\section{AppArmor}

\begin{frame}
   {AppArmor}

   \begin{itemize}
      \item Provides Mandatory Access Control (\textbf{MAC}).
      \item Allows administrators to associate a security
      profile to a program which restricts its capabilities.
      \item Is considered easier (by some but not all) to use
      than \textbf{SELinux}.
      \item Is considered filesystem-neutral (no security labels
      required).
   \end{itemize}


\end{frame}

\cprotect\note{

   \textbf{AppArmor} is an \textbf{LSM} alternative to
   \textbf{SELinux}.  Support for it has been incorporated
   in the \textbf{Linux} kernel since 2006.  It has been
   used by \textbf{SUSE}, \textbf{Ubuntu} and other
   distributions.

   \textbf{AppArmor} supplements the traditional
   \textbf{UNIX} \textbf{D}iscretionary \textbf{A}ccess
   \textbf{C}ontrol (\textbf{DAC}) model by providing
   \textbf{M}andatory \textbf{A}ccess \textbf{C}ontrol
   (\textbf{MAC}).

   In addition to manually specifying profiles,
   \textbf{AppArmor} includes a learning mode, in which
   violations of the profile are logged, but not
   prevented. This log can then be turned into a profile,
   based on the program's typical behavior.

}

\begin{frame}
   {Checking Status}

   \begin{itemize}

      \item
      \textbf{AppArmor} usually enabled and loaded by default
      \item
      \textbf{Linux} kernel must have it compiled and turned on

      \item Start and stop etc:
      \begin{cmd}
$ sudo systemctl [start|stop|restart|status] apparmor
      \end{cmd}
      \item Cause to be loaded or not loaded at boot:
      \begin{cmd}
$ sudo systemctl [enable|disable] apparmor
      \end{cmd}
      \item
      More detail on current status:
      \begin{cmd}
$ sudo apparmor_status
      \end{cmd}
      \item \textbf{Profiles} and \textbf{processes}  in either
      \textbf{enforce} or \textbf{complain} mode
      \begin{itemize}
         \item Directly analogous to \textbf{enforcing} and
         \textbf{permissive} modes in \textbf{SELinux}
      \end{itemize}
   \end{itemize}
\end{frame}

\cprotect\note{

   Distributions that come with \textbf{AppArmor}, tend to
   enable it and load it by default; note that the
   \textbf{Linux} kernel has to have it turned on as well,
   and in most cases only one \textbf{LSM} can run at a
   time.

   Assuming you have the \textbf{AppArmor} kernel module
   available, on a \textbf{systemd} equipped system you can
   do:
   \begin{cmd}
$ sudo systemctl [start|stop|restart|status] apparmor
   \end{cmd}
   to change or inquire about the current state of operation,
   or do:
   \begin{cmd}
$ sudo systemctl [enable|disable] apparmor
   \end{cmd}
   to cause to be loaded or not loaded at boot.

   In order to see the current status:
   \begin{cmd}
$ sudo apparmor_status
    \end{cmd}
   \begin{response}
 apparmor module is loaded.
25 profiles are loaded.
25 profiles are in enforce mode.
   /sbin/dhclient
....
    \end{response}

   \textbf{Profiles} and \textbf{processes} are in either
   \textbf{enforce} or \textbf{complain} mode, directly
   analogous to \textbf{SELinux}'s \textbf{enforcing} and
   \textbf{permissive}.

   Note in the process listing the \textbf{PID} is given:

   \begin{cmd}
$ ps aux | grep libvirtd
   \end{cmd}
   \begin{response}
root        787  0.0  0.9 527200 35936 ?        Ssl  10:54   0:00 /usr/sbin/libvirtd
student    3346  0.0  0.0  13696  2204 pts/16   S+   11:42   0:00 grep --color=auto libvirtd
   \end{response}
}

\begin{frame}
   {Modes and Profiles}

   \begin{itemize}
      \item
      Modes:
      \begin{itemize}
         \item \textbf{Enforce Mode}
         Restricted actions are prevented and reported.  Set
         with \textbf{aa-enforce}
         \item \textbf{Complain}
         Polices not enforced, but policy violations are
         reported. Set with \textbf{aa-complain}
      \end{itemize}
      \item
      \textbf{Profiles} configured in
      \filelink{/etc/apparmor.d} give details for utilities
      and software packages
   \end{itemize}
\end{frame}

\cprotect\note{

   \textbf{Profiles} restrict how executable programs, which
   have pathnames on your system, such as
   \filelink{/usr/bin/evince}, can be used.

   Processes can be run in either of two modes:

   \begin{itemize}
      \item \textbf{Enforce Mode}

      Applications are prevented from acting in ways which are
      restricted.  Attempted violations are reported to the system
      logging files.  This is the default mode.
      A profile can be
      set to this mode with \textbf{aa-enforce}.

      \item \textbf{Complain}

      Polices are not enforced, but attempted policy violations
      are reported.  This is also called \textbf{learning} mode.
      A profile can be
      set to this mode with \textbf{aa-complain}
   \end{itemize}


   \textbf{Linux} distributions come with pre-packaged
   profiles, typically installed either when a given package
   is installed, or with an \textbf{AppArmor} package, such
   as \textbf{apparmor-profiles}.  These profiles are stored
   in \filelink{/etc/apparmor.d}.


   When installing new software, new profiles can be created
   specific to any executables in the package.


   Exactly what \textbf{AppArmor} profiles are installed on
   your system depends on your selection of software packages.
   On one particular \textbf{Ubuntu} system:
   \begin{cmd}
student@ubuntu:/etc/apparmor.d$ ls
   \end{cmd}
   \begin{response}
abstractions              usr.lib.dovecot.anvil              usr.lib.telepathy
apache2.d                 usr.lib.dovecot.auth               usr.sbin.avahi-daemon
bin.ping                  usr.lib.dovecot.config             usr.sbin.cups-brows
....
   \end{response}

   Full documentation on what can go in these files can be
   obtained by doing \verb?man apparmor.d?.

}

\begin{frame}
   {AppArmor Utilities}
   \begin{table}[H]
      \caption{AppArmor Utilities}
      \vspace{-15pt}
   \end{table}

   \small{\begin{tcolorbox}[breakable=false, tabularx={p{0.15\textwidth}|X}]
         \textbf{Program}
         &
         \textbf{Use}
         \\ \hline\hline
         \textbf{apparmor\_status}
         &
         Show status of all profiles and processes with profiles
         \\ \hline
         \textbf{apparmor\_notify}
         &
         Show a summary for \textbf{AppArmor} log messages
         \\ \hline
         \textbf{complain}
         &
         Set a specified profile to complain mode.
         \\ \hline
         \textbf{enforce}
         &
         Set a specified profile to enforce mode.
         \\ \hline
         \textbf{disable}
         &
         Unload a specified profile from the current kernel and prevent from
         being loaded on system startup.
         \\ \hline
         \textbf{logprof}
         &
         Scan log files and if \textbf{AppArmor} events have been recorded
         that are not covered by existing profiles, suggest how to take
         into account, and if approved, modify and reload.
         \\ \hline
         \textbf{easyprof}
         &
         Help set up a basic \textbf{AppArmor} profile for a program.
      \end{tcolorbox}}

\end{frame}

\cprotect\note{

   \textbf{AppArmor} has quite a few administrative utilities
   for monitoring and control.  For example, on
   an \textbf{openSUSE} system:
   \begin{cmd}
$ rpm -qil apparmor-utils | grep bin
   \end{cmd}
   \begin{response}
/usr/bin/aa-easyprof
/usr/sbin/aa-audit
/usr/sbin/aa-autodep
/usr/sbin/aa-cleanprof
/usr/sbin/aa-complain
/usr/sbin/aa-decode
/usr/sbin/aa-disable
/usr/sbin/aa-enforce
/usr/sbin/aa-exec
......
/usr/sbin/complain
/usr/sbin/decode
/usr/sbin/disable
/usr/sbin/enforce
....
   \end{response}


   Note that many of these utilities can be invoked with
   either their short or long names; e.g.:
   \begin{cmd}
linux-llgn:/etc/apparmor.d # ls -l /usr/sbin/*complain
   \end{cmd}
   \begin{response}
-rwxr-xr-x 1 root root 1442 Oct 25 07:37 /usr/sbin/aa-complain*
lrwxrwxrwx 1 root root   11 Nov 11 13:02 /usr/sbin/complain -> aa-complain*
linux-llgn:/etc/apparmor.d #
   \end{response}

}

