Tag Info

Hot answers tagged

55

What it is Apparmor is a Mandatory Access Control (or MAC) system. It uses LSM kernel enhancements to restrict programs to certain resources. AppArmor does this with profiles loaded into the kernel when the system starts. Apparmor has two types of profile modes, enforcement and complain. Profiles in enforcement mode enforce that profile's rules and ...


25

I finally figured out the issue. Basically, the definition of some parameters has been removed from the previous version of mysql and has been replaced with different names. To fix, in /etc/mysql/my.cnf, replace: # Tom Added to ensure the server character set is set to utf8 default-character-set = utf8 default-collation = utf8_general_ci with: # Tom ...


12

The Linux Kernel provides the Linux Security Module interface, of which SELinux and AppArmor are both implementations of. (Others include TOMOYO, Smack, ...) This interface is designed currently to only allow a single LSM to be operational at a time. There is no way to run two simultaneously, so you must choose one. There has been discussion from ...


11

You can use different solutions.The best one is using RSA authentication which uses public/private keys to authenticate user and you can disable the keyboard login, But if you don't want use this one, you can use other ways. Check this great manual for different ways (RSA authentication included): http://www.la-samhna.de/library/brutessh.html I'm using the ...


10

I wouldn't use both. Both SELinux and AppArmor do the same basic thing: limiting access to files and folders to only the applications that really need access. But both implement this idea in very different ways. SELinux attaches a label to every file in your filesystem and limits the access of an application to certain labels. For example: Apache can ...


8

To permanently put all profiles into enforce mode: sudo aa-enforce /etc/apparmor.d/* To permanently put all profiles into complain mode: sudo aa-complain /etc/apparmor.d/* To verify the current status of apparmor: sudo aa-status complain mode will log violations against the application profiles, whereas enforce mode will strictly enforce the ...


7

To know the status of your app-armor , type this command in your terminal. sudo apparmor_status for example , sample output: To give working performance of Apparmor I think there is no Measurement tool.As I know we have to detect it by the things happening around with your PC I mean something abnormal.


6

Innodb has a default setting (innodb_buffer_pool_size) which is set to 128M - this may be too large for your server (especially if you're using a small Amazon EC2 AMI - which I was) The fix that worked for me was to add the following line to /etc/mysql/my.cnf innodb_buffer_pool_size = 16M I wrote about this fix over here ...


6

Here's what I was thinking of (from https://wiki.ubuntu.com/DebuggingApparmor ) -- "complain mode" . This doesn't address the issue of relative merits or consequences of this versus other debugging methods. When debugging, it may also be useful to put apparmor into 'complain' mode. This will allow your application to function normally while ...


5

I get brute-force ssh attacks on my servers with a rate of 1 to 2 per day. I have installed denyhosts (ubuntu package: denyhosts). It's a very simple but effective tool for that purpose: essentially it periodically scans your logs to detect brute-force attacks and puts IPs from where these attacks originate into your /etc/hosts.deny file. You won't hear from ...


5

[ 5909.432759] type=1400 audit(1344103797.021:146): apparmor="DENIED" operation="open" parent=8800 profile="/usr/sbin/named" name="/var/log/query.log" pid=8805 comm="named" requested_mask="ac" denied_mask="ac" fsuid=107 ouid=0 That’s because named aren’t allowed to write to directory /var/log/query.log. To solve this issue, open the local include for the ...


5

AppArmor is a Mandatory Access Control (MAC) system which is a kernel (LSM) enhancement to confine programs to a limited set of resources. AppArmor's security model is to bind access control attributes to programs rather than to users. AppArmor confinement is provided via profiles loaded into the kernel, typically on boot. AppArmor profiles can ...


4

According to the mailing list, there could be a way to generate such a default profile in this way: profile default /** { #insert default profile rules here } sources: Generate a default/fallback profile? No blacklisting and the responses that follow. Note that "Currently setting a default profile that applies to the whole system from boot is a bit ...


4

I had a similar problem. It was frustrating because I couldn't see any error logs indicating what the problem was. In my case, the value I had set for innodb_buffer_pool_size was too large for the memory of the server. I found this out by running mysqld directly as the mysql user. # su mysql # mysqld This way you actually see the error output.


4

Tell them don't install non-free softwares. If this doesn't work, try: Create user group powerusers, users in this group can only install certain type of softwres. # addgroup powerusers Edit /etc/sudoers, grant powerusers the privilege to sudo apt-get only: %powerusers ALL = (ALL) /usr/bin/apt-get Now, users in powerusers group can only sudo apt-get ...


4

There are two ways: You can find the patches for various kernel versions in the kernel-patches directory in the sources of the package apparmor: apt-get source apparmor You can grab the patches directly from the web (replace precise with whatever version you are running).


4

No one's answered, so I'll tell what I found out. The problem in short is the following: when the file /etc/mysql/my2.cnf is accessed by cat, we see this: open("/etc/mysql/my2.cnf", O_RDONLY) = 3 However, when mysqld makes the same call, it gets a different answer: open("/etc/mysql/my2.cnf", O_RDONLY) = -1 EACCES (Permission denied) Thus, the ...


3

I also had a similar problem. The items below say they have been removed from mysql server 5.5. If you have them in your my.cnf, it won't start. Comment them out with #. (Info derived from : http://dev.mysql.com/doc/refman/5.5/en/replication-options-slave.html) The options affected are shown in this list: --master-host --master-user --master-password ...


3

The only thing confusing in there are the codes and your interpret them like this: 'r' read 'w' write 'm' memory map as executable 'k' file locking 'l' creation hard links 'ix' execute and inherit this profile 'Px' execute under another profile, after cleaning the environment 'Ux' execute unconfined, after cleaning the environment The rest of the ...


3

Change the sshd port to something nonstandard Use knockd to implement a port-knocking system Use iptables' recent and hashlimit matches to limit consecutive SSH attempts Do not use passwords, but use SSH keys instead


3

Accrding to the http://wiki.apparmor.net FAQ any program that has no profile is basically unprotected / unconstrained and can do any mischief in Ubuntu, almost in the same way as there would not have been any AppArmor in the first place


3

It is not possible at this time. But it has been added as one of the possible features that could be added in the future in the apparmor roadmap. An alternate solution is to "fix" the Firefox profile so that you no longer get denial messages from it. You can update a profile using the aa-genprof utility using sudo aa-genprof ...


3

Run ps afx|grep rsyslog in a different console, then: If there are traces of rsyslogd running, probably in <defunct> state, this is a bug in the upstart scripts incompatibility which has been fixed. Simply upgrade to the recent version (dpkg -r --ignore-depends rsyslog rsyslog && aptitude update && aptitude upgrade rsyslog). If there ...


3

You can remove AppArmor without immediately killing the system. Nothing relies on it to function. But it is there for a reason. If security really isn't a concern, that's fair enough, but if you're just doing it for a quick convenience, consider learning how to adapt the rules.


2

The mission-control-5 process tried to open and read the /home/jagat/.config/dconf/user file and Apparmor stopped it. I'm not sure why mission-control wanted to read that file, but unless you have been tinkering with apparmor or think you are experiencing problems because of this, you shouldn't need to take any actions.


2

This is not the way to debug a problem with apparmor at all. You use sudo aa-logprof to examine the logs for problems. You will then be given an opportunity to review any problems in the logs and modify your aa profile. It is always a good idea to first back up the origional file (back it up in /root/aa-profiles). After reviewing the logs, it is always a ...


2

You will have to manually review and debug they Apparmor Profile you copied from Arch. My guess is that you can review and make a few (minor) changes. If you can not do this, then I suggest you put the profile into complain mode and run aa-logprof sudo aa-complain /etc/apparmor.d/usr.bin.skype Open and use Skype. Close Skype. Then run aa-logprof sudo ...


2

Here is a quote from the Apparmor wiki: AppArmor is an effective and easy-to-use Linux application security system. AppArmor proactively protects the operating system and applications from external or internal threats, even zero-day attacks, by enforcing good behavior and preventing even unknown application flaws from being exploited. AppArmor security ...



Only top voted, non community-wiki answers of a minimum length are eligible