“UbuntuHelp:AppArmor”的版本间的差异
来自Ubuntu中文
小 |
小 |
||
第28行: | 第28行: | ||
==== Installing the latest version ==== | ==== Installing the latest version ==== | ||
To install the latest apparmor packages on feisty, the packages have to be rebuilt. | To install the latest apparmor packages on feisty, the packages have to be rebuilt. | ||
− | See [https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/116627 latest apparmor utilities for feisty (LP #116627)]. | + | See [[https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/116627|latest apparmor utilities for feisty (LP #116627)]]. |
==== Kernel upgrade / apparmor-module-source upgrade ==== | ==== Kernel upgrade / apparmor-module-source upgrade ==== | ||
When a new kernel is installed or when a new version of apparmor-module-source is installed, the apparmor module has to be recompiled : | When a new kernel is installed or when a new version of apparmor-module-source is installed, the apparmor module has to be recompiled : | ||
第67行: | 第67行: | ||
</nowiki></pre> | </nowiki></pre> | ||
=== Disable [[UbuntuHelp:AppArmor|AppArmor]] framework === | === Disable [[UbuntuHelp:AppArmor|AppArmor]] framework === | ||
+ | Systems should not generally need to have [[UbuntuHelp:AppArmor|AppArmor]] disabled entirely. It is highly recommended that users leave [[UbuntuHelp:AppArmor|AppArmor]] enabled and put the problematic profile into complain mode (see above), then file a bug using the procedures found in https://wiki.ubuntu.com/DebuggingApparmor. If [[UbuntuHelp:AppArmor|AppArmor]] must be disabled (eg to use [[UbuntuHelp:SELinux|SELinux]] instead), users can: | ||
<pre><nowiki> | <pre><nowiki> | ||
sudo /etc/init.d/apparmor kill | sudo /etc/init.d/apparmor kill | ||
sudo update-rc.d -f apparmor remove | sudo update-rc.d -f apparmor remove | ||
</nowiki></pre> | </nowiki></pre> | ||
+ | On Itrepid Ibex 8.10 | ||
+ | <pre><nowiki> | ||
+ | |||
+ | sudo /etc/init.d/apparmor stop | ||
+ | sudo update-rc.d -f apparmor remove | ||
+ | </nowiki></pre> | ||
+ | Or else with kill it gives you "Killing [[UbuntuHelp:AppArmor|AppArmor]] module - failed, [[UbuntuHelp:AppArmor|AppArmor]] is builtin: Failed." | ||
=== Enable [[UbuntuHelp:AppArmor|AppArmor]] framework === | === Enable [[UbuntuHelp:AppArmor|AppArmor]] framework === | ||
<pre><nowiki> | <pre><nowiki> | ||
第122行: | 第130行: | ||
sudo sh -c "echo 'setprofile /path/to/bin' > /proc/pid/attr/current" | sudo sh -c "echo 'setprofile /path/to/bin' > /proc/pid/attr/current" | ||
</nowiki></pre> | </nowiki></pre> | ||
− | + | <<Anchor(newprofile)>> | |
== Creating a new profile == | == Creating a new profile == | ||
=== Design a test plan === | === Design a test plan === | ||
第143行: | 第151行: | ||
The man page has more information: <code><nowiki>man aa-genprof</nowiki></code>. | The man page has more information: <code><nowiki>man aa-genprof</nowiki></code>. | ||
=== Include your new profile in apparmor-profiles package === | === Include your new profile in apparmor-profiles package === | ||
− | To get your new profile included in the apparmor-profiles package, file a bug in Launchpad against the [https://bugs.launchpad.net/ubuntu/+source/apparmor/+filebug [[UbuntuHelp:AppArmor|AppArmor]] package]: | + | To get your new profile included in the apparmor-profiles package, file a bug in Launchpad against the [[https://bugs.launchpad.net/ubuntu/+source/apparmor/+filebug|[[UbuntuHelp:AppArmor|AppArmor]] package]]: |
* Include your test plan and testcases. | * Include your test plan and testcases. | ||
* Attach your new profile to the bug. | * Attach your new profile to the bug. | ||
=== Migrating an apparmor-profiles profile to a package === | === Migrating an apparmor-profiles profile to a package === | ||
Please see https://wiki.ubuntu.com/ApparmorProfileMigration | Please see https://wiki.ubuntu.com/ApparmorProfileMigration | ||
− | + | <<Anchor(updateprofile)>> | |
== Update profiles == | == Update profiles == | ||
When the program is misbehaving, audit messages are sent to the log files. The program ''aa-logprof'' can be used to scan log files for [[UbuntuHelp:AppArmor|AppArmor]] audit messages, review them and update the profiles. | When the program is misbehaving, audit messages are sent to the log files. The program ''aa-logprof'' can be used to scan log files for [[UbuntuHelp:AppArmor|AppArmor]] audit messages, review them and update the profiles. | ||
第158行: | 第166行: | ||
When filing bugs against an installed apparmor profile, please see: https://wiki.ubuntu.com/DebuggingApparmor | When filing bugs against an installed apparmor profile, please see: https://wiki.ubuntu.com/DebuggingApparmor | ||
== Resources == | == Resources == | ||
− | * [http://en.opensuse.org/AppArmor_Geeks Intro to AppArmor for Geeks] : detailed usage of apparmor. | + | * [[http://en.opensuse.org/AppArmor_Geeks|Intro to AppArmor for Geeks]] : detailed usage of apparmor. |
− | * [http://outflux.net/blog/archives/2007/04/02/apparmor-now-in-feisty/ AppArmor now in Feisty] : small tutorial about generating a new profile for evince. | + | * [[http://outflux.net/blog/archives/2007/04/02/apparmor-now-in-feisty/|AppArmor now in Feisty]] : small tutorial about generating a new profile for evince. |
---- | ---- | ||
[[category:CategoryDocumentation]] | [[category:CategoryDocumentation]] | ||
[[category:UbuntuHelp]] | [[category:UbuntuHelp]] |
2008年10月19日 (日) 04:13的版本
点击翻译: |
English |
请不要直接编辑翻译本页,本页将定期与来源同步。 |
目录
- 1 Introduction
- 2 Installation
- 3 Usage
- 3.1 List the current status of apparmor
- 3.2 Put a profile in complain mode
- 3.3 Put all profiles into complain mode
- 3.4 Put a profile in enforce mode
- 3.5 Put all profiles in enforce mode
- 3.6 Disable AppArmor framework
- 3.7 Enable AppArmor framework
- 3.8 Reload all profiles
- 3.9 Reload one profile
- 3.10 Disable one profile
- 3.11 Enable one profile
- 4 Profile customization
- 5 FAQ
- 6 Creating a new profile
- 7 Update profiles
- 8 Debug AppArmor problems
- 9 Resources
Introduction
AppArmor is a Linux Security Module implementation of name-based access controls. AppArmor confines individual programs to a set of listed files and posix 1003.1e draft capabilities. AppArmor was first made available to Ubuntu in Ubuntu 7.04 in Universe.
Installation
Ubuntu 8.04 (Hardy)
AppArmor is installed and loaded by default in Hardy. Some packages will install their own enforcing profiles. Additional profiles can be found in the package apparmor-profiles from the Universe repository.
Install additional AppArmor profiles
- Enable the Universe repository.
- Install apparmor-profiles. See InstallingSoftware.
Ubuntu 7.10 (Gutsy)
AppArmor is installed and loaded by default in Gutsy. Some packages will install their own profiles. Additional profiles can be found in the package apparmor-profiles from the Universe repository. When filing bugs against an installed apparmor profile, please see: https://wiki.ubuntu.com/DebuggingApparmor
Install additional AppArmor profiles
- Enable the Universe repository.
- Install apparmor-profiles. See InstallingSoftware.
Ubuntu 7.04 (Feisty)
AppArmor is not included by default in the Feisty kernel. It needs to be compiled manually.
- Enable the Universe repository.
- Install apparmor-modules-source and module-assistant packages. See InstallingSoftware.
- Compile the apparmor kernel module :
sudo m-a -v -t prepare sudo m-a -v -t -f build apparmor-modules sudo m-a -v -t install apparmor-modules
- Install apparmor-profiles, apparmor-utils and apparmor packages. See InstallingSoftware.
Installing the latest version
To install the latest apparmor packages on feisty, the packages have to be rebuilt. See [apparmor utilities for feisty (LP #116627)].
Kernel upgrade / apparmor-module-source upgrade
When a new kernel is installed or when a new version of apparmor-module-source is installed, the apparmor module has to be recompiled :
sudo m-a -v -t -f build apparmor-modules sudo m-a -v -t install apparmor-modules
In order to make sure that all running processes are protected, the system has then to be rebooted.
Usage
All the commands should be executed from a terminal.
List the current status of apparmor
sudo apparmor_status
Put a profile in complain mode
sudo aa-complain /path/to/bin
Example:
sudo aa-complain /bin/ping
Put all profiles into complain mode
sudo aa-complain /etc/apparmor.d/*
Put a profile in enforce mode
sudo aa-enforce /path/to/bin
Example:
sudo aa-enforce /bin/ping
Put all profiles in enforce mode
sudo aa-enforce /etc/apparmor.d/*
Disable AppArmor framework
Systems should not generally need to have AppArmor disabled entirely. It is highly recommended that users leave AppArmor enabled and put the problematic profile into complain mode (see above), then file a bug using the procedures found in https://wiki.ubuntu.com/DebuggingApparmor. If AppArmor must be disabled (eg to use SELinux instead), users can:
sudo /etc/init.d/apparmor kill sudo update-rc.d -f apparmor remove
On Itrepid Ibex 8.10
sudo /etc/init.d/apparmor stop sudo update-rc.d -f apparmor remove
Or else with kill it gives you "Killing AppArmor module - failed, AppArmor is builtin: Failed."
Enable AppArmor framework
sudo /etc/init.d/apparmor start sudo update-rc.d apparmor start 37 S .
Reload all profiles
sudo /etc/init.d/apparmor reload
Reload one profile
cat /etc/apparmor.d/profile.name | sudo apparmor_parser -r
Example:
cat /etc/apparmor.d/bin.ping | sudo apparmor_parser -r
Disable one profile
ln -s /etc/apparmor.d/profile.name /etc/apparmor.d/disable/ apparmor_parser -R /etc/apparmor.d/profile.name
Example:
ln -s /etc/apparmor.d/bin.ping /etc/apparmor.d/disable/ apparmor_parser -R /etc/apparmor.d/bin.ping
Enable one profile
By default, profiles are enabled (ie loaded into the kernel and applied to processes).
rm /etc/apparmor.d/disable/profile.name cat /etc/apparmor.d/profile.name | sudo apparmor_parser -a
Example:
rm /etc/apparmor.d/disable/bin.ping cat /etc/apparmor.d/bin.ping | sudo apparmor_parser -a
Profile customization
Profiles can found in /etc/apparmor.d
.
Some customization can be made in /etc/apparmor.d/tunables/
Set home directories location
The location of home directories can be tuned in /etc/apparmor.d/tunables/home
.
FAQ
apparmor_status reports processes that are unconfined but have a profile defined
Restart the listed processes. Rebooting will also fix the problem. AppArmor can only track and protect processes that are started after the kernel module has been loaded. After the apparmor packages have been installed, apparmor will be started. But running processes won't be protected by AppArmor. Either restarting the processes or rebooting will fix this. You can also apply a profile to an already running process by issuing the following command:
sudo sh -c "echo 'setprofile /path/to/bin' > /proc/pid/attr/current"
<<Anchor(newprofile)>>
Creating a new profile
Design a test plan
Try to think about how the application should be exercised. The test plan should be divided into small test cases. Each test case should have a small description and list the steps to follow. Some standard test cases are :
- starting the program
- stopping the program
- reloading the program
- testing all the command supported by the init script
Generate the new profile
Use aa-genprof to generate a new profile. From a terminal, use the command aa-genprof:
sudo aa-genprof executable
Example:
sudo aa-genprof slapd
The man page has more information: man aa-genprof
.
Include your new profile in apparmor-profiles package
To get your new profile included in the apparmor-profiles package, file a bug in Launchpad against the [AppArmor package]:
- Include your test plan and testcases.
- Attach your new profile to the bug.
Migrating an apparmor-profiles profile to a package
Please see https://wiki.ubuntu.com/ApparmorProfileMigration <<Anchor(updateprofile)>>
Update profiles
When the program is misbehaving, audit messages are sent to the log files. The program aa-logprof can be used to scan log files for AppArmor audit messages, review them and update the profiles.
sudo aa-logprof
The man page has more information : man aa-logprof
Debug AppArmor problems
When filing bugs against an installed apparmor profile, please see: https://wiki.ubuntu.com/DebuggingApparmor
Resources
- [to AppArmor for Geeks] : detailed usage of apparmor.
- [now in Feisty] : small tutorial about generating a new profile for evince.