7

Normally the private files stored in the home directory of a user can be accessed by applications running with the effective UID of the user. How can I restrict a particular application from accessing certain private files, while still allowing the files to be accessed by other applications using AppArmor on openSUSE.

  • 1
    @mutzmatron - this Q is perfectly fine as it is. OP's do not have to do exhaustive research. Often OP's are unfamiliar with the lingo/jargon so it may be beyond them in how to even proceed. – slm Dec 17 '13 at 13:55
  • @sim FYI My comment was in response to the original question (unix.stackexchange.com/revisions/105535/1) not this edited form. – jmetz Dec 17 '13 at 14:28
  • Just to point out point #1 unix.stackexchange.com/help/how-to-ask, "Search, and research Have you thoroughly searched for an answer before asking your question?" – jmetz Dec 17 '13 at 14:38
4

AppArmor is a Mandatory Access Control (MAC) Linux Security Module (LSM), used by, amongst other, Ubuntu and SUSE Linux. AppArmor access control rules are defined in AppArmor profiles in /etc/apparmor.d/. The profiles are simply text files, which contain information regarding resources the application the profile pertains is allowed to access.

Typically, when designing profiles, one would exercise the application with AppArmor set to complain mode, in which access control violations are allowed, but logged. Using the logs, one would iteratively refine the profile. When the profile is done, AppArmor can be switched to enforce mode, in which the access control rules defined in the profile are enforced, and any violation attempts logged.

The outline of an AppArmor profile looks like this:

#include <tunables/global>
/path/to/application {
   [...]
}

The #include directives allow statements pertaining to multiple applications to be placed in a common file, then included into the profile of each relevant application.

The <tunables/global> file, corresponding to /etc/apparmor.d/tunables/global in turn includes definitions that should be available to every profile. One of these additional includes is /etc/apparmor/tunables/home, which together with a @{HOME}/** rw (or similar directive) grant applications access to user home directories.

If this is the case, in order to deny access to certain files in the user home directory, one would need to add a profile rule to explicitly deny access to the files. This can be done using the deny directive, such as in the following example:

#include <tunables/global>
/path/to/application {
   [...]
   # Allow directory listings (i.e. 'r' on directories).
   @{HOME}/ r

   # This is needed for saving files in the home directory.
   @{HOME}/** rw

   # Revoke access to specific file
   deny /home/user/file rwa
}

The would deny read (r), write (w) and append (a) access to /home/user/file.

An alternative is to add the paths you want to protect to /etc/apparmor.d/abstractions/private-files or /etc/apparmor.d/abstractions/private-files-strict and make sure the AppArmor profile for each application to be affected includes the <abstractions/private-files> or <abstraction/private-files-strict>. These files should already contain rules for common files which should be protected for the purpose of privacy or other security considerations.

For a full list of access mode details and more information on AppArmor security profiles, consult the apparmor.d manual page and Novell AppArmor Administration Guide (pdf).

1

[In response to the edited, more specific question.]

To restrict access in AppArmor for a program, foo, create a profile with the entry

/usr/bin/foo {
    /etc/foo/* r,
}

Allows read access to the files in /etc/foo

    /etc/** 

would allow read access to all sub-directories in /etc

Conversely you can use

    deny /private/path rwa

to restrict access to a private path.

References

  • Actually, this is still not an answer... Links alone are not an answer as they can change but mainly, all links send to generic apparmor manuals... an answer saying read the manual is not very useful... tbh :). Purpose of this site is to help solving specific problems. Not all linux users are IT professionals and their computer is a tool, not their main job. They have other things to do instead of reading all the manuals of all the software installed on it. – laurent Dec 17 '13 at 12:53
  • @laurent: unless I'm mistaken it's also not a site to post full blown tutorials - the original question was far broader than the current form (edited by Thomas Nyman). – jmetz Dec 17 '13 at 12:54
  • @mutzmatron While I tried to improve the language, the question has been all along "How do I restrict access to certain files by certain programs". Your original answer did not address this, and your most recent edit answers the opposite question: "How do I grant access to certain files to a certain program (using AppArmor)". Furthermore, I assume that the OP does not want to create an AppArmor profile from scratch, and the default includes already grant access to all user home directories, as I explained in my answer. – Thomas Nyman Dec 17 '13 at 13:12
  • @ThomasNyman: not that quibbling about the details is particularly useful, but the OP's original post ended with "how to set the permission of the applications that could not access the the private files, but I can access them or other applications. Can I do it? I hear AppArmor, is it simple? Howto?". While your edit did indeed extract a coherent, meaningful question, the question in it's original form was very broad and open-ended. – jmetz Dec 17 '13 at 13:17
  • "...not that quibbling about the details is particularly useful..." Agreed, neither is copying information verbatim from existing answers. If you think a question needs improvement, suggest an edit, downvote and leave a comment or flag it. Your site association bonus gives you enough reputation to do any of those things. If you do post an answer, please make sure you actually give enough information to actually answer the question. – Thomas Nyman Dec 17 '13 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.