I installed apparmor now what? Where do I get profiles?

u666sa · 2021-03-19 19:27:53

I followed the archwiki and installed apparmor. Everything to the __T__. But without profiles it is useless.

Do I actually generate profiles for every program I install?

Or do I copy profiles from somewhere? I've read you can copy from Ubuntu, so I went ahead and downloaded ubuntu deb package, google-chrome-unstable and looked inside, did not find a profile.

How is this suppose to be done? In other words, just having it installed and enabled is not enough, more configuration is required. Where do I get profiles or do I generate profiles, and for what software do I generate profiles? Do I generate for nano for example, lul?

Last edited by u666sa (2021-03-19 19:29:20)

archimboldo · 2021-03-19 20:12:30

You should start with this https://wiki.archlinux.org/index.php/AppArmor

u666sa · 2021-03-20 10:27:56

archimboldo wrote:

You should start with this https://wiki.archlinux.org/index.php/AppArmor

I spend several hours on that article installing apparmor. What exactly you didn't understand when I wrote I installed according to arch wiki? I thought I made it clear.

I have questions beyond archwiki. Please read my original post before giving out links to arch wiki.

ponyrider · 2021-03-20 10:40:59

AppArmor proactively protects the operating system and applications from external or internal threats and even zero-day attacks by enforcing a specific rule set on a per application basis

here is another link to the wiki
https://wiki.archlinux.org/index.php/AppArmor

tucuxi · 2021-03-20 14:08:46

What do you hope to accomplish with a profile for nano? Or in general?

u666sa · 2021-03-20 14:31:09

@tucuxi
Well this what I'm talking about. First adequate response. The other two dudes have no idea that apparmor without app profile = zero protection.... Obviously profile for nano is not needed. But, let's say profile for google-chrome-unstable. Or, profile for VLC, or NewsFlash or qbittorrent or bitwarden, or wireshark or qt designer, or gimp or krita.

What is general rule of thumb for which application to get profiles? I bet not all listed above should have a profile. How do I decide which application should have a profile?

Secondly, do I a) generate profile myself? or do I b) go ahead and download profile from somewhere? I understand it can be generated. But what is the usual practice, perhaps it's easier to just get it somewhere already premaid?

Last edited by u666sa (2021-03-20 14:31:50)

archimboldo · 2021-03-20 14:40:04

Once again .... https://wiki.archlinux.org/index.php/Ap … g_profiles

Last edited by archimboldo (2021-03-20 14:40:33)

nl6720 · 2021-03-20 16:59:33

Apparmor profiles reside in /etc/apparmor.d/ and they are shipped with the apparmor package or the packages that they target.

$ pkgfile -d /etc/apparmor.d/
extra/apparmor
extra/libakonadi
extra/lightdm
community/firejail
community/lxc
community/torbrowser-launcher

Additional (not-as-good) profiles (and also Ubuntu's profiles) can be found in /usr/share/apparmor/extra-profiles/. You can copy them to /etc/apparmor.d/. Be sure to read /usr/share/apparmor/extra-profiles/README beforehand.

beroal · 2021-03-21 14:55:55

What a coincidence. I also plan to use AppArmor (after I do a clean install of ArchLinux).

The official repository was officially ☺ deleted. openSUSE packages contain AppArmor profiles (I checked for “pure-ftpd”), so in principle we can download profiles here.

I wonder

whether it's possible to deny access to a specific directory for all programs except chosen,
whether it's possible to grant access to a file per process invocation, for example, starting a text editor with a file and granting access to that file with one command.

Last edited by beroal (2021-03-21 14:57:22)

adventurer · 2021-03-21 15:47:25

Well, first of all, you can find additional profiles in /usr/share/apparmor/extra-profiles. Note that the README therein says:

The profiles in this directory are not turned on by default because they are not as mature as the profiles in /etc/apparmor.d/.

Nevertheless, you can copy the ones needed by you to /etc/apparmor.d. As in most cases adjustments will be necessary I suggest to set them into complain mode first for a couple of days and add rules, if required, with regularly executing sudo aa-logprof. Once everything works as expected those profiles should be set into enforce mode.

Updated or new profiles might also be available on https://gitlab.com/apparmor/apparmor/-/ … r/profiles. There are also a couple of github repositiories that offer profiles, but again they usually have to be adjusted by using aa-logprof.

However, one big advantage of AppArmor over, say, SELinux is that it's relatively easy to interactively create your own profiles:

1. Use sudo aa-autodep some_application to generate a basic profile for that application in complain mode.
2. Leave it in complain mode for a while and add the required rules as written above. You need some basic knowledge about the AppArmor syntax, though, e.g., regarding access modes and aa-logprof itself (https://man.archlinux.org/man/extra/app … gprof.8.en).
3. Finally set the profile in enforce mode. You might also finetune it manually.

A good documentation is on https://documentation.suse.com/sles/12- … armor.html. However. some parts (e.g., reagding Yast) is SuSe-specific.

adventurer · 2021-03-21 15:59:37

beroal wrote:

I wonder
[*]whether it's possible to deny access to a specific directory for all programs except chosen,[/*]

Access to any folder/file is denied by default unless explicitly allowed.

[*]whether it's possible to grant access to a file per process invocation, for example, starting a text editor with a file and granting access to that file with one command.[/*]

Not with one command. Access to this file by the text editor must be allowed. Placeholders can also be used, e.g.:

owner @{HOME}/**.txt rw,

EDIT: As an alternative to AppArmor you might want to consider Firejail which comes with about 1,000 ready-to-use profiles.

Last edited by adventurer (2021-03-21 16:33:46)

beroal · 2021-03-28 11:43:30

I searched in openSUSE repositories for packages with AppArmor profiles. The results aren't plentiful. :-( Unfortunately, there is no file extension for AppArmor profiles, so I can't search by a file extension. The command below was executed in an LXC with openSUSE Tumbleweed.

zypper se -nfd --provides apparmor

Loading repository data...
Reading installed packages...

S  | Name                            | Summary                                                             | Type
---+---------------------------------+---------------------------------------------------------------------+--------
   | MicroOS-release                 | openSUSE MicroOS                                                    | package
   | apache2-mod_apparmor            | AppArmor module for apache2                                         | package
   | apparmor                        | AppArmor                                                            | pattern
i+ | apparmor-abstractions           | AppArmor abstractions and directory structure                       | package
   | apparmor-docs                   | AppArmor Documentation package                                      | package
i+ | apparmor-parser                 | AppArmor userlevel parser utility                                   | package
   | apparmor-parser-lang            | Translations for package apparmor                                   | package
   | apparmor-profiles               | AppArmor profiles that are loaded into the apparmor kernel module   | package
   | apparmor-rpm-macros             | RPM macros used to setup apparmor profiles                          | package
i  | apparmor-utils                  | AppArmor User-Level Utilities Useful for Creating AppArmor Profiles | package
   | apparmor-utils-lang             | Translations for package apparmor                                   | package
   | colord                          | System Daemon for Managing Color Devices                            | package
   | coturn                          | TURN and STUN server for VoIP                                       | package
   | dovecot23                       | IMAP and POP3 Server Written Primarily with Security in Mind        | package
   | firejail                        | Linux namepaces sandbox program                                     | package
   | galene                          | Galène videoconferencing server                                     | package
   | ghostscript                     | The Ghostscript interpreter for PostScript and PDF                  | package
   | git-web                         | Git Web Interface                                                   | package
   | gude-mouseclock-udev            | Udev rules for GUDE DCF77 receivers                                 | package
   | haproxy                         | The Reliable, High Performance TCP/HTTP Load Balancer               | package
   | hostapd                         | Daemon for running a WPA capable Access Point                       | package
   | i2pd                            | C++ implementation of an I2P client                                 | package
   | libapparmor-devel               | Development headers and libraries for libapparmor                   | package
i  | libapparmor1                    | Utility library for AppArmor                                        | package
   | libapparmor1-32bit              | Utility library for AppArmor                                        | package
   | liblxc1                         | LXC container runtime library                                       | package
   | libvirt-daemon                  | Server side daemon and supporting files for libvirt                 | package
   | llmnrd                          | Link-Local Multicast Resolution (LLMNR) Daemon                      | package
   | lxc                             | Userspace tools for Linux kernel containers                         | package
   | microos_apparmor                | Apparmor Support                                                    | pattern
   | mlocate                         | A utility for finding files by name                                 | package
   | monitoring-plugins-bonding      | Nagios Network Bonding Check                                        | package
   | monitoring-plugins-cups         | Check cups service                                                  | package
   | monitoring-plugins-dhcp         | Check DHCP servers                                                  | package
   | monitoring-plugins-disk         | Check disk space                                                    | package
   | monitoring-plugins-icmp         | Send ICMP packets to the specified host                             | package
   | monitoring-plugins-ide_smart    | Check local hard drive                                              | package
   | monitoring-plugins-ipmi-sensor1 | IPMI Sensor 1 Monitoring Plugin                                     | package
   | monitoring-plugins-load         | Test the current system load average                                | package
   | monitoring-plugins-mem          | Check memory plugin for Nagios                                      | package
   | monitoring-plugins-ntp_time     | Check clock offset with the ntp server                              | package
   | monitoring-plugins-ping         | Check connection statistics                                         | package
   | monitoring-plugins-procs        | Check processes                                                     | package
   | monitoring-plugins-repomd       | Plugin to check freshness of repomd.xml file                        | package
   | monitoring-plugins-sar-perf     | Get performance data from sar                                       | package
   | monitoring-plugins-smart        | Check SMART status of a given disk                                  | package
   | monitoring-plugins-ssh          | Check SSH service                                                   | package
   | monitoring-plugins-swap         | Check swap space                                                    | package
   | monitoring-plugins-users        | Check number of users currently logged in                           | package
   | monitoring-plugins-zypper       | Check for software updates via zypper                               | package
   | mosquitto                       | A MQTT v3.1/v3.1.1 Broker                                           | package
   | mumble-server                   | Voice Communication Server for Gamers                               | package
   | openQA                          | The openQA web-frontend, scheduler and tools                        | package
   | openQA-worker                   | The openQA worker                                                   | package
i  | openSUSE-release                | openSUSE Tumbleweed                                                 | package
   | pam_apparmor                    | PAM module for AppArmor change_hat                                  | package
   | pam_apparmor-32bit              | PAM module for AppArmor change_hat                                  | package
   | patterns-base-apparmor          | AppArmor                                                            | package
   | patterns-base-apparmor-32bit    | AppArmor                                                            | package
   | patterns-microos-apparmor       | Apparmor Support                                                    | package
   | perl-apparmor                   | Perl interface for libapparmor functions                            | package
   | postsrsd                        | Sender Rewriting Support for postfix                                | package
   | pure-ftpd                       | A Lightweight, Fast, and Secure FTP Server                          | package
i  | python3-apparmor                | Python 3 interface for libapparmor functions                        | package
   | redshift                        | Tool for adjusting the color temperature of the screen              | package
   | rspamd                          | Spam filtering system                                               | package
   | ruby-apparmor                   | Ruby interface for libapparmor functions                            | package
i+ | torbrowser-apparmor-profile     | Apparmor profile for Tor Browser                                    | package
   | torbrowser-launcher             | Tool for launching and easy-updates of Tor Browser                  | package
   | yast2-apparmor                  | YaST2 - Plugins for AppArmor Profile Management                     | package

adventurer · 2021-03-28 12:49:13

beroal wrote:

I searched in openSUSE repositories for packages with AppArmor profiles. The results aren't plentiful.

Well, as mentioned you can find more profiles in /usr/share/apparmor/extra-profiles and in many github repositories - see https://github.com/search?q=apparmor

Furthermore, some packages come with their own AppArmor profiles like akonadi via libakonadi.

beroal · 2021-03-28 15:23:32

adventurer wrote:

Well, as mentioned you can find more profiles … in many github repositories - see https://github.com/search?q=apparmor
Furthermore, some packages come with their own AppArmor profiles like akonadi via libakonadi.

Thank you for the link. Another source of profiles won't hurt. Some of those repositories contain not profiles, but AppArmor modules and such, so we better search for “apparmor profiles”.

adventurer · 2021-03-28 15:53:35

beroal wrote:

Another source of profiles won't hurt.

Hm, what are you talking about? There are no other "official" sources. There are the profiles from those 3rd-party repositories which might work or not (in many/most cases they still need some modifications/finetuning), and how good/strict they are might be questionable in some cases. But I told you that it's relatively easy to create your own profiles with aa-logprof.

But if you prefer ready-to-use solutions handed to you on a silver platter, I suggest that you better use Firejail.

Arch Linux

#1 2021-03-19 19:27:53

I installed apparmor now what? Where do I get profiles?

#2 2021-03-19 20:12:30

Re: I installed apparmor now what? Where do I get profiles?

#3 2021-03-20 10:27:56

Re: I installed apparmor now what? Where do I get profiles?

#4 2021-03-20 10:40:59

Re: I installed apparmor now what? Where do I get profiles?

#5 2021-03-20 14:08:46

Re: I installed apparmor now what? Where do I get profiles?

#6 2021-03-20 14:31:09

Re: I installed apparmor now what? Where do I get profiles?

#7 2021-03-20 14:40:04

Re: I installed apparmor now what? Where do I get profiles?

#8 2021-03-20 16:59:33

Re: I installed apparmor now what? Where do I get profiles?

#9 2021-03-21 14:55:55

Re: I installed apparmor now what? Where do I get profiles?

#10 2021-03-21 15:47:25

Re: I installed apparmor now what? Where do I get profiles?

#11 2021-03-21 15:59:37

Re: I installed apparmor now what? Where do I get profiles?

#12 2021-03-28 11:43:30

Re: I installed apparmor now what? Where do I get profiles?

#13 2021-03-28 12:49:13

Re: I installed apparmor now what? Where do I get profiles?

#14 2021-03-28 15:23:32

Re: I installed apparmor now what? Where do I get profiles?

#15 2021-03-28 15:53:35

Re: I installed apparmor now what? Where do I get profiles?

Board footer