Differences

This shows you the differences between two versions of the page.

--- модуль_apparmor [2017/11/29 09:39]
val [Определение наличия профилей для сетевых служб]
+++ модуль_apparmor [2024/05/14 14:01]
val
@@ Line 5: / Line 5: @@
   * [[http://www.ibm.com/developerworks/ru/library/l-apparmor-1/index.html|Безопасный Linux : Часть первая. AppArmor – песочница для приложений]]
-===== Установка =====
+  * [[https://wiki.debian.org/AppArmor/HowToUse|debian AppArmor HowToUse]]
+  * [[https://help.ubuntu.com/community/AppArmor|ubuntu AppArmor]]
-==== Debian ====
+===== Включение/Выключение =====
-  * [[https://wiki.debian.org/AppArmor/HowToUse|AppArmor HowToUse]]
+  * В Debian/Ubuntu включен по умолчанию
+<code>
+# apt install apparmor
+# aa-status
+</code>
+=== Включение ===
 <code>
 # mkdir /etc/default/grub.d
@@ Line 17: / Line 25: @@
 </code><code>
 GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT apparmor=1 security=apparmor"
+</code>
+=== Выключение ===
+<code>
+# cat /etc/default/grub
 </code><code>
+...
+GRUB_CMDLINE_LINUX="... apparmor=0"
+...
+</code><code>
+# update-grub
 # init 6
 </code>
-==== Debian/Ubuntu ====
+===== Определение наличия и правка профилей для служб =====
+  * [[Сервис Clamav]]
 <code>
-# apt install apparmor
+# ps axZ #| grep [c]lam
-# aa-status
+# find /etc/apparmor.d/
-</code>
-===== Определение наличия профилей для сетевых служб =====
+# cat /etc/apparmor.d/usr.sbin.clamd
+</code><code>
+...
+  /disk2/ rw,
+  /disk2/** krw,
+  /var/CommuniGate/ rw,
+  /var/CommuniGate/** krw,
+...
+</code><code>
+# cat /etc/apparmor.d/local/usr.sbin.dhcpd
+</code><code>
+  /**/dhcp/ r,
+  /**/dhcp/** r,
+</code>
+или
 <code>
+# rm /etc/apparmor.d/usr.sbin.dhcpd
+</code><code>
+# init 6
 # apt install apparmor-utils
-# ps axZ
+# aa-unconfined
-ubuntu# aa-unconfined
+# apt install apparmor-profiles
-</code>
-===== Временное отключение службы =====
+# less /usr/share/apparmor/extra-profiles/README
-<code>
-# service apparmor teardown
+# find /etc/apparmor.d/
 </code>
 ===== Создание профиля "вручную" =====
@@ Line 59: / Line 103: @@
   /usr/local/sbin/webd r,
-#  /bin/bash ix,
+#  /usr/bin/bash ix,
-  /bin/cat ix,
+  /usr/bin/cat ix,
   /usr/bin/file ix,
   /etc/magic r,
   /usr/share/file/magic.mgc r,
+  /usr/lib/file/magic.mgc r,
   /var/www/** r,
-###For i386 Debian/Ubuntu
+  /usr/lib/x86_64-linux-gnu/libtinfo* mr,
-#  /lib/i386-linux-gnu/libz* mr,
+  /usr/lib/x86_64-linux-gnu/libdl* mr,
-#  /lib/i386-linux-gnu/libtinfo* mr,
+  /usr/lib/x86_64-linux-gnu/libc* mr,
-#  /lib/i386-linux-gnu/libdl* mr,
+  /usr/lib/x86_64-linux-gnu/libz* mr,
-#  /lib/i386-linux-gnu/libc* mr,
+  /usr/lib/x86_64-linux-gnu/libmagic* mr,
-#  /usr/lib/libmagic* mr,
-###For x86_64 Debian/Ubintu
-#  /lib/x86_64-linux-gnu/libtinfo* mr,
-#  /lib/x86_64-linux-gnu/libdl* mr,
-#  /lib/x86_64-linux-gnu/libc* mr,
-#  /lib/x86_64-linux-gnu/libz* mr,
-#  /usr/lib/x86_64-linux-gnu/libmagic* mr,
 }
@@ Line 89: / Line 126: @@
 # aa-complain /usr/local/sbin/webd
-# aa-enforce /usr/local/sbin/webd
+# aa-status
-# tail -f /var/log/syslog | grep usr.local.sbin.webd
+# tail -f /var/log/audit/audit.log | grep usr.local.sbin.webd
+# aa-enforce /usr/local/sbin/webd
 # tail -f /var/log/audit/audit.log | grep usr.local.sbin.webd
 # aa-disable /usr/local/sbin/webd
-# find /etc/apparmor.d/ -ls | grep webd
 </code>
 ===== Создание и включение профиля утилитой aa-genprof =====
-[[http://www.novell.com/documentation/apparmor/apparmor201_sp10_admin/data/bx5bml8.html#bx5bmlf]]
+  * [[http://wiki.apparmor.net/index.php/Profiling_with_tools|Profiling with tools]]
 <code>
 # aa-genprof /usr/local/sbin/webd
+...
+#https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928160
+debian10# touch /etc/apparmor.d/local/...dovecot...
 ...
 # cat /etc/apparmor.d/usr.local.sbin.webd
-</code><code>
+...
-# Last Modified: Fri Mar 30 06:29:37 2012
-#include <tunables/global>
-/usr/local/sbin/webd {
-  #include <abstractions/base>
-  #include <abstractions/bash>
-  #include <abstractions/apache2-common>
-  /usr/local/sbin/webd r,
-  /bin/bash ix,
-  /bin/cat rix,
-  /etc/magic r,
-  /usr/bin/file rix,
-  /usr/share/file/magic.mgc r,
   /var/www/* r,
 }

Методические материалы Лохтурова Вячеслава

User Tools

Site Tools

Differences

Page Tools