From ArchWiki
Revision as of 23:42, 24 October 2010 by Harvie (talk | contribs) (grub2 configuration)
Jump to navigation Jump to search

Apparmor is a MAC (Manditory Acccess Control) system, implemented upon LSM (Linux Security Modules).

Implementation Status

Apparmor is currently not available on ArchLinux, but we are working on it:

You can help us by adding packages (especialy AA userspace tools) to AUR.


AppArmor Packages


GRUB Configuration




 # (0) Arch Linux
 menuentry "Arch Linux" {
   set root=(hd0,1)
   linux /vmlinuz26 root=/dev/sda1 ro security=apparmor
   initrd /kernel26.img


AppArmor will be disabled by default in ArchLinux, so you will not need to disable it explicitly until you will build your own kernel with AppArmor enabled by default.

 # (0) Arch Linux
 menuentry "Arch Linux" {
   set root=(hd0,1)
   linux /vmlinuz26 root=/dev/sda1 ro apparmor=0 security=""
   initrd /kernel26.img

More Info

Ubuntu, Suse and a number of other Linux distributions use it. Redhat uses SELINUX which is apparently a little bit more difficult to configure properly. There exists another framework called Tomoyo but it is not currently integrated with any distributions.

It suplements, rather than replaces the standard POSIX access control system.

What you can do with it is very easily create profiles for applications which either acccess the Internet or listen via IP (e.g servers).

One may specify at quite a fine grained level what applications may or may not do.

Taking a common example - Firefox is frequently the victim of Zero day exploits. If you were to browse to a website that ran a buffer overflow or such thing against your browser - all data accessible to Firefox would then belong to the attackers, think SSH keys, password stores etc etc.

Likewise Wireshark (tcpdump) has had decoder modules with buffer overflows before, imagine the scenario - you suspect a server has been compromised, run a packet capture on the network, and then your own machine is compromised (tcpdump must run as root).

For both these applications, apparmor profiles exist. The configuration is stored in easy to read text files in /etc/apparmor.d/<application name>.

You can lock down your applications using wildcards, specifying for example that Firefox can only read the ~/Downloads folder and it's own profile directory, that it cannot create shell processes etc.

Every breach of policy triggers a message in the syslog, many distributions also integrate it into DBUS so that you get realtime violation warnings popping up on your desktop.

See also