3.1 Adding a Profile Using the Wizard

Add Profile Wizard is designed to set up Novell AppArmor profiles using the Novell AppArmor profiling tools, aa-genprof (Generate Profile) and aa-logprof (Update Profiles from Learning Mode Log File). For more information about these tools, refer to Section 4.6.3, Summary of Profiling Tools.

  1. Stop the application before profiling it to ensure that application start-up is included in the profile. To do this, make sure that the application or daemon is not running.

    For example, enter /etc/init.d/PROGRAM stop in a terminal window while logged in as root, replacing PROGRAM with the name of the program to profile.

  2. Start YaST and select Novell AppArmor > Add Profile Wizard.

    Choose the application to profile

  3. Enter the name of the application or browse to the location of the program.

  4. Click Create. This runs an AppArmor tool named aa-autodep, which performs a static analysis of the program to profile and loads an approximate profile into the AppArmor module. For more information about aa-autodep, refer to aa-autodep—Creating Approximate Profiles.

    The AppArmor Profile Wizard window opens.

    The Novell AppArmor Profile Wizard

    In the background, AppArmor also sets the profile to learning mode. For more information about learning mode, refer to aa-complain—Entering Complain or Learning Mode.

  5. Run the application to profile.

  6. Perform as many of the application functions as possible so learning mode can log the files and directories to which the program requires access to function properly. Be sure to include restarting and stopping the program in the exercised functions. AppArmor needs to handle these events as well as any other program function.

  7. Click Scan system log for AppArmor events to parse the learning mode log files. This generates a series of questions that you must answer to guide the wizard in generating the security profile.

    If requests to add hats appear, proceed to Section 5.0, Profiling Your Web Applications Using ChangeHat.

    The questions fall into two categories:

    • A resource is requested by a profiled program that is not in the profile (see Figure 3-2). Allow or deny access to a specific resource.

    • A program is executed by the profiled program and the security domain transition has not been defined (see Figure 3-3). Define execute permissions for an entry.

    Each of these cases results in a series of questions that you must answer to add the resource to the profile or to add the program to the profile. For an example of each case, see Figure 3-2 and Figure 3-3. Subsequent steps describe your options in answering these questions.

    NOTE: Varying Processing Options

    Depending on the type of entry processed, the available options vary.

    Figure 3-2 Learning Mode Exception: Controlling Access to Specific Resources

    Figure 3-3 Learning Mode Exception: Defining Execute Permissions for an Entry

  8. The Add Profile Wizard begins suggesting directory path entries that have been accessed by the application profiled (as seen in Figure 3-2) or requires you to define execute permissions for entries (as seen in Figure 3-3).

    • For Learning Mode Exception: Controlling Access to Specific Resources: Select the option that satisfies the request for access, which could be a suggested include, a particular globbed version of the path, or the actual pathname. Depending on the situation, these options are available:

      #include

      The section of a Novell AppArmor profile that refers to an include file. Include files give access permissions for programs. By using an include, you can give the program access to directory paths or files that are also required by other programs. Using includes can reduce the size of a profile. It is good practice to select includes when suggested.

      Globbed Version

      Accessed by clicking Glob. For information about globbing syntax, refer to Section 4.7, Paths and Globbing.

      Actual Pathname

      Literal path that the program needs to access to run properly.

      After selecting a directory path, process it as an entry to the Novell AppArmor profile by clicking Allow or Deny. If you are not satisfied with the directory path entry as it is displayed, you can also Glob or Edit it.

      The following options are available to process the learning mode entries and build the profile:

      Allow

      Grant the program access to the specified directory path entries. The Add Profile Wizard suggests file permission access. For more information about this, refer to Section 4.8, File Permission Access Modes.

      Deny

      Click Deny to prevent the program from accessing the specified paths.

      Glob

      Clicking this modifies the directory path (using wild cards) to include all files in the suggested directory. Double-clicking it grants access to all files and subdirectories beneath the one shown. For more information about globbing syntax, refer to Section 4.7, Paths and Globbing.

      Glob w/Ext

      Modify the original directory path while retaining the filename extension. A single click causes /etc/apache2/file.ext to become /etc/apache2/*.ext, adding the wild card (asterisk) in place of the filename. This allows the program to access all files in the suggested directories that end with the .ext extension. When you double-click it, access is granted to all files with the particular extension and subdirectories beneath the one shown.

      Edit

      Edit the highlighted line. The new edited line appears at the bottom of the list.

      Abort

      Abort aa-logprof, losing all rule changes entered so far and leaving all profiles unmodified.

      Finish

      Close aa-logprof, saving all rule changes entered so far and modifying all profiles.

      Click Allow or Deny for each learning mode entry. These help build the Novell AppArmor profile.

      NOTE: The number of learning mode entries corresponds to the complexity of the application.

    • For Learning Mode Exception: Defining Execute Permissions for an Entry: From the following options, select the one that satisfies the request for access. For detailed information about the options available, refer to Section 4.8, File Permission Access Modes.

      Inherit

      Stay in the same security profile (parent's profile).

      Profile

      Require a separate profile to exist for the executed program. When selecting this option, also select whether AppArmor should sanitize the environment when switching profiles by removing certain environment variables that can modify the execution behavior of the child process. Unless these variables are absolutely required to properly execute the child process, always choose the more secure, sanitized option.

      Unconfined

      Execute the program without a security profile. When prompted, have AppArmor sanitize the environment to avoid adding security risks by inheriting certain environment variables from the parent process.

      WARNING: Risks of Running Unconfined

      Unless absolutely necessary, do not run unconfined. Choosing the Unconfined option executes the new program without any protection from AppArmor.

      Deny

      Click Deny to prevent the program from accessing the specified paths.

      Abort

      Abort aa-logprof, losing all rule changes entered so far and leaving all profiles unmodified.

      Finish

      Close aa-logprof, saving all rule changes entered so far and modifying all profiles.

  9. Repeat the previous steps if you need to execute more functionality of the application.

    When you are done, click Finish. In the following pop-up, click Yes to exit the Profile Creation Wizard. The profile is saved and loaded into the AppArmor module.