1
Immunizing Programs
Novell® AppArmor provides immunization technologies that protect applications from
the inherent vulnerabilities they possess. After installing Novell AppArmor, setting up
Novell AppArmor profiles, and rebooting the computer, your system becomes immu-
nized because it begins to enforce the Novell AppArmor security policies. Protecting
programs with Novell AppArmor is referred to as immunizing.
Novell AppArmor sets up a collection of default application profiles to protect standard
Linux services. In order to protect other applications, use the Novell AppArmor tools
to create profiles for the applications that you want protected. This chapter introduces
the philosophy of immunizing programs. Proceed to
Chapter 2, Profile Components
and Syntax
(page 19),
Chapter 3, Building and Managing Profiles With YaST
(page 23),
or
Chapter 4, Building Profiles via the Command Line
(page 45) if you are ready to
build and manage Novell AppArmor profiles.
Novell AppArmor provides streamlined access control for network services by specifying
which files each program is allowed to read, write, and execute. This ensures that each
program does what it is supposed to do and nothing else. Novell AppArmor quarantines
programs to protect the rest of the system from being damaged by a compromised
process.
Novell AppArmor is a host intrusion prevention, or mandatory access control scheme.
Previously, access control schemes were centered around users because they were built
for large timeshare systems. Alternatively, modern network servers largely do not permit
users to log in, but instead provide a variety of network services for users, such as Web,
mail, file, and print. Novell AppArmor controls the access given to network services
and other programs to prevent weaknesses from being exploited.
Immunizing Programs
9
