User manual NOVELL APPARMOR 1.2 ADMINISTRATION GUIDE

[. . . ] Novell AppArmor Powered by Immunix Administration Guide www. novell. com 1. 2 09/29/2005 Novell AppArmor Powered by Immunix 1. 2 Administration Guide Legal Notices Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. [. . . ] logprof ignores all events in the system log before the specified mark is seen. If the mark contains spaces, it must be surrounded with quotes to work correctly. Example: logprof -m e2ff78636296f16d0b5301209a04430d logprof scans the log, asking you how to handle each logged event. Each question presents a numbered list of Novell AppArmor rules that can be added by pressing the number of the item on the list. By default, logprof looks for profiles in /etc/subdomain. d/ and scans the log in /var/log/messages so, in many cases, running logprof as root is enough to create the profile. However, there might times when you need to search archived log files, such as if the program exercise period exceeds the log rotation window (when the log file is archived and a new log file is started). If this is the case, you can enter zcat -f `ls -1tr /var/log/messages*` | logprof -f -. logprof Example 1 Following is an example of how logprof addresses httpd2-prefork accessing the file /etc/group. The example uses [] to indicate the default option. 66 In this example, the access to /etc/group is part of httpd2-prefork accessing name services. The appropriate response is 1, which pulls in a predefined set of Novell AppArmor rules. Selecting 1 to #include the name service package resolves all of the future questions pertaining to DNS lookups and also makes the profile less brittle in that any changes to DNS configuration and the associated nameservice profile package can be made just once, rather than needing to revise many profiles. Profile: /usr/sbin/httpd2-prefork Path: /etc/group New Mode: r [1 - #include <abstractions/nameservice>] 2 - /etc/group [(A)llow] / (D)eny / (N)ew / (G)lob / Glob w/(E)xt / Abo(r)t / (F)inish Select one of the following responses: Press Enter Allows access to the selected directory path. Allow Allows access to the specified directory path entries. Novell AppArmor suggests file permission access. For more information about this, refer to Section 3. 7, "File Permission Access Modes" (page 74). Deny Prevents the program from accessing the specified directory path entries. Novell AppArmor then moves on to the next event. New Prompts you to enter your own rule for this event, allowing you to specify whatever form of regular expression you want. If the expression you enter does not actually satisfy the event that prompted the question in the first place, Novell AppArmor asks you for confirmation and lets you reenter the expression. Glob Clicking this modifies the directory path (by using wild cards) to include all files in the suggested entry directory. Double-clicking it grants access to all files and subdirectories beneath the one shown. For more information about globbing syntax, refer to Section 3. 6, "Pathnames and Globbing" (page 73). Building Novell AppArmor Profiles 67 Glob w/Ext Clicking this modifies the original directory path while retaining the filename extension. For example, /etc/apache2/file. ext becomes /etc/apache2/ *. ext, adding the wild card (asterisk) in place of the filename. This allows the program to access all files in the suggested directory that end with the . ext extension. [. . . ] Intrusion detection systems might use attack signatures to distinguish between legitimate and potentially malicious activity. By not relying on attack signatures, Novell AppArmor provides "proactive" instead of "reactive" defense from attacks. This is better because there is no window of vulnerabilty where the attack signature must be defined for Novell AppArmor as it does for products using attack signatures to secure their networks. Refers to a software front-end meant to provide an attractive and easy-to-use interface between a computer user and application. [. . . ]