use case (
@{HOME}
and
@{HOMEDIRS}
) in the
/etc/apparmor.d/
tunables/home
file.
When a profile is created for a program, the program can access only the files, modes,
and POSIX capabilities specified in the profile. These restrictions are in addition to the
native Linux access controls.
Example:
To gain the capability
CAP_CHOWN
, the program must have both access
to
CAP_CHOWN
under conventional Linux access controls (typically, be a
root
-owned
process) and have the capability chown in its profile. Similarly, to be able to write to
the file
/foo/bar
the program must have both the correct user ID and mode bits set
in the files attributes (see the
chmod
and
chown
man pages) and have
/foo/bar
w
in its profile.
Attempts to violate Novell AppArmor rules are recorded in
/var/log/audit/
audit.log
if the
audit
package is installed or otherwise in
/var/log/messages
.
In many cases, Novell AppArmor rules prevent an attack from working because neces-
sary files are not accessible and, in all cases, Novell AppArmor confinement restricts
the damage that the attacker can do to the set of files permitted by Novell AppArmor.
2.1.1 Network Access Control
AppArmor allows mediation of network access based on the address type and family.
The following illustrates the network access rule syntax:
network [[<domain>
❶
][<type
❷
>][<protocol
❸
>]]
❶
Supported domains:
inet
,
ax25
,
ipx
,
appletalk
,
netrom
,
bridge
,
x25
,
inet6
,
rose
,
netbeui
,
security
,
key
,
packet
,
ash
,
econet
,
atmsvc
,
sna
,
irda
,
pppox
,
wanpipe
,
bluetooth
❷
Supported types:
stream
,
dgram
,
seqpacket
,
rdm
,
raw
,
packet
❸
Supported protocols:
tcp
,
udp
,
icmp
The AppArmor tools support only family and type specification. The AppArmor module
emits only
network
domain type
in “access denied” messages. And only these
are output by the profile generation tools, both YaST and command line.
14
Novell AppArmor Administration Guide
