Learn more == See the "External links" section on [[AppArmor|the main AppArmor page]]. |
Translation(s): none
Requirements
A Debian 7 "Wheezy" or newer GNU/Linux system is required.
If you are using wheezy, upgrading to systemd 204-14 from wheezy-backports is recommended, but not mandatory.
Install software
Install AppArmor userspace tools and some contributed profiles:
$ sudo apt-get install apparmor apparmor-profiles apparmor-utils
Enable AppArmor
Enable the AppArmor LSM:
$ sudo perl -pi -e 's,GRUB_CMDLINE_LINUX="(.*)"$,GRUB_CMDLINE_LINUX="$1 apparmor=1 security=apparmor",' /etc/default/grub $ sudo update-grub $ sudo reboot
Inspect the current state
See what running executables are currently confined by an AppArmor profile:
$ ps auxZ | grep -v '^unconfined' $ sudo aa-status
Enable / install more profiles
Find more profiles:
in the apparmor-profiles package;
in the apparmor-profiles-extra package (2014-08-28: waiting in the NEW queue);
in the patches, with new profiles included, that were submitted to Debian;
- in Ubuntu.
Once you've dropped the new profile into /etc/apparmor.d/, use apparmor_parser(8) to insert it into the kernel.
For example, to set all "extra" profiles (provided in the apparmor-profiles package) to complain mode (security policy is not enforced, but corresponding access violations are logged), do the following:
cd /usr/share/doc/apparmor-profiles/extras cp -i *.* /etc/apparmor.d/ for f in *.* ; do aa-complain /etc/apparmor.d/$f; done
To set these profiles to enforce mode, use aa-enforce instead of aa-complain.
AppArmor audit logs can be found in /var/log/syslog.
Learn more
See the "External links" section on the main AppArmor page.