“UbuntuHelp:AppArmor”的版本间的差异

2010年5月19日 (三) 17:28的最新版本

文章出处:

https://help.ubuntu.com/community/AppArmor

点击翻译:

English

请不要直接编辑翻译本页，本页将定期与来源同步。

title AppArmor

1 Introduction
2 Installation
3 Usage
4 Profile customization
- 4.1 Set home directories location
5 FAQ
- 5.1 apparmor_status reports processes that are unconfined but have a profile defined
- 5.2 How can I enable AppArmor for Firefox?
6 Creating a new profile
7 Update profiles
8 Debug AppArmor problems
9 Resources
10 External Links

Introduction

AppArmor is a Linux Security Module implementation of name-based access controls. AppArmor confines individual programs to a set of listed files and posix 1003.1e draft capabilities. AppArmor was first made available to Ubuntu in Ubuntu 7.04 in Universe. Further information about AppArmor can be found on the AppArmor project's wiki.

Installation

Ubuntu 8.04 (Hardy) and Higher

AppArmor is installed and loaded by default in Hardy. Some packages will install their own enforcing profiles. Additional profiles can be found in the package apparmor-profiles from the Universe repository. When filing bugs against an installed apparmor profile, please see: https://wiki.ubuntu.com/DebuggingApparmor

Install additional AppArmor profiles

Enable the Universe repository.
Install apparmor-profiles. Click the link to install, or see InstallingSoftware for more installation options.

Ubuntu 7.10 (Gutsy)

AppArmor is installed and loaded by default in Gutsy. Some packages will install their own profiles. Additional profiles can be found in the package apparmor-profiles from the Universe repository. When filing bugs against an installed apparmor profile, please see: https://wiki.ubuntu.com/DebuggingApparmor

Install additional AppArmor profiles

Enable the Universe repository.
Install apparmor-profiles. Click the link to install, or see InstallingSoftware for more installation options.

Ubuntu 7.04 (Feisty)

AppArmor is not included by default in the Feisty kernel. It needs to be compiled manually.

Enable the Universe repository.
Install apparmor-modules-source and module-assistant packages. Click the links to install, or see InstallingSoftware for more installation options.
Compile the apparmor kernel module :

sudo m-a -v -t prepare
sudo m-a -v -t -f build apparmor-modules
sudo m-a -v -t install apparmor-modules

Install apparmor-profiles, apparmor-utils and apparmor packages. Click the links to install, or see InstallingSoftware for more installation options.

Installing the latest version

To install the latest apparmor packages on feisty, the packages have to be rebuilt. See latest apparmor utilities for feisty (LP #116627).

Kernel upgrade / apparmor-module-source upgrade

When a new kernel is installed or when a new version of apparmor-module-source is installed, the apparmor module has to be recompiled :

sudo m-a -v -t -f build apparmor-modules
sudo m-a -v -t install apparmor-modules

In order to make sure that all running processes are protected, the system must then be rebooted.

Usage

All of the following commands should be executed from a terminal.

List the current status of apparmor

sudo apparmor_status

Put a profile in complain mode

sudo aa-complain /path/to/bin

Example:

sudo aa-complain /bin/ping

Put all profiles into complain mode

sudo aa-complain /etc/apparmor.d/*

Put a profile in enforce mode

sudo aa-enforce /path/to/bin

Example:

sudo aa-enforce /bin/ping

Put all profiles in enforce mode

sudo aa-enforce /etc/apparmor.d/*

Put all profiles except for one in enforce mode

GLOBIGNORE="*profile.name"
sudo aa-enforce /etc/apparmor.d/*

Example:

GLOBIGNORE="*bin.ping"
sudo aa-enforce /etc/apparmor.d/*

Disable AppArmor framework

Systems should not generally need to have AppArmor disabled entirely. It is highly recommended that users leave AppArmor enabled and put the problematic profile into complain mode (see above), then file a bug using the procedures found in https://wiki.ubuntu.com/DebuggingApparmor. If AppArmor must be disabled (eg to use SELinux instead), users can:

sudo invoke-rc.d apparmor kill
sudo update-rc.d -f apparmor remove

On Ubuntu 8.04 (Hardy), Ubuntu 8.10 (Intrepid) and Ubuntu 9.04 (Jaunty):

sudo invoke-rc.d apparmor stop
sudo update-rc.d -f apparmor remove

Using kill with Ubuntu 8.10 or later gives the following error:

Killing AppArmor module - failed, AppArmor is builtin: Failed.

On Ubuntu 9.10 and later, you can either:

adjust your kernel boot command line (see ```/boot/grub/menul.lst``` for Grub or ```/boot/grub/grub.cfg``` for Grub 2) to include either
- 'apparmor=0'
- 'security=XXX' where XXX can be "" to disable AppArmor or an alternative LSM name, eg. 'security="selinux"'
remove the ```apparmor``` package with your package manager. Do not 'purge' apparmor if you think you might want to reenable AppArmor at a later date

Enable AppArmor framework

sudo invoke-rc.d apparmor start
sudo update-rc.d apparmor start 37 S .

Reload all profiles

sudo invoke-rc.d apparmor reload

Reload one profile

sudo apparmor_parser -r /etc/apparmor.d/profile.name

Example:

sudo apparmor_parser -r /etc/apparmor.d/bin.ping

Disable one profile

sudo ln -s /etc/apparmor.d/profile.name /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/profile.name

Example:

sudo ln -s /etc/apparmor.d/bin.ping /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/bin.ping

Enable one profile

By default, profiles are enabled (ie loaded into the kernel and applied to processes).

sudo rm /etc/apparmor.d/disable/profile.name
sudo apparmor_parser -r /etc/apparmor.d/profile.name

Example:

sudo rm /etc/apparmor.d/disable/bin.ping
sudo apparmor_parser -r /etc/apparmor.d/bin.ping

Profile customization

Profiles can found in /etc/apparmor.d. These are simple text files and can be edited either with a text editor, or by using aa-logprof.

Some customization can be made in /etc/apparmor.d/tunables/. When updating profiles, it is important to use these when appropriate. For example, rather than using a rule like:

  /home/*/ r,

use:

 @{HOME}/ r,

After updating a profile, be sure to reload it (see above).

Set home directories location

The location of home directories can be tuned in /etc/apparmor.d/tunables/home.

FAQ

apparmor_status reports processes that are unconfined but have a profile defined

Restart the listed processes. Rebooting will also fix the problem. AppArmor can only track and protect processes that are started after the kernel module has been loaded. After the apparmor packages have been installed, apparmor will be started. But running processes won't be protected by AppArmor. Either restarting the processes or rebooting will fix this. You can also apply a profile to an already running process by issuing the following command:

sudo sh -c "echo 'setprofile /path/to/bin' > /proc/pid/attr/current"

How can I enable AppArmor for Firefox?

Since Ubuntu 9.10 (Karmic), AppArmor ships with a profile for Firefox which is disabled by default. You can enable it using the following command:

sudo aa-enforce /etc/apparmor.d/usr.bin.firefox-3.5

<<Anchor(newprofile)>>

Creating a new profile

Design a test plan

Try to think about how the application should be exercised. The test plan should be divided into small test cases. Each test case should have a small description and list the steps to follow. Some standard test cases are :

starting the program
stopping the program
reloading the program
testing all the command supported by the init script

In the case of graphical programs, your test cases should also include anything you normally do. Downloading and opening files, saving files, uploading files, using plugins, saving configurations changes, and launching other programs are all possibilities.

Generate the new profile

Use aa-genprof to generate a new profile. From a terminal, use the command aa-genprof:

sudo aa-genprof executable

Example:

sudo aa-genprof slapd

The man page has more information: man aa-genprof.

Include your new profile in apparmor-profiles package

To get your new profile included in the apparmor-profiles package, file a bug in Launchpad against the AppArmor package:

Include your test plan and testcases.
Attach your new profile to the bug.

Migrating an apparmor-profiles profile to a package

Please see https://wiki.ubuntu.com/ApparmorProfileMigration <<Anchor(updateprofile)>>

Update profiles

When the program is misbehaving, audit messages are sent to the log files. The program aa-logprof can be used to scan log files for AppArmor audit messages, review them and update the profiles.

sudo aa-logprof

The man page has more information : man aa-logprof

Debug AppArmor problems

When filing bugs against an installed apparmor profile, please see: https://wiki.ubuntu.com/DebuggingApparmor

Resources

Intro to AppArmor for Geeks - detailed usage of apparmor.
AppArmor now in Feisty - small tutorial about generating a new profile for evince.

External Links

AppArmor Profile Repository - Find some sample profiles for some common applications done by members of the Ubuntu community.

@@ 第1行： / 第1行： @@
 {{From|https://help.ubuntu.com/community/AppArmor}}
 {{Languages|UbuntuHelp:AppArmor}}
+#title AppArmor
 == Introduction ==
 AppArmor is a Linux Security Module implementation of name-based access controls. AppArmor confines individual programs to a set of listed files and posix 1003.1e draft capabilities.
 AppArmor was first made available to Ubuntu in Ubuntu 7.04 in Universe.
+Further information about AppArmor can be found on the AppArmor project's [http://apparmor.wiki.kernel.org wiki].
 == Installation ==
-=== Ubuntu 8.04 (Hardy) ===
+=== Ubuntu 8.04 (Hardy) and Higher ===
-AppArmor is installed and loaded by default in Hardy. Some packages will install their own '''enforcing''' profiles. Additional profiles can be found in the package ''apparmor-profiles'' from the Universe repository.
+AppArmor is installed and loaded by default in Hardy. Some packages will install their own '''enforcing''' profiles. Additional profiles can be found in the package ''apparmor-profiles'' from the Universe repository.  When filing bugs against an installed apparmor profile, please see: https://wiki.ubuntu.com/DebuggingApparmor
 ==== Install additional AppArmor profiles ====
 * Enable the Universe repository.
-* Install ''apparmor-profiles''. See [[UbuntuHelp:InstallingSoftware|InstallingSoftware]].
+* Install ''[[UbuntuHelp:apt:apparmor-profiles|apparmor-profiles]]''. Click the link to install, or see [[UbuntuHelp:InstallingSoftware|InstallingSoftware]] for more installation options.
 === Ubuntu 7.10 (Gutsy) ===
 AppArmor is installed and loaded by default in Gutsy. Some packages will install their own profiles. Additional profiles can be found in the package ''apparmor-profiles'' from the Universe repository.  When filing bugs against an installed apparmor profile, please see: https://wiki.ubuntu.com/DebuggingApparmor
 ==== Install additional AppArmor profiles ====
 * Enable the Universe repository.
-* Install ''apparmor-profiles''. See [[UbuntuHelp:InstallingSoftware|InstallingSoftware]].
+* Install ''[[UbuntuHelp:apt:apparmor-profiles|apparmor-profiles]]''. Click the link to install, or see [[UbuntuHelp:InstallingSoftware|InstallingSoftware]] for more installation options.
 === Ubuntu 7.04 (Feisty) ===
 AppArmor is not included by default in the Feisty kernel. It needs to be compiled manually.
 * Enable the Universe repository.
-* Install ''apparmor-modules-source'' and ''module-assistant'' packages. See [[UbuntuHelp:InstallingSoftware|InstallingSoftware]].
+* Install ''[[UbuntuHelp:apt:apparmor-modules-source|apparmor-modules-source]]'' and ''[[UbuntuHelp:apt:module-assistant|module-assistant]]'' packages. Click the links to install, or see [[UbuntuHelp:InstallingSoftware|InstallingSoftware]] for more installation options.
 * Compile the apparmor kernel module :
 <pre><nowiki>
@@ 第25行： / 第27行： @@
 sudo m-a -v -t install apparmor-modules
 </nowiki></pre>
-* Install ''apparmor-profiles'', ''apparmor-utils'' and ''apparmor'' packages. See [[UbuntuHelp:InstallingSoftware|InstallingSoftware]].
+* Install ''[[UbuntuHelp:apt:apparmor-profiles|apparmor-profiles]]'', ''[[UbuntuHelp:apt:apparmor-utils|apparmor-utils]]'' and ''[[UbuntuHelp:apt:apparmor|apparmor]]'' packages. Click the links to install, or see [[UbuntuHelp:InstallingSoftware|InstallingSoftware]] for more installation options.
 ==== Installing the latest version ====
 To install the latest apparmor packages on feisty, the packages have to be rebuilt.
@@ 第35行： / 第37行： @@
 sudo m-a -v -t install apparmor-modules
 </nowiki></pre>
-In order to make sure that all running processes are protected, the system has then to be rebooted.
+In order to make sure that all running processes are protected, the system must then be rebooted.
 == Usage ==
-All the commands should be executed from a terminal.
+All of the following commands should be executed from a terminal.
 === List the current status of apparmor ===
 <pre><nowiki>
@@ 第64行： / 第66行： @@
 === Put all profiles in enforce mode ===
 <pre><nowiki>
+sudo aa-enforce /etc/apparmor.d/*
+</nowiki></pre>
+=== Put all profiles except for one in enforce mode ===
+<pre><nowiki>
+GLOBIGNORE="*profile.name"
+sudo aa-enforce /etc/apparmor.d/*
+</nowiki></pre>
+Example:
+<pre><nowiki>
+GLOBIGNORE="*bin.ping"
 sudo aa-enforce /etc/apparmor.d/*
 </nowiki></pre>
@@ 第69行： / 第81行： @@
 Systems should not generally need to have AppArmor disabled entirely. It is highly recommended that users leave AppArmor enabled and put the problematic profile into complain mode (see above), then file a bug using the procedures found in https://wiki.ubuntu.com/DebuggingApparmor. If AppArmor must be disabled (eg to use [[UbuntuHelp:SELinux|SELinux]] instead), users can:
 <pre><nowiki>
-sudo /etc/init.d/apparmor kill
+sudo invoke-rc.d apparmor kill
 sudo update-rc.d -f apparmor remove
 </nowiki></pre>
-On Itrepid Ibex 8.10
+On Ubuntu 8.04 (Hardy), Ubuntu 8.10 (Intrepid) and Ubuntu 9.04 (Jaunty):
 <pre><nowiki>
+sudo invoke-rc.d apparmor stop
-sudo /etc/init.d/apparmor stop
 sudo update-rc.d -f apparmor remove
 </nowiki></pre>
-Or else with kill it gives you "Killing AppArmor module - failed, AppArmor is builtin: Failed."
+Using <code><nowiki>kill</nowiki></code> with Ubuntu 8.10 or later gives the following error:
+<pre><nowiki>
+Killing AppArmor module - failed, AppArmor is builtin: Failed.
+</nowiki></pre>
+On Ubuntu 9.10 and later, you can either:
+* adjust your kernel boot command line (see ```/boot/grub/menul.lst``` for Grub or ```/boot/grub/grub.cfg``` for Grub 2) to include either
+** 'apparmor=0'
+** 'security=XXX' where XXX can be "" to disable AppArmor or an alternative LSM name, eg. 'security="selinux"'
+* remove the ```apparmor``` package with your package manager. Do not 'purge' apparmor if you think you might want to reenable AppArmor at a later date
 === Enable AppArmor framework ===
 <pre><nowiki>
-sudo /etc/init.d/apparmor start
+sudo invoke-rc.d apparmor start
 sudo update-rc.d apparmor start 37 S .
 </nowiki></pre>
 === Reload all profiles ===
 <pre><nowiki>
-sudo /etc/init.d/apparmor reload
+sudo invoke-rc.d apparmor reload
 </nowiki></pre>
 === Reload one profile ===
 <pre><nowiki>
-cat /etc/apparmor.d/profile.name | sudo apparmor_parser -r
+sudo apparmor_parser -r /etc/apparmor.d/profile.name
 </nowiki></pre>
 Example:
 <pre><nowiki>
-cat /etc/apparmor.d/bin.ping | sudo apparmor_parser -r
+sudo apparmor_parser -r /etc/apparmor.d/bin.ping
 </nowiki></pre>
 === Disable one profile ===
 <pre><nowiki>
- ln -s /etc/apparmor.d/profile.name /etc/apparmor.d/disable/
+sudo ln -s /etc/apparmor.d/profile.name /etc/apparmor.d/disable/
- apparmor_parser -R /etc/apparmor.d/profile.name
+sudo apparmor_parser -R /etc/apparmor.d/profile.name
 </nowiki></pre>
 Example:
 <pre><nowiki>
- ln -s /etc/apparmor.d/bin.ping /etc/apparmor.d/disable/
+sudo ln -s /etc/apparmor.d/bin.ping /etc/apparmor.d/disable/
- apparmor_parser -R /etc/apparmor.d/bin.ping
+sudo apparmor_parser -R /etc/apparmor.d/bin.ping
 </nowiki></pre>
 === Enable one profile ===
 By default, profiles are enabled (ie loaded into the kernel and applied to processes).
 <pre><nowiki>
- rm /etc/apparmor.d/disable/profile.name
+sudo rm /etc/apparmor.d/disable/profile.name
- cat /etc/apparmor.d/profile.name | sudo apparmor_parser -a
+sudo apparmor_parser -r /etc/apparmor.d/profile.name
 </nowiki></pre>
 Example:
 <pre><nowiki>
- rm /etc/apparmor.d/disable/bin.ping
+sudo rm /etc/apparmor.d/disable/bin.ping
- cat /etc/apparmor.d/bin.ping | sudo apparmor_parser -a
+sudo apparmor_parser -r /etc/apparmor.d/bin.ping
 </nowiki></pre>
 == Profile customization ==
-Profiles can found in <code><nowiki>/etc/apparmor.d</nowiki></code>.
+Profiles can found in <code><nowiki>/etc/apparmor.d</nowiki></code>. These are simple text files and can be edited either with a text editor, or by using <code><nowiki>aa-logprof</nowiki></code>.
-Some customization can be made in <code><nowiki>/etc/apparmor.d/tunables/</nowiki></code>
+Some customization can be made in <code><nowiki>/etc/apparmor.d/tunables/</nowiki></code>. When updating profiles, it is important to use these when appropriate. For example, rather than using a rule like:<pre><nowiki>
+  /home/*/ r,
+</nowiki></pre>use:<pre><nowiki>
+  @{HOME}/ r,
+</nowiki></pre>
+After updating a profile, be sure to reload it (see above).
 === Set home directories location ===
 The location of home directories can be tuned in <code><nowiki>/etc/apparmor.d/tunables/home</nowiki></code>.
@@ 第129行： / 第153行： @@
 <pre><nowiki>
 sudo sh -c "echo 'setprofile /path/to/bin' > /proc/pid/attr/current"
+</nowiki></pre>
+=== How can I enable AppArmor for Firefox? ===
+Since Ubuntu 9.10 (Karmic), AppArmor ships with a profile for Firefox which is disabled by default.
+You can enable it using the following command:
+<pre><nowiki>
+sudo aa-enforce /etc/apparmor.d/usr.bin.firefox-3.5
 </nowiki></pre>
 <<Anchor(newprofile)>>
@@ 第139行： / 第169行： @@
 * reloading the program
 * testing all the command supported by the init script
+In the case of graphical programs, your test cases should also include anything you normally do.  Downloading and opening files, saving files, uploading files, using plugins, saving configurations changes, and launching other programs are all possibilities.
 === Generate the new profile ===
 Use ''aa-genprof'' to generate a new profile.
@@ 第166行： / 第197行： @@
 When filing bugs against an installed apparmor profile, please see: https://wiki.ubuntu.com/DebuggingApparmor
 == Resources ==
-* [http://en.opensuse.org/AppArmor_Geeks Intro to AppArmor for Geeks] : detailed usage of apparmor.
+* [http://en.opensuse.org/AppArmor_Geeks Intro to AppArmor for Geeks] - detailed usage of apparmor.
-* [http://outflux.net/blog/archives/2007/04/02/apparmor-now-in-feisty/ AppArmor now in Feisty] : small tutorial about generating a new profile for evince.
+* [http://outflux.net/blog/archives/2007/04/02/apparmor-now-in-feisty/ AppArmor now in Feisty] - small tutorial about generating a new profile for evince.
+== External Links ==
+* [http://bodhizazen.net/aa-profiles/ AppArmor Profile Repository] - Find some sample profiles for some common applications done by members of the Ubuntu community.
 ----
-[[category:CategoryDocumentation]]
 [[category:UbuntuHelp]]

	本页面被Ubuntu中文用户Wikibot最后修改于2010年5月19日 (星期三) 17:28。隐私政策关于Ubuntu中文免责声明
	Mozilla Cavendish Theme based on Cavendish style by Gabriel Wicke modified by DaSch for the Web Community Wiki github Projectpage – Report Bug – Skin-Version: 2.3.4

个人工具

“UbuntuHelp:AppArmor”的版本间的差异 - Ubuntu中文

搜索

“UbuntuHelp:AppArmor”的版本间的差异

来自Ubuntu中文

2010年5月19日 (三) 17:28的最新版本

目录

Introduction

Installation

Ubuntu 8.04 (Hardy) and Higher

Install additional AppArmor profiles

Ubuntu 7.10 (Gutsy)

Install additional AppArmor profiles

Ubuntu 7.04 (Feisty)

Installing the latest version

Kernel upgrade / apparmor-module-source upgrade

Usage

List the current status of apparmor

Put a profile in complain mode

Put all profiles into complain mode

Put a profile in enforce mode

Put all profiles in enforce mode

Put all profiles except for one in enforce mode

Disable AppArmor framework

Enable AppArmor framework

Reload all profiles

Reload one profile

Disable one profile

Enable one profile

Profile customization

Set home directories location

FAQ

apparmor_status reports processes that are unconfined but have a profile defined

How can I enable AppArmor for Firefox?

Creating a new profile

Design a test plan

Generate the new profile

Include your new profile in apparmor-profiles package

Migrating an apparmor-profiles profile to a package

Update profiles

Debug AppArmor problems

Resources

External Links