A Novell® AppArmor profile represents the security policy for an individual program instance or process. It applies to an executable program, but if a portion of the program needs different access permissions than other portions, the program can “change hats” to use a different security context, distinctive from the access of the main program. This is known as a hat or subprofile.
ChangeHat enables programs to change to or from a hat within a Novell AppArmor profile. It enables you to define security at a finer level than the process. This feature requires that each application be made “ChangeHat aware” meaning that it is modified to make a request to the Novell AppArmor module to switch security domains at arbitrary times during the application execution. Two examples for ChangeHat-aware applications are the Apache Web server and Tomcat.
A profile can have an arbitrary number of subprofiles, but there are only
two levels: a subprofile cannot have further sub-subprofiles. A subprofile
is written as a separate profile and named as the containing profile
followed by the subprofile name, separated by a ^
.
Subprofiles must be stored in the same file as the parent profile.
Note that the security of hats is considerably weaker than that of full profiles. That is to say, if an attacker can find just the right kind of bug in a program, they may be able to escape from a hat into the containing profile. This is because the security of hats is determined by a secret key handled by the containing process, and the code running in the hat must not have access to the key. Thus change_hat is most useful in conjunction with application servers, where a language interpreter (such as PERL, PHP, or Java) is isolating pieces of code such that they do not have direct access to the memory of the containing process.
The rest of this chapter describes using change_hat in conjunction with Apache, to contain web server components run using mod_perl and mod_php. Similar approaches can be used with any application server by providing an application module similar to the mod_apparmor described next in Section 6.2.2, “Location and Directory Directives”.
For More Information | |
---|---|
For more information, see the change_hat man page. |
Novell AppArmor provides a mod_apparmor
module (package
apache2-mod_apparmor
) for
the Apache program. This module makes the Apache Web server
ChangeHat aware. Install it along with Apache.
When Apache is ChangeHat aware, it checks for the following customized Novell AppArmor security profiles in the order given for every URI request that it receives.
URI-specific hat (for example,
^phpsysinfo/templates/classic/images/bar_left.gif
)
DEFAULT_URI
HANDLING_UNTRUSTED_INPUT
Apache Configuration | |
---|---|
If you install
a2enmod apparmor |
As with most of the Novell AppArmor tools, you can use two methods for managing ChangeHat, YaST or the command line interface. Managing ChangeHat-aware applications from the command line is much more flexible, but the process is also more complicated. Both methods allow you to manage the hats for your application and populate them with profile entries.
The following steps are a demonstration that adds hats to an Apache profile using YaST. In the
, the Novell AppArmor profiling utilities prompt you to create new hats for distinct URI requests. Choosing to create a new hat allows you to create individual profiles for each URI. You can create very tight rules for each request.If the URI that is processed does not represent significant processing or otherwise does not represent a significant security risk, safely select
to process this URI in the default hat, which is the default security profile.
This example creates a new hat for the URI
phpsysinfo
and its subsequent accesses. Using the
profiling utilities, delegate what to add to this new hat. The resulting
hat becomes a tight-security container that encompasses all the
processing on the server that occurs when the
phpsysinfo
URI is passed to the Apache Web server.
The URI runs the application phpsysinfo (refer to
http://phpsysinfo.sourceforge.net for more
information). The phpsysinfo
package is assumed to be installed in
/srv/www/htdocs/phpsysinfo
in a clean (new)
installation of
openSUSE
and AppArmor.
Once phpsysinfo
is
installed, you are ready to add hats to the Apache profile. From the
Novell AppArmor GUI, select .
In httpd2-prefork.
, enterClick
.Restart Apache by entering rcapache2 restart in a terminal window.
Restart any program you are profiling at this point.
Open http://localhost/phpsysinfo/
in a Web
browser window. The browser window should display network usage and
system information.
Data Caching | |
---|---|
To ensure that this request is processed by the server and you do not
review cached data in your browser, refresh the page. To do this,
click the browser |
Click aa-logprof tool, which scans the information learned in the previous step. It begins to prompt you with profile questions.
. Novell AppArmor launches the
aa-logprof first prompts with or because
it noticed that the phpsysinfo
URI was accessed.
Select .
Click
.Choosing
in the previous step creates a new hat in the profile and specifies that the results of subsequent questions about the script's actions are added to the newly created hat rather than the default hat for this application.In the next screen, Novell AppArmor displays an external program that the script executed. You can specify that the program should run confined by the phpsysinfo hat (choose
), confined by a separate profile (choose ), or that it should run unconfined or without any security profile (choose ). For the case of the option, a new profile is created for the program if one does not already exist.Security Considerations | |
---|---|
Selecting can create a significant security hole and should be done with caution. |
Select /bin/bash
path. This adds
/bin/bash
(accessed by Apache) to the
phpsysinfo hat profile with the necessary permissions.
Click
.The remaining questions prompt you to generate new hats and add entries to your profile and its hats. The process of adding entries to profiles is covered in detail in the Section 4.1, “Adding a Profile Using the Wizard”.
When all profiling questions are answered, click
to save your changes and exit the wizard.The following is an example phpsysinfo hat.
Example 6.1. Example phpsysinfo Hat
/usr/sbin/httpd2-prefork { ... ^phpsysinfo { #include <abstractions/bash> #include <abstractions/nameservice> /bin/basename ixr, /bin/bash ixr, /bin/df ixr, /bin/grep ixr, /bin/mount Ux, /bin/sed ixr, /dev/bus/usb/ r, /dev/bus/usb/** r, /dev/null w, /dev/tty rw, /dev/urandom r, /etc/SuSE-release r, /etc/ld.so.cache r, /etc/lsb-release r, /etc/lsb-release.d/ r, /lib/ld-2.6.1.so ixr, /proc/** r, /sbin/lspci ixr, /srv/www/htdocs/phpsysinfo/** r, /sys/bus/pci/** r, /sys/bus/scsi/devices/ r, /sys/devices/** r, /usr/bin/cut ixr, /usr/bin/getopt ixr, /usr/bin/head ixr, /usr/bin/lsb_release ixr, /usr/bin/lsscsi ixr, /usr/bin/tr ixr, /usr/bin/who ixr, /usr/lib/lib*so* mr, /usr/lib/locale/** r, /usr/sbin/lsusb ixr, /usr/share/locale/** r, /usr/share/pci.ids r, /usr/share/usb.ids r, /var/log/apache2/access_log w, /var/run/utmp kr, } }
Hat and Parent Profile Relationship | |
---|---|
The profile |
When you use the Section 4.3, “Editing Profiles”) or when you add a new profile using (for instructions, refer to Section 4.2, “Manually Adding a Profile”), you are given the option of adding hats (subprofiles) to your Novell AppArmor profiles. Add a ChangeHat subprofile from the window as in the following.
dialog (for instructions, refer toFrom the
window, click then select . The dialog box opens:Enter the name of the hat to add to the Novell AppArmor profile. The name is the URI that, when accessed, receives the permissions set in the hat.
Click
. You are returned to the screen.After adding the new hat, click
.For More Information | |
---|---|
For an example of an Novell AppArmor profile, refer to Example 6.1, “Example phpsysinfo Hat”. |