Lesson 3.51: Writing an AppArmor profile from its logs
AppArmor, Ubuntu's mandatory access control, confines a program to a list of paths and permissions written in its profile, whoever runs it, root included. In complain mode it only logs what it would block, which is how you learn what a program really needs. In the lab Northwind's legacy invoice renderer has to run as root and processes files that customers upload. Its draft profile has been logging for a day. You read the logs, add exactly the rules the job needs (and not the one an attacker's file triggered), switch to enforce mode and watch the same attack fail.
18 min
You will learn to
- Explain AppArmor profiles and their modes
- Read ALLOWED and DENIED records in the kernel log
- Write least-privilege path rules
- Load a profile with apparmor_parser and enforce it
- Recognise an attack in complain-mode logs
Key terms
- AppArmor profile
- A file in /etc/apparmor.d listing the paths and permissions one program may use.
- Complain mode
- Nothing is blocked; accesses outside the profile are logged as ALLOWED.
- Enforce mode
- Accesses outside the profile are refused and logged as DENIED.
- Path rule
- A glob and permissions ending in a comma: r read, w write, a append, m map, k lock.
- Abstraction
- A shared include with rules most programs need, such as the dynamic loader and libc.
- apparmor_parser
- Compiles a profile and loads or replaces it in the kernel.
← Capabilities: root's powers in pieces · All lessons · Recovering a damaged LUKS header →