User
’
s
Gui
de
16
Notes:
Requires root privilege, and should not itself be run from within a Novell
AppArmor profile.
unconfined
does not distinguish between one network interface and
another, and so it will report
all
unconfined processes, even those that
may be listening to an internal LAN interface.
Fi
ndi
ng
user
net
wor
k
cl
i
ent
appl
i
cat
i
ons
i
s
dependent
on
your
user
’
s
preferences. The
unconfined
tool will detect and report network
ports opened by client applications, but
only
those client applications
that are running at the time the
unconfined
analysis is performed.
This is a problem because network services tend to be running all the
time, while network client applications tend to only be running when the
user is interested in them.
Applying Novell AppArmor profiles to user network client applications is
al
so
dependent
on
user
’
s
pr
ef
er
ences,
and
i
s
i
nt
ended
f
or
ser
ver
s
rather than workstations, and so we leave profiling of user network cli-
ent applications as an exercise for the user.
To aggressively confine desktop applications, the unconfined com-
mand supports a paranoid option, which will report all processes run-
ning and the corresponding AppArmor profiles that may or may not be
associated with each process. The unconfined user can then decide
whether each of these programs needs an AppArmor profile.
Additional profiles may be traded with other users and with the Novell
security development team on the user's mailing list at the following
URL:
http://mail.wirex.com/mailman/listinfo/
Novell AppArmor
-
users
