Confining applications with AppArmor
You write AppArmor profiles that let a service reach only the files and capabilities it needs, test them in complain mode and move them to enforce mode.
Level 301 · 16 lessons · 18 practice labs
Lessons
Mandatory access control
- When permissions aren’t enough: the idea of mandatory access control
- Seeing profiles and modes with aa-status
- Anatomy of a profile: paths, permissions, capabilities
- Switching between complain and enforce modes
- Short task: find the profiles that are not enforcing
Writing profiles
- Creating a new profile with aa-genprof
- Reading denials and refining a profile with aa-logprof
- Abstractions and shared includes
- Network and capability rules: only the sockets you need
- Short task: write a profile from scratch for a small script
Services and containers
- A profile for Nginx: restricting the upload directory
- AppArmor profiles for Docker containers
- Diagnosing a service broken by its profile
- Short task: stop a container from writing under /proc
Capstone
- Rolling profiles out to production in stages
- Capstone: contain a vulnerable web application with AppArmor
Practice labs
- Find the profiles that are not enforcing: Extract the profiles in complain mode from aa-status and note which services they belong to.
- Show which profile a service runs under: Inspect the service process with ps and /proc/<pid>/attr/current and write down its profile and mode.
- List network-facing processes with no profile: Match listening processes with their AppArmor status and find the two services running unconfined.
- Catch a profile set to enforce that never got loaded: Find out why the profile on disk and the kernel state differ, load the profile and show it is enforcing.
- Write a profile for a small backup script: Build a profile with aa-genprof by running the script, enforce it and show the script can write only to the backup folder.
- Read a profile file and explain its permissions: Prepare a short table explaining each path rule and the r, w, ix and k flags in a ready-made profile.
- Read the denials and tighten the profile: Review the DENIED records in the log, add only the needed permissions with aa-logprof and remove an overly broad rule.
- Trim the network and capability rights of a report service: Replace the broad network and capability lines with what the service really uses and test the service.
- Close the wildcard gap a profile leaves open: Show that an over-broad path rule allows reading /etc/shadow, narrow the rule and prove access is denied.
- Stop scripts from running in the Nginx upload folder: Add a no-execute rule for the upload folder to the Nginx profile and show an uploaded script cannot run.
- Fix a service that will not start because of its profile: Find which denial a service hits after an update and get it running by adding the narrowest permission.
- Run a container under a custom AppArmor profile: Load a profile that forbids writing to /proc and /sys, start the container with it and test the restriction.
- Validate a risky profile in complain mode before enforcing it: Compare a new profile with a day of complain-mode records, add missing rights and switch to enforce with no outage.
- Stop a compromised web app from spawning a shell: Edit the app profile to deny running /bin/sh and curl, then trigger the flaw and show the block works.
- Find and fix the broken rule in a profile that fails to load: Follow the apparmor_parser output and the included abstractions to the faulty line, fix and reload the profile and show the service running in enforce mode.
- Switch a profile from complain mode to enforce mode: Move a service profile left in complain mode to enforce mode with aa-enforce and show a denied access in the log.
- List the network and capability rights a profile grants: Find the network and capability lines in the report service’s profile and state what each allows.
- Remove unused rights from a profile using log evidence: Watch the service in complain mode for a while, identify file, network and capability rules never used in the log, remove them and verify it works in enforce mode.
About this course
You write AppArmor profiles that let a service reach only the files and capabilities it needs, test them in complain mode and move them to enforce mode.
What you will learn
- Mandatory access control
- Writing profiles
- Services and containers
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.