Introduction
This article explains how to create an AppArmor whitelist to allow running specified applications on a system using the vanilla 4.9.x AppArmor buildroot. A whitelist is a security measure that only permits explicitly allowed activities, in this case, running particular applications.
What is AppArmor?
AppArmor (AA) is a Linux Security Module (LSM) that confines programs to a set of predefined capabilities, known as a "profile". AppArmor provides an effective means of security, particularly in multiuser environments, by limiting the potential damage from misbehaving or compromised programs through mandatory access control (MAC).
Why Create an AppArmor Whitelist?
A whitelist helps strengthen system security by restricting users to only run explicitly allowed applications. By limiting application execution through whitelisting, unauthorized or potentially harmful software cannot execute, reducing the chances of system compromise or malware infections.
Prerequisites
Ensure that the AppArmor framework is installed and properly configured. Here are the steps to install AppArmor on a Debian-based system:
sudo apt-get updatesudo apt-get install apparmor apparmor-utils
Verify AppArmor is running using:
sudo systemctl status apparmor
Creating the Whitelist
AppArmor whitelisting involves defining specific paths and executables in its corresponding profiles. You will create a custom profile in this example, but it is crucial to be aware of any existing profiles relevant to your applications.
Step 1: Creating a New Profile
To create a tailored profile for your allowed applications, execute:
sudo aa-genprof /path/to/application
Replace "/path/to/application" with the actual path of the
executable. Execute the program as a regular user and let it perform its tasks,
such as opening files, internet connections, and displaying GUI elements.
Step 2: Generating a Confinement Profile
Once you have finished using the application, AppArmor will generate a confinement profile, listing all paths that the program has attempted to access. This stage will show a log of its behavior. To save these findings to a file, type:
sudo aa-logprof
Use the arrow keys to navigate the entries, press a or i
based on whether you want to allow or indicate a specific denied access
attempt. Once complete, save the profile with:
sudo aa-save
Step 3: Whitelisting Applications
With your profile now complete, it is time to define the whitelist. To do this, add the following line in the profile:
# Allow only specified applications
profile {
...
deny /**
...
allow /path/to/application/**
}
By adding the "allow /path/to/application/**" statement,
you allow full access to the specified application's actions,
whitelisting it for use.
AppArmor profiles provide an efficient means of securing your system by applying MAC policies and creating whitelists. By allowing only a predefined set of applications to run, you strengthen the security of your system, reducing susceptibility to harmful software and unauthorized users alike.
- AppArmor is a Linux Security Module (LSM) that confines programs using predefined capabilities (profiles).
- A whitelist is a security measure restricting users to only run explicitly allowed applications.
- Ensure AppArmor is installed and functioning on your system.
-
Create a custom profile using
aa-genprof. -
Utilize
aa-logprofandaa-saveto generate a comprehensive profile. - Whitelist applications by adding "allow" lines in the profile.