2

For security reasons, I want to put Tomcat under apparmor. The Ubuntu server(12.04 LTS) guide has a good explanation about apparmor, but I am not sure what is the correct way of creating a profile for Tomcat and how to put it under apparmor.

1 Answer 1

0

First install apparmor-utils and some extra profiles with:

sudo apt-get install apparmor-utils apparmor-profiles

Then run:

sudo aa-genrpof /usr/bin/tomcat 

Replacing /usr/bin/tomcat with the location of tomcat's binary. genprof will then search the Apparmor profiles for a Tomcat profile. If it doesn't find one it will generate a profile with aa-autodep.

After setting a profile you will be asked to start the program you are profiling and use it like you normally would. genprof will monitor the logs for rule violations and allow you to tweak the profile based on what happens. It will then reload all relevant profiles.

5
  • After doing above changes I am still unable to see anything related to Tomcat under apparmor profiles. Please tell me the name of file for tomcat profile.
    – Sunil Rai
    Apr 1, 2014 at 8:32
  • Where are you looking for profiles?
    – Seth
    Apr 1, 2014 at 13:36
  • Path for apparmor profiles : "/etc/apparmor.d"
    – Sunil Rai
    Apr 1, 2014 at 15:00
  • @SunilRai Where is tomcat's binary located? Do you know? The path to it's profile would be similar.
    – Seth
    Apr 1, 2014 at 15:06
  • Tomcat folder for my application is located at : /home/user/web-portal/tomcat-7.0.27/bin
    – Sunil Rai
    Apr 2, 2014 at 5:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .