Slide 1
Slide 1 text
John Johansen
AppArmor Maintainer
[email protected]
AppArmor 3 and Beyond
Riding the Tumbleweed
Slide 2
Slide 2 text
First, lets review
Slide 3
Slide 3 text
RBAC
&
User Confnement
Slide 4
Slide 4 text
pam_apparmor
●
Mappings done through policy
– Uses “hats” to do the mapping
– Requires task calling into pam be confned
●
Roles use policy inheritance
– task and all its children confned by the same profle
Slide 5
Slide 5 text
Policy Namespaces
Slide 6
Slide 6 text
Policy Namespaces
/usr/sbin/libvirtd (enforce)
/usr/sbin/mdnsd (complain)
/usr/sbin/ippusbxd (enforce)
/usr/sbin/dovecot (complain)
/usr/lib/snapd/snap-confine (enforce)
/usr/lib/telepathy/telepathy-ofono (enforce)
/usr/lib/telepathy/telepathy-* (enforce)
/usr/lib/telepathy/mission-control-5 (enforce)
/usr/sbin/identd (complain)
/usr/sbin/cupsd (enforce)
/usr/sbin/libvirtd (enforce)
/usr/sbin/mdnsd (complain)
/usr/sbin/identd (complain)
/usr/sbin/cupsd (enforce)
firefox (enforce)
firefox//sanitized_helper (enforce)
firefox//lsb_release (enforce)
firefox//browser_openjdk (enforce)
firefox//browser_java (enforce)
Namespace 1 Namespace 2
Slide 7
Slide 7 text
Policy Namespaces
:ns:profle
:ns://profle
Slide 8
Slide 8 text
Policy Namespaces - Hierarchical
System
nscd
dnsmasq
:ns2:
:ns4:
:ns1:
nscd
dnsmasq
:ns5:
:ns3:
Slide 9
Slide 9 text
View
System
nscd
dnsmasq
:ns2:
:ns4:
:ns1:
nscd
dnsmasq
:ns5:
:ns3:
Slide 10
Slide 10 text
Child NS View
System
nscd
dnsmasq
:ns2:
:ns4:
:ns1:
nscd
dnsmasq
:ns5:
:ns3:
Slide 11
Slide 11 text
Grand Child NS View
System
nscd
dnsmasq
:ns2:
:ns4:
:ns1:
nscd
dnsmasq
:ns5:
:ns3:
Slide 12
Slide 12 text
Policy Stacking
Slide 13
Slide 13 text
Stacking
frefior//&evince
Slide 14
Slide 14 text
System View
System
nscd
dnsmasq
:ns2:
:ns4:
:ns1:
nscd
dnsmasq
:ns5:
:ns3:
Task
Slide 15
Slide 15 text
Reduced View
System
nscd
dnsmasq
:ns2:
:ns4:
:ns1:
nscd
dnsmasq
:ns5:
:ns3:
Task
Slide 16
Slide 16 text
Further Reduced View
System
nscd
dnsmasq
:ns2:
:ns4:
:ns1:
nscd
dnsmasq
:ns5:
:ns3:
Task
Slide 17
Slide 17 text
AppArmor 3
Slide 18
Slide 18 text
Policy Versioning
include
include
# We want to confine the binaries that match:
# /usr/lib/firefox/firefox
# /usr/lib/firefox/firefox
# but not:
# /usr/lib/firefox/firefox.sh
profile firefox /usr/lib/firefox/firefox{,*[^s][^h]} {
include
include
include
include
...
Slide 19
Slide 19 text
Policy Versioning - Include
$ cat /etc/apparmor.d/version/3.0
feature-abi=
@{version}=3.0
$
Slide 20
Slide 20 text
Multiple versions
●
Each profle fle has a version
– Versions do not have to be the same
●
Policy in application packaging
– Updated out ofi sync firom distro policy
– Selectively use fieatures not in distro policy*
Slide 21
Slide 21 text
Versioned policy on older releases?
●
Versioning will not be back ported
●
Ercept
– Backported 2.13, 2.12. 2.11
– Considering 2.10 & 2.9
include if exists
include
profile firefox /usr/lib/firefox/firefox{,*[^s][^h]} {
if defined @{version} {
include
Slide 22
Slide 22 text
Policy with out Versioning
●
Will mostly continue to work
– subset ofi current kernel abi and upstream 4.14
●
Compatibility “patches”
– Without “unsupported” rules will be downgraded
Slide 23
Slide 23 text
Pre-built policy & RO images
Slide 24
Slide 24 text
Pre 3.0 - Single binary policy Cache
bin.ping
sbin.klogd
sbin.syslogd
sbin.syslog-ng
skype
usr.bin.evince
usr.bin.firefox
usr.bin.pidgin
usr.sbin.cupsd
usr.sbin.dnsmasq
usr.sbin.dovecot
...
/etc/apparmor.d/cache
Slide 25
Slide 25 text
Per Kernel binary policy
bin.ping
sbin.klogd
sbin.syslogd
sbin.syslog-ng
skype
usr.bin.evince
usr.bin.firefox
usr.bin.pidgin
usr.sbin.cupsd
usr.sbin.dnsmasq
usr.sbin.dovecot
...
bin.ping
sbin.klogd
sbin.syslogd
sbin.syslog-ng
skype
usr.bin.evince
usr.bin.firefox
usr.bin.pidgin
usr.sbin.cupsd
usr.sbin.dnsmasq
usr.sbin.dovecot
...
bin.ping
sbin.klogd
sbin.syslogd
sbin.syslog-ng
skype
usr.bin.evince
usr.bin.firefox
usr.bin.pidgin
usr.sbin.cupsd
usr.sbin.dnsmasq
usr.sbin.dovecot
...
$(location)/cache/7f01cf2e.1
$(location)/7f01cf2e.0 $(location)/cache/a035ea11.0
Slide 26
Slide 26 text
Binary policy overlays
bin.ping
sbin.klogd
sbin.syslogd
sbin.syslog-ng
skype
usr.bin.evince
usr.bin.firefox
usr.bin.pidgin
usr.sbin.cupsd
usr.sbin.dnsmasq
usr.sbin.dovecot
...
skype
usr.bin.evince
usr.bin.firefox
usr.sbin.cupsd
...
$(loc1)/7f01cf2e.0 $(loc2)/7f01cf2e.0
bin.ping
sbin.klogd
sbin.syslogd
sbin.syslog-ng
skype
usr.bin.evince
usr.bin.firefox
usr.bin.pidgin
usr.sbin.cupsd
usr.sbin.dnsmasq
usr.sbin.dovecot
...
skype
usr.bin.evince
usr.bin.firefox
usr.sbin.cupsd
...
$(loc1)/a035ea11.0 $(loc2)/a035ea11.0
Slide 27
Slide 27 text
Policy Overlays
bin.ping
sbin.klogd
sbin.syslogd
sbin.syslog-ng
skype
usr.bin.evince
usr.bin.firefox
usr.bin.pidgin
usr.sbin.cupsd
usr.sbin.dnsmasq
usr.sbin.dovecot
...
skype
usr.bin.evince
usr.bin.firefox
usr.sbin.cupsd
...
/var/lib/apparmor.d/ /etc/apparmor.d/
Slide 28
Slide 28 text
Support for new upstream features
Slide 29
Slide 29 text
Network
●
upstream Network socket mediation (4.16)
●
fne grain unir socket mediation (4.19)
unix,
unix (accept, receive) addr=@foo peer=(label=/bar),
unix receive peer=(label=@{profile_name})
unix bind addr=@example,
unix (connect, receive, send) type=stream peer=(label=/foo,addr="@bar"),
Slide 30
Slide 30 text
DBus
dbus send
bus=session
path=/com/example/path
interface=com.example.Interface
member=ExampleMethod
peer=(name=(com.example.ExampleName1|com.example.ExampleName2)),
dbus bind name=com.example.ExampleName,
deny dbus bus=system interface=com.example.ExampleInterface,
dbus eavesdrop bus=system,
Slide 31
Slide 31 text
IMA interaction
profile firefox /usr/lib/firefox/firefox{,*[^s][^h]} {
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
...
Slide 32
Slide 32 text
IMA interaction
profile firefox /usr/lib/firefox/firefox{,*[^s][^h]} xattrs=(security.ima=bar) {
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
...
Slide 33
Slide 33 text
And beyond
Slide 34
Slide 34 text
Systemd integration
●
Use libapparmor directly
●
Direct loading ofi binary policy
●
Allows loading policy as early as possible
Slide 35
Slide 35 text
Policy NS – Scope & Views
System
nscd
dnsmasq
:ns2:
:ns4:
:ns1:
nscd
dnsmasq
:ns5:
:ns3:
Task
●
View
●
Scope
●
Admin
Slide 36
Slide 36 text
System
nscd
dnsmasq
:ns2:
:ns4:
:ns1:
nscd
dnsmasq
:ns5:
:ns3:
Task
nscd
nscd
nscd :ns5:nscd
User sees:
●
View
●
Scope
●
Admin
Slide 37
Slide 37 text
System
nscd
dnsmasq
:ns2:
:ns4:
:ns1:
nscd
dnsmasq
:user_jj:
:role:
Task
user
admin
chrome
:chrome:
sandbox
Slide 38
Slide 38 text
User confnement revisited
●
pam_apparmor
– confg fle
– change_profle instead ofi change_hat
– doesn’t require total system confnement
Slide 39
Slide 39 text
User confnement revisited
profile firefox /usr/lib/firefox/firefox{,*[^s][^h]} user=(jj,cboltz) {
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
...
Slide 40
Slide 40 text
Policy Learning – kernel interface
●
Boot Param to set bufer size
●
Divert complain messages
●
Allow applications to register to receive messages
●
Read complain messages directly firom the kernel
Slide 41
Slide 41 text
Fine grain ipv4/ipv6 networking
ipv4 bind addr=192.168.1.100#53,
ipv4 bind addr=#53,
ipv4 (connect, send, receive) peer=(addr=192.168.1.200)
ipv4 (connect, send) label:=foo peer=(addr=192.168.5)
ipv4 (send, receive) label:=foo peer=bar
Slide 42
Slide 42 text
Questions Please
https://gitlab.com/apparmor/apparmor
John Johansen
[email protected]
www.canonical.com
Slide 43
Slide 43 text
License
This slide deck is licensed under the Creative Commons Attribution-ShareAlike 4.0
International license.
It can be shared and adapted fior any purpose (even commercially) as long as Attribution
is given and any derivative work is distributed under the same license.
Details can be fiound at https://creativecommons.org/licenses/by-sa/4.0/
General Disclaimer
This document is not to be construed as a promise by any participating organisation to
develop, deliver, or market a product. It is not a commitment to deliver any material,
code, or fiunctionality, and should not be relied upon in making purchasing decisions.
openSUSE makes no representations or warranties with respect to the contents ofi this
document, and specifcally disclaims any erpress or implied warranties ofi merchantability
or ftness fior any particular purpose. The development, release, and timing ofi fieatures or
fiunctionality described fior openSUSE products remains at the sole discretion ofi
openSUSE. Further, openSUSE reserves the right to revise this document and to make
changes to its content, at any time, without obligation to notifiy any person or entity ofi
such revisions or changes. All openSUSE marks refierenced in this presentation are
trademarks or registered trademarks ofi SUSE LLC, in the United States and other
countries. All third-party trademarks are the property ofi their respective owners. Credits
Template
Richard Brown
[email protected]
Design & Inspiration
openSUSE Design Team
http://opensuse.github.io/branding-
guidelines/