AppArmor¶

AppArmor confines programs to what their profile allows: which files they can read, which they can write, whether they can open network connections. When a confined program is exploited, the attacker gets the profile's permissions, not the user's. Both Mint and Debian ship it enabled; an image can turn it off or set every profile to complain-only.

The settings¶

CIS	What	Value
1.3.1.1	Packages	`apparmor` and `apparmor-utils` installed
1.3.1.2	Enabled at boot	`apparmor=1 security=apparmor` on the kernel line (Bootloader)
1.3.1.3	No profile disabled	Nothing in `/etc/apparmor.d/disable/`
1.3.1.4	Every profile enforcing	`aa-status` shows 0 profiles in complain mode
Debian CIS 1.3.1.4	Unprivileged unconfined restricted	`kernel.apparmor_restrict_unprivileged_unconfined = 1`, so an unconfined user process can't change its own confinement

Apply¶

sudo apt install -y apparmor apparmor-utils
sudo systemctl enable --now apparmor
sudo aa-status

aa-status prints how many profiles are loaded, how many are in enforce mode, and how many in complain mode. Complain mode logs violations but allows them, which is the same as off for an attacker.

sudo ls /etc/apparmor.d/disable/
sudo rm /etc/apparmor.d/disable/*        # re-enables the disabled profiles
sudo aa-enforce /etc/apparmor.d/*
echo 'kernel.apparmor_restrict_unprivileged_unconfined = 1' | sudo tee /etc/sysctl.d/60-apparmor.conf; sudo sysctl --system

aa-enforce on a profile whose program isn't installed prints an error and moves on; that's fine. If a README application stops working after enforcing, sudo aa-complain /etc/apparmor.d/<that profile> puts one profile back and journalctl -k | grep apparmor shows what it was denied.

Verify¶

sudo aa-status | head -n 6
cat /sys/module/apparmor/parameters/enabled     # Y
grep -E 'apparmor=1' /proc/cmdline              # after reboot

Example¶

aa-status says "apparmor module is loaded. 0 profiles are loaded." and systemctl is-enabled apparmor says disabled. /etc/apparmor.d/disable/ contains symlinks for usr.sbin.cupsd and usr.bin.man. Remove the links, enable and start the service, aa-enforce everything, and check the kernel line.

Try it¶

Run aa-status and count the profiles. Put one in complain mode with aa-complain, run aa-status again, put it back.
Find a denial in journalctl -k after enforcing everything.

Build it¶

Add aa-status | head -n 6 and a check of /etc/apparmor.d/disable/ to baseline.sh.

Next¶

Login Banners