AppArmor

From postmarketOS
Note This article is from the proof of concept of using AppArmor with postmarketOS. This is not relevant anymore, see pmaports#1596.


AppArmor will be used in postmarketOS to sandbox applications, so they don't have more rights than necessary. Integration is in development, eventually it will be enabled by default.

As of writing, profiles are stored in the postmarketos-apparmor-profiles repository. Right now this contains all AppArmor profiles in postmarketOS, there is not yet a place to store Alpine specific AppArmor profiles (this is being discussed here).

Installation

Make sure your kernel has apparmor support enabled (pmbootstrap kconfig check --apparmor). Then install apparmor and the profiles:

$ sudo apk add postmarketos-apparmor-profiles apparmor apparmor-utils
$ sudo rc-update add apparmor boot

Reboot and verify that it runs:

$ sudo aa-status
apparmor module is loaded.
2 profiles are loaded.
2 profiles are in enforce mode.
   /usr/bin/gnome-calculator
   /usr/bin/postmarketos-welcome
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
2 processes have profiles defined.
2 processes are in enforce mode.
   /usr/bin/gnome-calculator (6138) 
   /usr/bin/postmarketos-welcome (6183) 
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.

Modifying profiles

Profiles are stored in /etc/apparmor.d. See the quick guide to get an idea of how the profile language works.

After modifying a profile, reload it with:

$ sudo apparmor_parser -r /etc/apparmor.d/postmarketos-welcome-gtk3

Violations are logged to dmesg. Rules with deny cause violations not to be logged (meaning you will only find the unexpected violations in the log).

See also