7

I know the AppArmor profiles resides in /etc/apparmor.d/, but I do not know how to interpret it. Any translation would be enlightening.

Improve this question
8
  • 1
    You mean the configuration from /etc/apparmor.d/usr.bin.firefox? It looks very explanatory.
    – Lekensteyn
    May 9, 2011 at 13:13
  • @Lekensteyn, no I do not know how to read it. And sorry about the new question, I posted it mistakenly after I couldn't find my own question.
    – Oxwivi
    Jun 27, 2011 at 18:56
  • It would be better if you had studied the syntax and then asked some more specific questions. There's plenty of documentation online. You can't expect anyone to explain the profile line by line. wiki.ubuntu.com/AppArmor
    – arrange
    Jun 28, 2011 at 8:10
  • @arrange, I was hoping someone would. :) You can't expect every user to learn to effects when considering using it.
    – Oxwivi
    Jun 28, 2011 at 8:16
  • @Oxwivi: I get your point, but right now there are 618 lines in FF-related apparmor profile files...
    – arrange
    Jun 28, 2011 at 8:28

2 Answers 2

Reset to default
4

The only thing confusing in there are the codes and your interpret them like this: 

'r'  read
'w'  write
'm'  memory map as executable
'k'  file locking
'l'  creation hard links
'ix' execute and inherit this profile
'Px' execute under another profile, after cleaning the environment
'Ux' execute unconfined, after cleaning the environment

The rest of the file are mainly directories, files and libraries with sometimes some parameters in front (like PROC and HOME which seem easy to understand) and regexes to make it more flexible and sometimes a 'deny' or 'owner' in front of the line (these seem to be self-explanatory to me: they deny access and limit actions in case it is the owner doing them).

Regarding PROC:

Example:

# for networking
  network inet stream,
  network inet6 stream,
  @{PROC}/[0-9]*/net/if_inet6 r,
  @{PROC}/[0-9]*/net/ipv6_route r,

and do 

cd /proc/
ls *

See all the directories with digits? These correspond to each running process. If any of them contain a directory net (network) and that holds a file if_net6 or ipv6_route they are considered read.

Improve this answer
3
  • HOME I understand, but not PROC.
    – Oxwivi
    Jun 28, 2011 at 7:26
  • Also there are some lines without any of the parameters defined.
    – Oxwivi
    Jun 28, 2011 at 7:37
  • so the code behind it says what permission it gets systemwide for every user.
    – Rinzwind
    Jun 28, 2011 at 7:44
2

See Access Modes, Rule Qualifiers, and #include mechanism in the man page...

man apparmor.d

The man page explains it pretty verbosely. Regarding your question about @{PROC} there are variables which can be set within include files. From the apparmor.d(5) man page...

Some of the abstractions rely on variables that are set in files in the /etc/apparmor.d/tunables/ directory. These variables are currently @{HOME} and @{HOMEDIRS}. Variables cannot be set in profile scope; they can only be set before the profile. Therefore, any profiles that use abstractions should either #include <tunables/global> or otherwise ensure that @{HOME} and @{HOMEDIRS} are set before starting the profile definition. The aa-autodep(8) and aa-genprof(8) utilities will automatically emit #include <tunables/global> in generated profiles.

If you look in /etc/apparmor.d/tunables/global you'll see there's another #include <tunables/proc>. The contents of that file is....

# Copyright (C) 2006 Novell/SUSE... GNU GPLv2... more license info...
# @{PROC} is the location where procfs is mounted.
@{PROC}=/proc/

So @{PROC} is simply an abstract variable pointing to the proc(5) filesystem.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.