1

As far as I know, AppArmor cannot grant privileges to a program that otherwise doesn't have it (i.e. it can only further restrict). Given that, would it be okay to "allow all" for all programs at first, and iteratively add more rules & fine-tune the existing ones?

People seem to disagree with that on the Web it seems, as if the ruleset has to be right from the first moment but I don't understand why that should be the case? Isn't some level of protection better than none?

To clarify:

  • Is an iterative approach supported technically by AppArmor. (Perhaps there is no such thing as "allow all" or whitelisting by default and blacklisting specifically?)
  • Are there any security risks of such approach?

1 Answer 1

1

Sure it would be technically possible... but it's not the most efficient way to work.

If you first allow everything, you'll need to keep guessing what things would be good to disallow. You'll be effectively working blind.

If you first disallow everything, you'll get program error messages, giving you information about things the program is trying to do and failing (probably because of overly strict AppArmor rules). You'll also get messages in the system audit log telling you exactly what AppArmor prevented the program from doing, which will be a great help in allowing precisely the things the program needs and no more.

Note that AppArmor profiles can also be set in complain mode: in that mode, AppArmor won't actually stop the program from doing anything, but generates audit log messages as if it would. So, if you need to minimize the disruption to a particular application you're developing an AppArmor profile for, you can start with the "allow-nothing" profile in complain mode, look at the resulting audit log, add rules to allow things that look legitimate and are currently generating audit messages, and keep iterating this way until any audit messages about that application are about things you don't want the application do in the first place.

At that point, you can be reasonably confident that the AppArmor profile is either completely correct or very close to it, and can switch it into enforcing mode, where the AppArmor restrictions are actually applied. At that point, it is wise to do some testing, just in case you've missed something... but after this procedure, you can be quite confident that the resulting profile won't accidentally allow something dangerous you haven't thought of.

1
  • This makes a lot of sense, thank you! Aug 4, 2019 at 11:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .