Differences between revisions 54 and 55
Revision 54 as of 2020-01-31 19:37:51
Size: 3770
Editor: nodiscc
Comment: WIP wording, formatting, cleanup
Revision 55 as of 2020-01-31 19:59:16
Size: 4197
Editor: nodiscc
Comment: WIP wording, formatting, clarify installing/enabling, packages, improve links
Deletions are marked like this. Additions are marked like this.
Line 57: Line 57:
== Enable / install more profiles == == Find / install more profiles ==
Line 59: Line 59:
!AppArmor profiles live in `/etc/apparmor.d/`. Some packages automatically install their own profiles in this directory. To install more profiles: !AppArmor profiles live in `/etc/apparmor.d/`. Some packages automatically install their own profiles in this directory. To find more profiles:
Line 67: Line 67:
For example, to set all "extra" profiles (provided in the apparmor-profiles package) to complain mode (except `deny` rules that are silently enforced, security policy is not enforced and access violations are logged), do the following: == Enabling profiles ==

Files dropped by Debian packages in `/etc/apparmor.d/` are automatically enabled. Other profiles need to be copied to this directory and manually set to `complain` or `enforce` mode.

- `complain` mode: violations to the policy will only be logged
- `enforce` mode: operations that violate the policy will be blocked.

For example to install an "extra" profile from the `/usr/share/apparmor/extra-profiles/` directory provided by [[DebianPkg:apparmor-profiles]] and set it to `complain` mode:
Line 70: Line 78:
cd /usr/share/doc/apparmor-profiles/extras
cp -i *.* /etc/apparmor.d/
# list available profiles
$ ls /usr/share/apparmor/extra-profiles/
Line 73: Line 81:
for f in *.* ; do aa-complain /etc/apparmor.d/$f; done # install the profile
$ sudo cp /usr/share/apparmor/extra-profiles/usr.bin.example /etc/apparmor.d/

# set the profile to complain mode
sudo aa-complain /etc/apparmor.d/usr.bin.example
Line 76: Line 88:
To set these profiles to enforce mode, use `aa-enforce` instead of `aa-complain`. '''Beware''' though: many of these profiles are not up-to-date and will break functionality in enforce mode (and possibly even in complain mode); only enforce them if you're ready to improve them ''upstream''. Not that `deny` rules in profiles are *always* enforced/blocked, even in `complain` mode.

To set a profile to enforce mode, use `aa-enforce` instead of `aa-complain`. '''Beware''' though: many profiles are not up-to-date and will break functionality in enforce mode, be ready to [[#Debug|debug]]!

Translation(s): none

This page describes how to use AppArmor on Debian.


Install software

AppArmor is available in Debian since Debian 7 "Wheezy".

Install AppArmor userspace tools:

Enable AppArmor

If you are using Debian 10 "Buster" or newer, AppArmor is enabled by default so you can skip this step.

Enable the AppArmor Linux Security Modules (LSM):

$ sudo mkdir -p /etc/default/grub.d
$ echo 'GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT apparmor=1 security=apparmor"' \
  | sudo tee /etc/default/grub.d/apparmor.cfg
$ sudo update-grub
$ sudo reboot

Inspect the current state

List all loaded AppArmor profiles for applications and processes and detail their status (enforced, complain, unconfined):

$ sudo aa-status

List running executables which are currently confined by an AppArmor profile:

$ ps auxZ | grep -v '^unconfined'

List of processes with tcp or udp ports that do not have AppArmor profiles loaded:

$ sudo aa-unconfined

Find / install more profiles

AppArmor profiles live in /etc/apparmor.d/. Some packages automatically install their own profiles in this directory. To find more profiles:

Enabling profiles

Files dropped by Debian packages in /etc/apparmor.d/ are automatically enabled. Other profiles need to be copied to this directory and manually set to complain or enforce mode.

- complain mode: violations to the policy will only be logged - enforce mode: operations that violate the policy will be blocked.

For example to install an "extra" profile from the /usr/share/apparmor/extra-profiles/ directory provided by apparmor-profiles and set it to complain mode:

# list available profiles
$ ls /usr/share/apparmor/extra-profiles/

# install the profile
$ sudo cp /usr/share/apparmor/extra-profiles/usr.bin.example /etc/apparmor.d/

# set the profile to complain mode
sudo aa-complain /etc/apparmor.d/usr.bin.example

Not that deny rules in profiles are *always* enforced/blocked, even in complain mode.

To set a profile to enforce mode, use aa-enforce instead of aa-complain. Beware though: many profiles are not up-to-date and will break functionality in enforce mode, be ready to debug!

Debug

AppArmor audit logs can be found in the systemd Journal or in /var/log/syslog.

For more detailed instructions, please read the dedicated documentation for debugging AppArmor.

Report a bug

If you think that you've found a bug in AppArmor or a software in Debian which ships its own profile, you might want to report a bug.

Learn more

Learn more or start contributing.

Disable AppArmor

First, you can disable individual profiles with aa-disable.

But if you want to entirely disable AppArmor on your system, run:

$ sudo mkdir -p /etc/default/grub.d
$ echo 'GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT apparmor=0"' \
  | sudo tee /etc/default/grub.d/apparmor.cfg
$ sudo update-grub
$ sudo reboot

See also


CategorySystemSecurity