Differences between revisions 1 and 11 (spanning 10 versions)
Revision 1 as of 2012-05-11 15:40:30
Size: 854
Editor: ?IntRigeri
Comment: Initial instructions draft.
Revision 11 as of 2014-08-28 20:29:36
Size: 1993
Editor: ?IntRigeri
Comment: Point to profiles-extra, mention aa-status, update URL for usertagged bugs.
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
Install AppArmor userspace tools and some contributed profiles: #language en
~-[[DebianWiki/EditorGuide#translation|Translation(s)]]: none-~
----
== Requirements ==

A Debian 7 "Wheezy" or newer GNU/Linux system is required.

If you are using wheezy, upgrading to systemd 204-14 from wheezy-backports is recommended, but not mandatory.

== Install software ==

Install !AppArmor userspace tools and some contributed profiles:
Line 7: Line 18:
Enable the AppArmor LSM: == Enable AppArmor ==

Enable the !AppArmor LSM:
Line 15: Line 28:
See what running executable is currently confined by an AppArmor profile: == Inspect the current state ==

See what running executables are currently confined by an !AppArmor profile:
Line 19: Line 34:
$ sudo aa-status
Line 21: Line 37:
One place to find more profiles is [[http://bugs.debian.org/cgi-bin/pkgreport.cgi?tag=new-profile;users=apparmor@packages.debian.org|the patches, with new profiles included, that were submitted to Debian]]. == Enable / install more profiles ==
Line 23: Line 39:
Once you've dropped the new profile into `/etc/apparmor.d/`, use `apparmor_parser(8)` to insert it into the kernel. Find more profiles:
Line 25: Line 41:
AppArmor audit logs can be found in `/var/log/kern.log`.  * in the DebianPkg:apparmor-profiles package;
 * in the DebianPkg:apparmor-profiles-extra package (2014-08-28: waiting in the NEW queue);
 * in [[https://udd.debian.org/cgi-bin/bts-usertags.cgi?user=pkg-aa-profiles-team@lists.alioth.debian.org|the patches, with new profiles included]], that were submitted to Debian;
 * in Ubuntu.

Once you've dropped the new profile into `/etc/apparmor.d/`, use [[DebianMan:8/apparmor_parser|apparmor_parser(8)]] to insert it into the kernel.

For example, to set all "extra" profiles (provided in the apparmor-profiles package) to complain mode (security policy is not enforced, but corresponding access violations are logged), do the following:

{{{
cd /usr/share/doc/apparmor-profiles/extras
cp -i *.* /etc/apparmor.d/
for f in *.* ; do aa-complain /etc/apparmor.d/$f; done
}}}

To set these profiles to enforce mode, use `aa-enforce` instead of `aa-complain`.

!AppArmor audit logs can be found in `/var/log/syslog`.

== Learn more ==

See the "External links" section on [[AppArmor|the main AppArmor page]].

Translation(s): none


Requirements

A Debian 7 "Wheezy" or newer GNU/Linux system is required.

If you are using wheezy, upgrading to systemd 204-14 from wheezy-backports is recommended, but not mandatory.

Install software

Install AppArmor userspace tools and some contributed profiles:

$ sudo apt-get install apparmor apparmor-profiles apparmor-utils

Enable AppArmor

Enable the AppArmor LSM:

$ sudo perl -pi -e 's,GRUB_CMDLINE_LINUX="(.*)"$,GRUB_CMDLINE_LINUX="$1 apparmor=1 security=apparmor",' /etc/default/grub
$ sudo update-grub
$ sudo reboot

Inspect the current state

See what running executables are currently confined by an AppArmor profile:

$ ps auxZ | grep -v '^unconfined'
$ sudo aa-status

Enable / install more profiles

Find more profiles:

Once you've dropped the new profile into /etc/apparmor.d/, use apparmor_parser(8) to insert it into the kernel.

For example, to set all "extra" profiles (provided in the apparmor-profiles package) to complain mode (security policy is not enforced, but corresponding access violations are logged), do the following:

cd /usr/share/doc/apparmor-profiles/extras
cp -i *.* /etc/apparmor.d/
for f in *.* ; do aa-complain /etc/apparmor.d/$f; done

To set these profiles to enforce mode, use aa-enforce instead of aa-complain.

AppArmor audit logs can be found in /var/log/syslog.

Learn more

See the "External links" section on the main AppArmor page.