1 00:00:00,050 --> 00:00:01,020 In this lesson, 2 00:00:01,020 --> 00:00:04,110 we're going to discuss SELinux and AppArmor. 3 00:00:04,110 --> 00:00:05,400 Now in order to further mitigate 4 00:00:05,400 --> 00:00:06,900 the risk of a security breach, 5 00:00:06,900 --> 00:00:08,520 several Linux distributions provide 6 00:00:08,520 --> 00:00:09,630 an additional layer of security 7 00:00:09,630 --> 00:00:12,060 on top of the original operating system. 8 00:00:12,060 --> 00:00:14,280 Now one of the best ways to stop a data breach 9 00:00:14,280 --> 00:00:16,560 is to restrict the ability of granting access 10 00:00:16,560 --> 00:00:17,820 or denying somebody's access 11 00:00:17,820 --> 00:00:21,000 to a given resource object within your file system. 12 00:00:21,000 --> 00:00:23,400 And this is where the idea of mandatory access control 13 00:00:23,400 --> 00:00:24,450 comes into play, 14 00:00:24,450 --> 00:00:27,240 and this is known as MAC, M-A-C. 15 00:00:27,240 --> 00:00:28,920 Now mandatory access control 16 00:00:28,920 --> 00:00:31,680 is a system-enforced access control mechanism 17 00:00:31,680 --> 00:00:34,890 that's based on subject clearance and the object labels. 18 00:00:34,890 --> 00:00:36,630 In this lesson, we're going to discuss 19 00:00:36,630 --> 00:00:39,810 context-based permissions and security related technologies, 20 00:00:39,810 --> 00:00:42,570 as the Security-Enhanced Linux and AppArmor 21 00:00:42,570 --> 00:00:44,370 are both classified as MAC 22 00:00:44,370 --> 00:00:46,500 or mandatory access control systems 23 00:00:46,500 --> 00:00:47,760 to create those mechanisms 24 00:00:47,760 --> 00:00:50,460 on how to restrict access to system processes 25 00:00:50,460 --> 00:00:52,740 into the files, directories, networks, 26 00:00:52,740 --> 00:00:55,170 ports, and other things like that. 27 00:00:55,170 --> 00:00:56,700 Now context-based permissions 28 00:00:56,700 --> 00:00:58,140 refered permission schemes 29 00:00:58,140 --> 00:01:00,060 that are defined by various properties 30 00:01:00,060 --> 00:01:02,070 for a given file or process. 31 00:01:02,070 --> 00:01:05,610 And it uses those properties together, rather than isolation 32 00:01:05,610 --> 00:01:07,830 to determine whether to grant or deny access 33 00:01:07,830 --> 00:01:09,270 to a given user. 34 00:01:09,270 --> 00:01:11,880 Now in Linux, there are two main context-based 35 00:01:11,880 --> 00:01:13,620 permission schemes that are available, 36 00:01:13,620 --> 00:01:16,500 namely SELinux and AppArmor. 37 00:01:16,500 --> 00:01:18,930 And both of these context-based permission schemes 38 00:01:18,930 --> 00:01:21,120 leverage MAC to do their work. 39 00:01:21,120 --> 00:01:23,910 Now this differs from the default scheme inside of Linux, 40 00:01:23,910 --> 00:01:27,330 which is known as DAC or discretionary access control. 41 00:01:27,330 --> 00:01:30,090 In DAC, each object has a list of entities 42 00:01:30,090 --> 00:01:31,590 that are allowed to access it, 43 00:01:31,590 --> 00:01:34,890 whether these are systems, processes, files or users, 44 00:01:34,890 --> 00:01:36,780 and the person who controls that 45 00:01:36,780 --> 00:01:38,490 is actually the object owner. 46 00:01:38,490 --> 00:01:40,110 They can make those changes directly 47 00:01:40,110 --> 00:01:42,690 using things like change own or change mod 48 00:01:42,690 --> 00:01:44,280 depending on whether you want to change ownership 49 00:01:44,280 --> 00:01:45,900 or permissions, and you could do that 50 00:01:45,900 --> 00:01:47,730 in a discretionary manner. 51 00:01:47,730 --> 00:01:49,410 Now SELinux on the other hand 52 00:01:49,410 --> 00:01:52,560 doesn't allow DAC and instead it relies on MAC 53 00:01:52,560 --> 00:01:55,110 to do its permissions and access control. 54 00:01:55,110 --> 00:01:58,110 SELinux was created by the National Security Agency 55 00:01:58,110 --> 00:01:59,880 known as the NSA. 56 00:01:59,880 --> 00:02:03,360 SELinux is the default context-based permission scheme 57 00:02:03,360 --> 00:02:05,460 that's included inside of CentOS 58 00:02:05,460 --> 00:02:07,620 and Red Hat Enterprise Linux. 59 00:02:07,620 --> 00:02:10,110 By using SELinux, we have a way to provide 60 00:02:10,110 --> 00:02:12,630 additional file system and network security 61 00:02:12,630 --> 00:02:15,090 so that unauthorized processes cannot access 62 00:02:15,090 --> 00:02:18,450 or tamper with our data, bypass our security mechanisms, 63 00:02:18,450 --> 00:02:20,190 violate our security policies 64 00:02:20,190 --> 00:02:22,920 or execute untrustworthy programs. 65 00:02:22,920 --> 00:02:25,020 SELinux is used to enforce MAC 66 00:02:25,020 --> 00:02:27,030 on processes and resources 67 00:02:27,030 --> 00:02:30,030 and enables information to be classified and protected 68 00:02:30,030 --> 00:02:33,330 based on its confidentiality and integrity requirements. 69 00:02:33,330 --> 00:02:35,670 This helps us mitigate the damage that can be caused 70 00:02:35,670 --> 00:02:38,280 by information getting into the hands of malicious user 71 00:02:38,280 --> 00:02:40,260 or malicious application. 72 00:02:40,260 --> 00:02:42,930 Now SELinux defines three main context 73 00:02:42,930 --> 00:02:44,970 for each file and process. 74 00:02:44,970 --> 00:02:48,060 These are the user, the role and the type. 75 00:02:48,060 --> 00:02:51,930 The user context defines what users can access an object. 76 00:02:51,930 --> 00:02:54,480 Different distributions provide different users, 77 00:02:54,480 --> 00:02:58,050 but the most common ones include unconfined_u, 78 00:02:58,050 --> 00:02:59,627 which pertains to all users; 79 00:02:59,627 --> 00:03:03,390 user_u, which pertains to unprivileged users; 80 00:03:03,390 --> 00:03:07,350 sysadm_u, which pertains to system administrators; 81 00:03:07,350 --> 00:03:10,020 and root, which pertains to the root user. 82 00:03:10,020 --> 00:03:12,300 The role context is our second area. 83 00:03:12,300 --> 00:03:15,420 And this defines what roles can access a given object. 84 00:03:15,420 --> 00:03:19,020 Now SELinux users are authorized to be in a certain roles. 85 00:03:19,020 --> 00:03:22,470 And those roles are typically used to permit or deny access 86 00:03:22,470 --> 00:03:26,234 to the given domain, or the given resources and processes. 87 00:03:26,234 --> 00:03:29,910 To control this, there's a role called object_r, 88 00:03:29,910 --> 00:03:32,490 and this applies to your files and directories. 89 00:03:32,490 --> 00:03:36,000 Now the third context we have is known as the type context. 90 00:03:36,000 --> 00:03:38,610 The type context is the label portion of MAC. 91 00:03:38,610 --> 00:03:40,530 And it's the most important context 92 00:03:40,530 --> 00:03:42,330 for this fine grained access control 93 00:03:42,330 --> 00:03:43,770 that we want to achieve. 94 00:03:43,770 --> 00:03:45,240 By using this type, 95 00:03:45,240 --> 00:03:47,400 it's a way of us grouping objects together 96 00:03:47,400 --> 00:03:50,730 that have similar security requirements or characteristics. 97 00:03:50,730 --> 00:03:52,620 Now another feature of SELinux 98 00:03:52,620 --> 00:03:55,350 that's considered optional is a fourth context 99 00:03:55,350 --> 00:03:57,150 and this is called a level. 100 00:03:57,150 --> 00:03:59,790 This level is used to describe the sensitivity level 101 00:03:59,790 --> 00:04:02,790 of a given file, directory or process. 102 00:04:02,790 --> 00:04:03,900 When we use levels, 103 00:04:03,900 --> 00:04:06,960 we call this a multi-level security context. 104 00:04:06,960 --> 00:04:09,030 And it enables you to further fine tune 105 00:04:09,030 --> 00:04:12,420 and constrain access even when the main three contexts 106 00:04:12,420 --> 00:04:14,700 are being fulfilled because this fourth one 107 00:04:14,700 --> 00:04:16,769 of this level may not be. 108 00:04:16,769 --> 00:04:19,350 Now SELinux also has three different modes 109 00:04:19,350 --> 00:04:20,519 that we need to cover. 110 00:04:20,519 --> 00:04:23,910 These are called disabled, enforcing, and permissive. 111 00:04:23,910 --> 00:04:27,330 Now in a disabled mode, SELinux is essentially turned off, 112 00:04:27,330 --> 00:04:29,460 and so MAC is not going to be implemented. 113 00:04:29,460 --> 00:04:32,640 And instead, we're going to rely on the default DAC method 114 00:04:32,640 --> 00:04:34,470 inside the file system. 115 00:04:34,470 --> 00:04:36,450 Now when we're using enforcing mode, 116 00:04:36,450 --> 00:04:39,690 all the SELinux security policies are being enforced. 117 00:04:39,690 --> 00:04:42,150 Therefore, the processes cannot violate 118 00:04:42,150 --> 00:04:44,460 any security policies because we have them 119 00:04:44,460 --> 00:04:45,926 and they're being enforced. 120 00:04:45,926 --> 00:04:48,780 The third one we have is known as permissive mode. 121 00:04:48,780 --> 00:04:51,480 Now in permissive mode, SELinux is enabled 122 00:04:51,480 --> 00:04:54,450 but the security policies are not enforced. 123 00:04:54,450 --> 00:04:55,770 And this means that processes 124 00:04:55,770 --> 00:04:58,410 can bypass the security policies. 125 00:04:58,410 --> 00:05:00,420 Now SELinux policy is going to be used 126 00:05:00,420 --> 00:05:02,130 to describe the access permissions 127 00:05:02,130 --> 00:05:04,860 for all of your users, programs, processes, 128 00:05:04,860 --> 00:05:07,140 files and devices that are going to be used 129 00:05:07,140 --> 00:05:09,660 and acted upon by the operating system. 130 00:05:09,660 --> 00:05:12,630 Now SELinux can implement two different types of policies. 131 00:05:12,630 --> 00:05:14,578 These are known as targeted or strict. 132 00:05:14,578 --> 00:05:18,240 Now the targeted policy is the default SELinux policy 133 00:05:18,240 --> 00:05:20,710 that's used in Red Hat Linux and CentOS. 134 00:05:20,710 --> 00:05:23,070 When we're using targeted policies, 135 00:05:23,070 --> 00:05:25,050 processes that are targeted are going to run 136 00:05:25,050 --> 00:05:26,610 in a confined domain, 137 00:05:26,610 --> 00:05:28,530 and the processes that are not targeted 138 00:05:28,530 --> 00:05:30,870 will run in unconfined domain. 139 00:05:30,870 --> 00:05:34,035 A strict policy is really the opposite of a targeted policy. 140 00:05:34,035 --> 00:05:37,410 And this means that every subject and object in that system 141 00:05:37,410 --> 00:05:40,050 is enforced to operate on the MAC method. 142 00:05:40,050 --> 00:05:41,940 So when you think about targeted, 143 00:05:41,940 --> 00:05:44,760 this only applies to certain things on your operating system 144 00:05:44,760 --> 00:05:47,430 that you really want higher levels of protection for. 145 00:05:47,430 --> 00:05:50,040 If you go ahead and use the strict policy, 146 00:05:50,040 --> 00:05:53,160 it's going to enforce MAC on everything on your system. 147 00:05:53,160 --> 00:05:55,050 This is really complicated to set up 148 00:05:55,050 --> 00:05:57,390 if you want to use this strict policy 149 00:05:57,390 --> 00:05:59,730 because you have to go and look at everything on the system 150 00:05:59,730 --> 00:06:00,810 and what could be broken 151 00:06:00,810 --> 00:06:02,885 by not having the proper access rights. 152 00:06:02,885 --> 00:06:04,710 Now there are several major commands 153 00:06:04,710 --> 00:06:05,910 that you need to understand 154 00:06:05,910 --> 00:06:09,180 if you're going to start configuring an SELinux environment. 155 00:06:09,180 --> 00:06:11,430 This includes the semanage command. 156 00:06:11,430 --> 00:06:15,259 The semanage command is used to configure SELinux policies. 157 00:06:15,259 --> 00:06:17,760 The sestatus command is going to be used 158 00:06:17,760 --> 00:06:21,270 to get the status of SELinux, including the policy type, 159 00:06:21,270 --> 00:06:23,505 the mount point and other things like that. 160 00:06:23,505 --> 00:06:26,400 The getenforce command is going to be used to display 161 00:06:26,400 --> 00:06:29,400 which mode SELinux is currently running it. 162 00:06:29,400 --> 00:06:31,410 The setenforce command is going to be used 163 00:06:31,410 --> 00:06:33,900 to change the mode that SELinux is running in. 164 00:06:33,900 --> 00:06:35,010 And then you can verify that 165 00:06:35,010 --> 00:06:37,260 by using the getenforce command. 166 00:06:37,260 --> 00:06:40,410 For example, if you entered setenforce 1, 167 00:06:40,410 --> 00:06:42,210 this would enable enforcing mode. 168 00:06:42,210 --> 00:06:46,290 If you set setenforce 0, this enables permissive mode. 169 00:06:46,290 --> 00:06:48,507 You can also use the command getsebool. 170 00:06:48,507 --> 00:06:51,180 And this will display the on or off status 171 00:06:51,180 --> 00:06:53,040 of the SE boolean values, 172 00:06:53,040 --> 00:06:56,250 which enable you to change policy configurations at runtime 173 00:06:56,250 --> 00:06:58,770 without actually writing the policies directly. 174 00:06:58,770 --> 00:07:00,930 If you want to change the on or off status 175 00:07:00,930 --> 00:07:02,550 of an SE boolean value, 176 00:07:02,550 --> 00:07:05,430 you can use the setsebool command. 177 00:07:05,430 --> 00:07:06,750 Now you may be wondering 178 00:07:06,750 --> 00:07:08,940 how you can list out the directory contents 179 00:07:08,940 --> 00:07:11,300 along with each object security context. 180 00:07:11,300 --> 00:07:13,830 And if you guessed that you're going to use the ls command, 181 00:07:13,830 --> 00:07:14,940 you'd be right. 182 00:07:14,940 --> 00:07:18,720 In this case, you're going to want to use ls-Z. 183 00:07:18,720 --> 00:07:21,046 When you do this, it's going to list out the entire directory, 184 00:07:21,046 --> 00:07:24,780 all of its contents and each object security context 185 00:07:24,780 --> 00:07:26,700 in terms of SELinux. 186 00:07:26,700 --> 00:07:28,980 Now, if you want to list out the running processes 187 00:07:28,980 --> 00:07:31,350 along with each processes security context, 188 00:07:31,350 --> 00:07:36,350 you can do that using the ps command by using ps-Z. 189 00:07:36,600 --> 00:07:39,120 If you just want to check one specific process, 190 00:07:39,120 --> 00:07:42,840 you can do that as well by typing in ps-Z 191 00:07:42,840 --> 00:07:45,990 and the PID for the process you want to check. 192 00:07:45,990 --> 00:07:48,180 Another command that you're going to use with SELinux 193 00:07:48,180 --> 00:07:52,080 is known as chcon or change con. 194 00:07:52,080 --> 00:07:55,350 Now this is going to change the context for a given file. 195 00:07:55,350 --> 00:08:00,350 By issuing change con, and then -u, -r or -t, 196 00:08:00,570 --> 00:08:03,068 this will refer to the user, the role or the type, 197 00:08:03,068 --> 00:08:05,670 and then the context value you want to assign 198 00:08:05,670 --> 00:08:08,272 and the file or directory you want to assign it to. 199 00:08:08,272 --> 00:08:09,690 Now, if you make a mistake, 200 00:08:09,690 --> 00:08:12,780 and you need to set that file back to its default context, 201 00:08:12,780 --> 00:08:16,020 you can do that by using restorecon as the command. 202 00:08:16,020 --> 00:08:18,660 And to do that, you'll simply type in restorecon 203 00:08:18,660 --> 00:08:20,880 and the name of the file or directory. 204 00:08:20,880 --> 00:08:23,010 As you can see, there are lots of different commands 205 00:08:23,010 --> 00:08:25,140 associated with using SELinux. 206 00:08:25,140 --> 00:08:28,080 It is somewhat complicated to set all this up properly, 207 00:08:28,080 --> 00:08:30,930 but it does give you a lot better security. 208 00:08:30,930 --> 00:08:33,780 Now once SELinux is enforced on a system, 209 00:08:33,780 --> 00:08:35,400 there's going to be violation messages 210 00:08:35,400 --> 00:08:37,506 that are going to be captured as part of an audit log 211 00:08:37,506 --> 00:08:39,933 for you be able to see what things people are doing 212 00:08:39,933 --> 00:08:41,940 that aren't inside of your policies 213 00:08:41,940 --> 00:08:43,260 that you're not allowing. 214 00:08:43,260 --> 00:08:44,700 Now these violations can occur 215 00:08:44,700 --> 00:08:46,710 because somebody is trying to access an object 216 00:08:46,710 --> 00:08:48,840 or a file they don't have access to. 217 00:08:48,840 --> 00:08:50,760 Or there's an action that goes against 218 00:08:50,760 --> 00:08:53,160 an existing policy and it's being blocked. 219 00:08:53,160 --> 00:08:55,740 When a system is first put under SELinux, 220 00:08:55,740 --> 00:08:58,410 it's possible to get a lot of false violations 221 00:08:58,410 --> 00:09:00,240 because your policies have to be tweaked 222 00:09:00,240 --> 00:09:02,490 and configured and fine tuned. 223 00:09:02,490 --> 00:09:04,920 So you're going to want to use the sealert command, 224 00:09:04,920 --> 00:09:06,960 which will make sure that all of your alert messages 225 00:09:06,960 --> 00:09:09,990 for violations are being sent into the audit log. 226 00:09:09,990 --> 00:09:12,210 Now unfortunately, the output of sealert 227 00:09:12,210 --> 00:09:13,890 is a little bit difficult to read, 228 00:09:13,890 --> 00:09:16,530 because it's meant for computers and not for humans. 229 00:09:16,530 --> 00:09:19,547 So if you want to see things in a more human readable format, 230 00:09:19,547 --> 00:09:22,584 I recommend you use audit2why instead. 231 00:09:22,584 --> 00:09:25,439 audit2why is another command that allows you to go 232 00:09:25,439 --> 00:09:27,510 and see what's in those logs 233 00:09:27,510 --> 00:09:30,240 and what's happening in terms of these violations. 234 00:09:30,240 --> 00:09:32,610 Now, in addition to the audit2why command, 235 00:09:32,610 --> 00:09:35,820 you should also be aware of the audit2allow command. 236 00:09:35,820 --> 00:09:38,580 The audit2allow command is a utility that you can use 237 00:09:38,580 --> 00:09:40,620 to gather information from the logs 238 00:09:40,620 --> 00:09:43,650 of all those denied operations and violations. 239 00:09:43,650 --> 00:09:46,470 And then it will generate SELinux policy allow rules 240 00:09:46,470 --> 00:09:48,420 for those denied operations. 241 00:09:48,420 --> 00:09:51,240 This is really helpful when you're first installing a system 242 00:09:51,240 --> 00:09:52,650 and you go ahead and turn it on 243 00:09:52,650 --> 00:09:54,630 and you start seeing all the things that are being blocked. 244 00:09:54,630 --> 00:09:56,130 And now you need to create allow rules 245 00:09:56,130 --> 00:09:57,330 for all of those things 246 00:09:57,330 --> 00:09:59,130 because they're things you actually wanted to happen 247 00:09:59,130 --> 00:10:01,140 and not things you wanted get blocked. 248 00:10:01,140 --> 00:10:06,140 To do this, you can run the command audit2allow -w -a 249 00:10:06,300 --> 00:10:08,040 at the command line interface. 250 00:10:08,040 --> 00:10:09,990 This will cause the audit2allow utility 251 00:10:09,990 --> 00:10:11,520 to read from the audit log, 252 00:10:11,520 --> 00:10:16,520 which is located at /var/log/audit/audit.log 253 00:10:16,770 --> 00:10:18,630 and display in a human readable format 254 00:10:18,630 --> 00:10:19,770 so you can understand a description 255 00:10:19,770 --> 00:10:21,990 of all these different blocked activities. 256 00:10:21,990 --> 00:10:24,510 Now, if you want to generate a loadable module 257 00:10:24,510 --> 00:10:26,340 to allow this activity to occur, 258 00:10:26,340 --> 00:10:31,340 you can then enter audit2allow -a -M and rule name. 259 00:10:31,860 --> 00:10:33,390 And this is where you can define a rule name 260 00:10:33,390 --> 00:10:35,280 that you want to use to identify this rule. 261 00:10:35,280 --> 00:10:37,410 For example, you might call it allow web 262 00:10:37,410 --> 00:10:39,060 or something like that. 263 00:10:39,060 --> 00:10:40,950 Then this is going to create two files 264 00:10:40,950 --> 00:10:42,300 in the current directory. 265 00:10:42,300 --> 00:10:44,211 One is named rulename.pp 266 00:10:44,211 --> 00:10:47,460 and the other one is called rulename.te. 267 00:10:47,460 --> 00:10:50,974 Now te is a file type that is for type enforcement 268 00:10:50,974 --> 00:10:55,200 and the pp file is what's known as a policy package file. 269 00:10:55,200 --> 00:10:58,230 To load that policy package file into SELinux, 270 00:10:58,230 --> 00:11:00,060 you're going to load that module and install it. 271 00:11:00,060 --> 00:11:05,060 So you're going to use semodule-irulename.pp, 272 00:11:05,070 --> 00:11:08,010 and this will implement your new SELinux allow rule 273 00:11:08,010 --> 00:11:11,280 called rule name on your SELinux system. 274 00:11:11,280 --> 00:11:13,740 Next, let's talk about AppArmor. 275 00:11:13,740 --> 00:11:15,150 Now at the beginning of this lesson, 276 00:11:15,150 --> 00:11:16,380 I mentioned that there were two 277 00:11:16,380 --> 00:11:19,200 context-based permission schemas that we could use. 278 00:11:19,200 --> 00:11:22,470 The first was SELinux and the second was AppArmor. 279 00:11:22,470 --> 00:11:25,680 Now that we've covered SELinux, let's move into AppArmor. 280 00:11:25,680 --> 00:11:27,450 Now AppArmor is an alternative 281 00:11:27,450 --> 00:11:29,250 context-based permission scheme 282 00:11:29,250 --> 00:11:31,280 and MAC implementation for Linux. 283 00:11:31,280 --> 00:11:35,040 AppArmor provides the same fundamental services as SELinux, 284 00:11:35,040 --> 00:11:36,900 but its approach is different 285 00:11:36,900 --> 00:11:39,550 in a lot of significant ways that you should be aware of. 286 00:11:39,550 --> 00:11:41,615 Now, the most overarching difference here 287 00:11:41,615 --> 00:11:44,460 is that SELinux is considered very complex 288 00:11:44,460 --> 00:11:46,050 and difficult to configure, 289 00:11:46,050 --> 00:11:49,260 but AppArmor was designed to be much simpler. 290 00:11:49,260 --> 00:11:51,892 Functionally, the main difference is that AppArmor works 291 00:11:51,892 --> 00:11:54,759 with file system objects based on paths, 292 00:11:54,759 --> 00:11:58,830 whereas SELinux actually references the inodes directly. 293 00:11:58,830 --> 00:12:02,700 Now each executable can have an associated AppArmor profile, 294 00:12:02,700 --> 00:12:07,700 and profiles are located in the /etc/apparmor.d/ directory. 295 00:12:07,950 --> 00:12:10,590 Within this directory, there's going to be several text files 296 00:12:10,590 --> 00:12:13,560 that are named in a path dot binary format. 297 00:12:13,560 --> 00:12:16,920 For example, you might have the /bin/dig command 298 00:12:16,920 --> 00:12:19,200 is one that you want to protect with AppArmor. 299 00:12:19,200 --> 00:12:21,300 So its configuration file will be located 300 00:12:21,300 --> 00:12:26,300 at /etc/apparmor.d/bin.dig. 301 00:12:26,460 --> 00:12:28,470 Now within a profile, you can configure 302 00:12:28,470 --> 00:12:30,210 two main types of rules. 303 00:12:30,210 --> 00:12:31,770 One is called capabilities 304 00:12:31,770 --> 00:12:34,080 and the second is called path entries. 305 00:12:34,080 --> 00:12:37,260 Now capabilities provide the ability for that executable 306 00:12:37,260 --> 00:12:40,230 to have access to some sort of system functionality. 307 00:12:40,230 --> 00:12:44,310 For example, the net_bind_service capability 308 00:12:44,310 --> 00:12:45,810 is going to enable the executable 309 00:12:45,810 --> 00:12:48,960 to bind to a well known TCP/IP port 310 00:12:48,960 --> 00:12:52,170 using a port number less than 1024. 311 00:12:52,170 --> 00:12:54,570 Now these path entries, which is the second type 312 00:12:54,570 --> 00:12:56,400 are going to be used to allow the executable 313 00:12:56,400 --> 00:12:59,280 to access a specific file on the system. 314 00:12:59,280 --> 00:13:02,070 So you can see that there's a capability and there's a path. 315 00:13:02,070 --> 00:13:03,852 And capability our system functions 316 00:13:03,852 --> 00:13:06,630 where as path entries are really giving you access 317 00:13:06,630 --> 00:13:09,120 to a particular file on that system. 318 00:13:09,120 --> 00:13:11,670 Now each profile can operate in two modes, 319 00:13:11,670 --> 00:13:13,890 either complain or enforce. 320 00:13:13,890 --> 00:13:15,570 When you're using complain mode, 321 00:13:15,570 --> 00:13:17,700 this is going to make sure that the policy violations 322 00:13:17,700 --> 00:13:19,890 are logged, but they're not blocked 323 00:13:19,890 --> 00:13:21,330 and they're not prevented. 324 00:13:21,330 --> 00:13:22,980 When you're using enforce mode, 325 00:13:22,980 --> 00:13:25,320 those profile violations are both logged 326 00:13:25,320 --> 00:13:27,105 and prevented or blocked. 327 00:13:27,105 --> 00:13:29,730 Now the other thing we need to talk about is tunables. 328 00:13:29,730 --> 00:13:31,590 Now tunables are a mechanism 329 00:13:31,590 --> 00:13:34,500 for tuning your configurations inside of AppArmor 330 00:13:34,500 --> 00:13:37,350 without having to adjust all of your different profiles. 331 00:13:37,350 --> 00:13:40,200 These tunables are going to be stored in various files 332 00:13:40,200 --> 00:13:45,200 underneath the /etc/apparmor.d/tunables directory. 333 00:13:45,720 --> 00:13:47,820 The most common tuneable that you're going to use 334 00:13:47,820 --> 00:13:52,820 is going to be in the /etc/apparmor.d/tunables/home file. 335 00:13:54,210 --> 00:13:55,860 If AppArmor is denying access 336 00:13:55,860 --> 00:13:57,630 to files in your home directory, 337 00:13:57,630 --> 00:14:00,420 and your home directory is not in the /home, 338 00:14:00,420 --> 00:14:05,420 then you're going to need to edit /etc/apparmor.d/tunables/home 339 00:14:06,240 --> 00:14:09,270 accordingly to give you proper access to that. 340 00:14:09,270 --> 00:14:11,190 Now some of the major commands that you can use 341 00:14:11,190 --> 00:14:15,840 to configure AppArmor include things like apparmor_status. 342 00:14:15,840 --> 00:14:17,847 This is a command that's used to display the current status 343 00:14:17,847 --> 00:14:20,220 of your AppArmor profiles. 344 00:14:20,220 --> 00:14:23,640 Another one you're going to see is aa-complain. 345 00:14:23,640 --> 00:14:25,620 And this command is used to place a profile 346 00:14:25,620 --> 00:14:27,180 into complain mode. 347 00:14:27,180 --> 00:14:29,487 If you use aa-enforce, this is a command 348 00:14:29,487 --> 00:14:31,890 that's going to be used to place the profile 349 00:14:31,890 --> 00:14:33,284 into enforce mode. 350 00:14:33,284 --> 00:14:37,320 aa-disable is a command used to disable a profile 351 00:14:37,320 --> 00:14:39,390 and this will basically unload it from the kernel 352 00:14:39,390 --> 00:14:41,790 and make it so it's not going to be enforced. 353 00:14:41,790 --> 00:14:45,420 Another one you're going to use is aa-unconfined. 354 00:14:45,420 --> 00:14:47,760 And this command is used to list out the processes 355 00:14:47,760 --> 00:14:49,350 with open network sockets 356 00:14:49,350 --> 00:14:51,780 that don't have an AppArmor profile loaded. 357 00:14:51,780 --> 00:14:53,310 And so those are things you may want to look 358 00:14:53,310 --> 00:14:56,400 at tightening up and giving yourself better security. 359 00:14:56,400 --> 00:14:57,989 Now the bottom line is that AppArmor 360 00:14:57,989 --> 00:15:00,900 can really be configured for any application 361 00:15:00,900 --> 00:15:02,940 to reduces potential attack surface 362 00:15:02,940 --> 00:15:04,770 and provide greater defense. 363 00:15:04,770 --> 00:15:06,120 When you're using AppArmor, 364 00:15:06,120 --> 00:15:08,100 it's going to be configured through these profiles 365 00:15:08,100 --> 00:15:09,810 that are tuned to allow access 366 00:15:09,810 --> 00:15:12,390 as needed by a specific program or container, 367 00:15:12,390 --> 00:15:14,370 such as your different Linux capabilities, 368 00:15:14,370 --> 00:15:17,310 network access, file permissions and more. 369 00:15:17,310 --> 00:15:20,130 Each profile can then be run in either enforcing mode, 370 00:15:20,130 --> 00:15:22,680 which blocks access to disallowed resources, 371 00:15:22,680 --> 00:15:25,230 or complain mode, which only reports the violations 372 00:15:25,230 --> 00:15:26,700 by logging them. 373 00:15:26,700 --> 00:15:29,640 AppArmor is really used to give you a more secure deployment 374 00:15:29,640 --> 00:15:32,280 by restricting what containers are allowed to do, 375 00:15:32,280 --> 00:15:35,250 and be able to provide better auditing through system logs. 376 00:15:35,250 --> 00:15:37,590 However, it's always important to remember 377 00:15:37,590 --> 00:15:39,900 that AppArmor is not a silver bullet, 378 00:15:39,900 --> 00:15:42,630 and it can only do so much to protect against exploits 379 00:15:42,630 --> 00:15:45,030 and malware in your application code. 380 00:15:45,030 --> 00:15:47,310 Remember, AppArmor is only as strong 381 00:15:47,310 --> 00:15:49,650 as the restricted profiles that you're creating. 382 00:15:49,650 --> 00:15:51,690 So if you create good restricted profiles, 383 00:15:51,690 --> 00:15:53,400 and you harden your applications, 384 00:15:53,400 --> 00:15:55,380 this can prevent a lot of malicious attacks 385 00:15:55,380 --> 00:15:57,030 against your enterprise networks.