This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
модуль_apparmor [2017/11/29 09:54] val [Debian] |
модуль_apparmor [2024/09/07 15:38] (current) val [Определение наличия и правка профилей для служб] |
||
---|---|---|---|
Line 5: | Line 5: | ||
* [[http://www.ibm.com/developerworks/ru/library/l-apparmor-1/index.html|Безопасный Linux : Часть первая. AppArmor – песочница для приложений]] | * [[http://www.ibm.com/developerworks/ru/library/l-apparmor-1/index.html|Безопасный Linux : Часть первая. AppArmor – песочница для приложений]] | ||
- | ===== Установка ===== | + | * [[https://wiki.debian.org/AppArmor/HowToUse|debian AppArmor HowToUse]] |
+ | * [[https://help.ubuntu.com/community/AppArmor|ubuntu AppArmor]] | ||
- | ==== Debian ==== | + | ===== Включение/Выключение ===== |
- | * [[https://wiki.debian.org/AppArmor/HowToUse|AppArmor HowToUse]] | + | * В Debian/Ubuntu включен по умолчанию |
+ | <code> | ||
+ | # ###apt install apparmor | ||
+ | |||
+ | # aa-status | ||
+ | </code> | ||
+ | |||
+ | === Включение === | ||
<code> | <code> | ||
# mkdir /etc/default/grub.d | # mkdir /etc/default/grub.d | ||
Line 17: | Line 25: | ||
</code><code> | </code><code> | ||
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT apparmor=1 security=apparmor" | GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT apparmor=1 security=apparmor" | ||
+ | </code> | ||
+ | |||
+ | === Выключение === | ||
+ | <code> | ||
+ | # cat /etc/default/grub | ||
+ | </code><code> | ||
+ | ... | ||
+ | GRUB_CMDLINE_LINUX="... apparmor=0" | ||
+ | ... | ||
</code><code> | </code><code> | ||
# update-grub | # update-grub | ||
Line 22: | Line 39: | ||
# init 6 | # init 6 | ||
</code> | </code> | ||
- | ==== Debian/Ubuntu ==== | + | |
+ | |||
+ | ===== Определение наличия и правка профилей для служб ===== | ||
+ | |||
+ | * [[Сервис Clamav]] | ||
<code> | <code> | ||
- | # apt install apparmor | + | # ps axZ #| grep [c]lam |
- | # aa-status | + | # find /etc/apparmor.d/ |
- | </code> | + | |
- | ===== Определение наличия профилей для служб ===== | + | # cat /etc/apparmor.d/usr.sbin.clamd |
+ | </code><code> | ||
+ | ... | ||
+ | /disk2/ rw, | ||
+ | /disk2/** krw, | ||
+ | |||
+ | /var/CommuniGate/ rw, | ||
+ | /var/CommuniGate/** krw, | ||
+ | ... | ||
+ | </code><code> | ||
+ | # cat /etc/apparmor.d/local/usr.sbin.dhcpd | ||
+ | </code><code> | ||
+ | /**/dhcpd.conf r, | ||
+ | </code> | ||
+ | или | ||
<code> | <code> | ||
+ | # rm /etc/apparmor.d/usr.sbin.dhcpd | ||
+ | </code><code> | ||
+ | # init 6 | ||
+ | |||
# apt install apparmor-utils | # apt install apparmor-utils | ||
- | # ps axZ | + | # aa-unconfined |
- | ubuntu# aa-unconfined | + | # apt install apparmor-profiles |
- | </code> | + | |
- | ===== Временное отключение службы ===== | + | # less /usr/share/apparmor/extra-profiles/README |
- | <code> | + | |
- | # service apparmor teardown | + | # find /etc/apparmor.d/ |
</code> | </code> | ||
+ | |||
+ | |||
+ | |||
===== Создание профиля "вручную" ===== | ===== Создание профиля "вручную" ===== | ||
Line 61: | Line 102: | ||
/usr/local/sbin/webd r, | /usr/local/sbin/webd r, | ||
- | # /bin/bash ix, | + | # /usr/bin/bash ix, |
- | /bin/cat ix, | + | /usr/bin/cat ix, |
/usr/bin/file ix, | /usr/bin/file ix, | ||
/etc/magic r, | /etc/magic r, | ||
/usr/share/file/magic.mgc r, | /usr/share/file/magic.mgc r, | ||
+ | /usr/lib/file/magic.mgc r, | ||
/var/www/** r, | /var/www/** r, | ||
- | ###For i386 Debian/Ubuntu | + | /usr/lib/x86_64-linux-gnu/libtinfo* mr, |
- | # /lib/i386-linux-gnu/libz* mr, | + | /usr/lib/x86_64-linux-gnu/libdl* mr, |
- | # /lib/i386-linux-gnu/libtinfo* mr, | + | /usr/lib/x86_64-linux-gnu/libc* mr, |
- | # /lib/i386-linux-gnu/libdl* mr, | + | /usr/lib/x86_64-linux-gnu/libz* mr, |
- | # /lib/i386-linux-gnu/libc* mr, | + | /usr/lib/x86_64-linux-gnu/libmagic* mr, |
- | # /usr/lib/libmagic* mr, | + | |
- | + | ||
- | ###For x86_64 Debian/Ubintu | + | |
- | # /lib/x86_64-linux-gnu/libtinfo* mr, | + | |
- | # /lib/x86_64-linux-gnu/libdl* mr, | + | |
- | # /lib/x86_64-linux-gnu/libc* mr, | + | |
- | # /lib/x86_64-linux-gnu/libz* mr, | + | |
- | # /usr/lib/x86_64-linux-gnu/libmagic* mr, | + | |
} | } | ||
Line 91: | Line 125: | ||
# aa-complain /usr/local/sbin/webd | # aa-complain /usr/local/sbin/webd | ||
- | # aa-enforce /usr/local/sbin/webd | + | # aa-status |
- | # tail -f /var/log/syslog | grep usr.local.sbin.webd | + | # tail -f /var/log/audit/audit.log | grep usr.local.sbin.webd |
+ | |||
+ | # aa-enforce /usr/local/sbin/webd | ||
# tail -f /var/log/audit/audit.log | grep usr.local.sbin.webd | # tail -f /var/log/audit/audit.log | grep usr.local.sbin.webd | ||
# aa-disable /usr/local/sbin/webd | # aa-disable /usr/local/sbin/webd | ||
- | |||
- | # find /etc/apparmor.d/ -ls | grep webd | ||
</code> | </code> | ||
===== Создание и включение профиля утилитой aa-genprof ===== | ===== Создание и включение профиля утилитой aa-genprof ===== | ||
- | [[http://www.novell.com/documentation/apparmor/apparmor201_sp10_admin/data/bx5bml8.html#bx5bmlf]] | + | * [[http://wiki.apparmor.net/index.php/Profiling_with_tools|Profiling with tools]] |
<code> | <code> | ||
# aa-genprof /usr/local/sbin/webd | # aa-genprof /usr/local/sbin/webd | ||
+ | ... | ||
+ | #https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928160 | ||
+ | debian10# touch /etc/apparmor.d/local/...dovecot... | ||
... | ... | ||
# cat /etc/apparmor.d/usr.local.sbin.webd | # cat /etc/apparmor.d/usr.local.sbin.webd | ||
- | </code><code> | + | ... |
- | # Last Modified: Fri Mar 30 06:29:37 2012 | + | |
- | #include <tunables/global> | + | |
- | + | ||
- | /usr/local/sbin/webd { | + | |
- | #include <abstractions/base> | + | |
- | #include <abstractions/bash> | + | |
- | #include <abstractions/apache2-common> | + | |
- | + | ||
- | /usr/local/sbin/webd r, | + | |
- | /bin/bash ix, | + | |
- | /bin/cat rix, | + | |
- | /etc/magic r, | + | |
- | /usr/bin/file rix, | + | |
- | /usr/share/file/magic.mgc r, | + | |
/var/www/* r, | /var/www/* r, | ||
} | } |