Under Ubuntu, another way of jailing is apparmor!
It is a path based mandatory access control (MAC) Linux Security Module (LSM). In Ubuntu 10.04 it is enabled by default for selected services.
The documentation is quite fragmented. The Ubuntu documentation could be ... better. Even the upstream documentation does not give a good introduction. The reference page states:
WARNING: this document is in a very early stage of creation it is not in any shape yet to be used as a reference manual
However, getting started is relatively easy. An AppAmor profile matches a executable path, e.g.
/var/www/slave/slave. The default rule of a profile is deny (which is great), if nothing else matches. Profile deny-rules match always before allow-rules. An empty profile denies everything.
Profiles for different binaries are stored under
apparmor_status displays what profiles are active, what are in enforce-mode (good), or only in complain mode (only log messages are printed).
Creating a new profile for
/var/www/slave/slave is just:
Start in another terminal
/var/www/slave/slave and do a typical use case. After it is finished press
f in the previous terminal.
/etc/apparmor.d contains a profile file
var.www.slave.slave. If the slave does some forking the profile is only very sparse - all the accesses of the childs are ignored.
Anyway, the profile is now active in enforce mode and you can just iteratively trigger actions in the slave and watch
tail -f /var/log/messages for violations. In another terminal you edit the profile file and execute
aa-enforce var.www.slave.slave after each change. The log displays then:
audit(1308348253.465:3586): operation="profile_replace" pid=25186 name="/var/www/slave/slave"
A violation looks like:
operation="open" pid=24583 parent=24061 profile="/var/www/slave/slave"
requested_mask="::r" denied_mask="::r" fsuid=10004 ouid=10000 name="/var/www/slave/config"
A profile rule like:
would allow the access in the future.
This is all pretty straight forward.
AppAmor supports coarse grained network rules, e.g.
network inet stream,
Without this rule no internet access is possible (including localhost), i.e. with that rule you can use
iptables for finer-grained rules (e.g. based on slave uid).
Another documentation fragment contains something about sub profiles for php scripts.
The var.www.slave.slave profile skeleton looks like:
network inet stream,
With such a profile the slave is not able anymore to call utilities like