Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I setup and configured AppArmor in Ubuntu and I would like to know how AppArmor deals with Packages and Applications which have no AppArmor Profile?

After installing the package with sudo apt-get install apparmor-profiles, I have 175 profiles reported as loaded from aa-status

I cannot imagine I have only 175 programs installed on my box, and I would like to know what AppArmor does to prevent security breaches in programs that have no profile.

share|improve this question
    
A famous example for a potentially vulnerable software without active profile is the firefox browser. –  humanityANDpeace Dec 19 '12 at 14:07

2 Answers 2

Accrding to the http://wiki.apparmor.net FAQ any program that has no profile is basically unprotected / unconstrained and can do any mischief in Ubuntu, almost in the same way as there would not have been any AppArmor in the first place

share|improve this answer
    
Right. it doesn't have a profile, so it isn't sandboxed, so it has free reign. –  jrg Dec 19 '12 at 14:30
    
@jrg: There is no kind of "fallback profile" / "defaul rule" for the unprofiled program? –  humanityANDpeace Dec 19 '12 at 14:32
    
From what I understand, no. Not at this point. Eventually they want to do LXC sandboxing (from what I've heard) for everything - so everything will be sandboxed, and then specific things will be whitelisted for everything. –  jrg Dec 19 '12 at 14:33
    
    
@jrg: (1) Nice list (few packages covered though..:( (2) The irony is that LXC says this: "sorry not safe yet". Kind of defering the purpose of using a "linux container" in the first place, when its rather likely to be not safe. At present I cannot manage to get Ubunut safe neither via LXC nor AppArmor. –  humanityANDpeace Dec 19 '12 at 14:41

First, the background of AppArmor:

AppArmor's security model is to bind access control attributes to programs rather than to users.

AppArmor profiles can be in one of two modes: enforcement and complain.

via the Ubuntu Security Team's wiki page

So, enforcement enforced whatever rules (for more details on that, take a look here) are defined, and complain just logs attempts to violate policy to the syslog (most of the time).

Some supported profiles are:

  • Cups (cupsd)
  • MySQL (mysqld)
  • Evince (PDF viewer on Ubuntu - enabled by default).
  • Firefox (Will be disabled by default and be opt-in for advanced users)
  • Apache (webserver, ditto)
  • and the list goes on, but not long enough. Full list is here.

Notable exceptions are:

  • Chrom(ium)e. While they do have a AppArmor profile on their wiki, doesn't seem like anyone uses it.
  • I didn't see empathy, pidgin or transmission on this list, or anything similar to them.

Lastly, someone else has asked a similar question about a fallback profile for anything that isn't defined.

But the answer is, by default, if a application doesn't have a profile in AppArmor, it will have access to everything - it won't be sandboxed.

However, on 12.10 Chrome will run inside a seccomp-bpf sandbox, which had it's modules backported from version 3.5 of the Linux Kernel to the 3.2 series that 12.10 is using by Canonical.

share|improve this answer
    
I like the linked question about the "fallback profile". Seems you also put a bounty on it. Great! I have a very poor repu, so I cannot join, elsewise I would consider. –  humanityANDpeace Dec 19 '12 at 15:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.