1
Immunizing Programs
Novell® AppArmor provides immunization technologies that protect applications from
the inherent vulnerabilities they possess. After installing Novell AppArmor, setting up
Novell AppArmor profiles, and rebooting the computer, your system becomes immu-
nized because it begins to enforce the Novell AppArmor security policies. Protecting
programs with Novell AppArmor is referred to as immunizing.
Novell AppArmor sets up a collection of default application profiles to protect standard
Linux services. To protect other applications, use the Novell AppArmor tools to create
profiles for the applications that you want protected. This chapter introduces the philos-
ophy of immunizing programs. Proceed to
Chapter 2, Profile Components and Syntax
(page 11),
Chapter 3, Building and Managing Profiles with YaST
(page 27), or
Chap-
ter 4, Building Profiles from the Command Line
(page 49) if you are ready to build and
manage Novell AppArmor profiles.
Novell AppArmor provides streamlined access control for network services by specifying
which files each program is allowed to read, write, and execute, and which type of
network it is allowed to access. This ensures that each program does what it is supposed
to do and nothing else. Novell AppArmor quarantines programs to protect the rest of
the system from being damaged by a compromised process.
Novell AppArmor is a host intrusion prevention or mandatory access control scheme.
Previously, access control schemes were centered around users because they were built
for large timeshare systems. Alternatively, modern network servers largely do not permit
users to log in, but instead provide a variety of network services for users, such as Web,
mail, file, and print servers. Novell AppArmor controls the access given to network
services and other programs to prevent weaknesses from being exploited.
Immunizing Programs
1
