Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #168093

Re: What can AppArmor do?

Show all headers | View raw

On 5/18/2016 10:27 AM, Darac Marjal wrote:
> On Wed, May 18, 2016 at 09:23:34AM -0500, Richard Owlett wrote:
>> https://packages.debian.org/jessie/apparmor is uninformative.
>>
>> It says:
>> "This provides the system initialization scripts needed to use
>> the AppArmor Mandatory Access Control system, including the
>> AppArmor Parser which is required to convert AppArmor text
>> profiles into machine-readable policies that are loaded into
>> the kernel for use with the AppArmor Linux Security Module."
>>
>> There is a link to http://wiki.apparmor.net/index.php/Main_Page
>> which gives no hints!
>>
>> My application question.
>> 1. If BrowserA and BrowserB are installed, can AppArmor prevent
>> BrowserB from
>>   connecting to the internet independent of user permissions?
>> 2. Can AppArmor default to preventing *ALL* but specific
>> applications from
>>   connecting to the internet independent of user permissions?
>
>  From that wiki page: "AppArmor security policies completely
> define what system resources individual applications can access,
> and with what privileges."

That statement reminds me of one of George Orwell's characters 
saying "It means whatever I want it to mean."


>
> "Network access" is, although not explicitly stated on that page,
> a system resource. So yes, you can prevent, say, an application
> called "firefox" from accessing the network entirely. Looking
> deeper, I see
> http://wiki.apparmor.net/index.php/AppArmor_Core_Policy_Reference#Network_rules
> which defines the network rules of AppArmor. It appears that you
> should be able to constrain said application to only connect to
> certain addresses.

The very first line of the page said "Don't trust me." 
[paraphrased ;]
I was looking for descriptive information aimed at a general 
audience. I was looking for guidance on "suitability for intended 
use". A "No" to my narrowly stated question would have eliminated 
AppArmor. To actually want to use it is a wider question. I was 
hoping for a response from an actual user.

>
> Just a warning that you need to think carefully about the rules
> you implement. Can a user get around your rules by renaming
> "firefox" to "iceweasel"? If, instead, you put blanket rules in
> place check that you aren't blocking other networking functions
> (like X talking over the local network, for example). AppArmor
> does, however, have a "complain" mode where, rather than
> enforcing rules it will log violations to syslog. You can use
> this to guide your profile creation.

After initially reading your post I found something that hinted 
that "blacklist all except explicit exceptions" would be 
possible. More reading required.

Thank you for your time.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

What can AppArmor do? Richard Owlett <rowlett@cloud85.net> - 2016-05-18 16:30 +0200
  Re: What can AppArmor do? Darac Marjal <mailinglist@darac.org.uk> - 2016-05-18 17:30 +0200
    Re: What can AppArmor do? Richard Owlett <rowlett@cloud85.net> - 2016-05-20 17:00 +0200
      Re: What can AppArmor do? Lisi Reisz <lisi.reisz@gmail.com> - 2016-05-20 17:10 +0200
        Re: What can AppArmor do? Richard Owlett <rowlett@cloud85.net> - 2016-05-20 17:50 +0200
          Re: What can AppArmor do? Lisi Reisz <lisi.reisz@gmail.com> - 2016-05-20 18:10 +0200
          Re: What can AppArmor do? cbannister@slingshot.co.nz - 2016-05-21 18:10 +0200
        Re: What can AppArmor do? cbannister@slingshot.co.nz - 2016-05-21 18:00 +0200
          Re: What can AppArmor do? Lisi Reisz <lisi.reisz@gmail.com> - 2016-05-21 23:20 +0200
            Re: What can AppArmor do? cbannister@slingshot.co.nz - 2016-05-22 08:50 +0200
              Re: What can AppArmor do? Lisi Reisz <lisi.reisz@gmail.com> - 2016-05-22 12:20 +0200
                Re: What can AppArmor do? cbannister@slingshot.co.nz - 2016-05-23 15:20 +0200
                Re: What can AppArmor do? Lisi Reisz <lisi.reisz@gmail.com> - 2016-05-23 16:40 +0200
                Re: What can AppArmor do? Gene Heskett <gheskett@shentel.net> - 2016-05-23 16:50 +0200
                Files browser won'r run if several programs open D&P Dimov <lddimov@yahoo.com> - 2016-05-23 18:40 +0200
                Re: What can AppArmor do? David Wright <deblis@lionunicorn.co.uk> - 2016-05-23 22:30 +0200
                console fonts and systemd (was ... Re: What can AppArmor do?) cbannister@slingshot.co.nz - 2016-05-24 22:30 +0200
                Re: console fonts and systemd (was ... Re: What can AppArmor do?) David Wright <deblis@lionunicorn.co.uk> - 2016-05-25 17:40 +0200
                Re: console fonts and systemd (was ... Re: What can AppArmor do?) David Wright <deblis@lionunicorn.co.uk> - 2016-06-05 16:40 +0200
                Re: console fonts and systemd (was ... Re: What can AppArmor do?) cbannister@slingshot.co.nz - 2016-06-06 07:10 +0200
                Re: console fonts and systemd (was ... Re: What can AppArmor do?) David Wright <deblis@lionunicorn.co.uk> - 2016-06-09 05:50 +0200
          Wee squares [was: What can AppArmor do?] <tomas@tuxteam.de> - 2016-05-22 08:40 +0200
            Re: Wee squares [was: What can AppArmor do?] Curt <curty@free.fr> - 2016-05-22 18:10 +0200
  Re: What can AppArmor do? Richard Owlett <rowlett@cloud85.net> - 2016-06-02 14:50 +0200

csiph-web