AppArmor : Create Profiles : aa-genprof2026/06/11 |
|
Create a profile for a program with [aa-genprof] command. |
|
| [1] | For example, create a test script and also create a profile for it to run normally. |
|
# create a test script
root@dlp:~# cat > /usr/local/bin/nodejs_test.js <<'EOF'
var http = require('http');
var server = http.createServer(function(req, res) {
res.write("Hello, This is the Node.js Simple Web Server!\n");
res.end();
}).listen(8080);
EOF
root@dlp:~# node /usr/local/bin/nodejs_test.js & [1] 13953 root@dlp:~# curl localhost:8080 Hello, This is the Node.js Simple Web Server!
root@dlp:~#
kill 13953 # create a profile for it above root@dlp:~# aa-genprof /usr/bin/node
Updating AppArmor profiles in /etc/apparmor.d.
Writing updated profile for /usr/bin/node.
Setting /usr/bin/node to complain mode.
Before you begin, you may wish to check if a
profile already exists for the application you
wish to confine. See the following wiki page for
more information:
https://gitlab.com/apparmor/apparmor/wikis/Profiles
Profiling: /usr/bin/node
Please start the application to be profiled in
another window and exercise its functionality now.
Once completed, select the "Scan" option below in
order to scan the system logs for AppArmor events.
For each AppArmor event, you will be given the
opportunity to choose whether the access should be
allowed or denied.
[(S)can system log for AppArmor events] / (F)inish
Setting /usr/bin/node to enforce mode.
# stdout stops here
# it needs to operate all required operations for the target application on another terminal
# to log required operations in a logfile,
# after finishing all required operations, push [f(F)] key to finish,
# then [aa-genprof] finishes
Reloaded AppArmor profiles in enforce mode.
Please consider contributing your new profile!
See the following wiki page for more information:
https://gitlab.com/apparmor/apparmor/wikis/Profiles
Finished generating profile for /usr/bin/node.
# for the case with [aa-genprof], target app will be entered in [enforce] mode control root@dlp:~# aa-status apparmor module is loaded. 182 profiles are loaded. 106 profiles are in enforce mode. /usr/bin/man /usr/bin/node /usr/lib/snapd/snap-confine /usr/lib/snapd/snap-confine//mount-namespace-capture-helper /usr/sbin/chronyd alsamixer babeld ..... ..... # created profile root@dlp:~# cat /etc/apparmor.d/usr.bin.node
# Last Modified: Fri Aug 15 11:17:19 2025
abi <abi/4.0>,
include <tunables/global>
/usr/bin/node {
include <abstractions/base>
/usr/bin/node mr,
}
# start the application # * if all required operations are not learned by logs, some errors occur root@dlp:~# node /usr/local/bin/nodejs_test.js Cannot load externalized builtin: "internal/deps/cjs-module-lexer/lexer:/usr/share/nodejs/cjs-module-lexer/lexer.js". ----- Native stack trace ----- 1: 0x75cb72ea4975 node::builtins::BuiltinLoader::AddExternalizedBuiltin(char const*, char const*) [/usr/lib/x86_64-linux-gnu/libnode.so.127] 2: 0x75cb72ea4b73 node::builtins::BuiltinLoader::BuiltinLoader() [/usr/lib/x86_64-linux-gnu/libnode.so.127] ..... ..... # if target app does not run normally, change it to [complain] mode and operate it again to learn all root@dlp:~# aa-complain /usr/bin/node Setting /usr/bin/node to complain mode. root@dlp:~# node /usr/local/bin/nodejs_test.js & [1] 1830 root@dlp:~# curl localhost:8080 Hello, This is the Node.js Simple Web Server!
root@dlp:~#
kill 1830
# read unauthorized actions in logs # logs are recorded in [/var/log/audit/audit.log] if Auditd is running # if Auditd is not installed, logs are recorded in [/var/log/syslog] root@dlp:~# aa-logprof Updating AppArmor profiles in /etc/apparmor.d. Reading log entries from /var/log/audit/audit.log. Complain-mode changes: Profile: /usr/bin/node Capability: ipc_lock Severity: 8 [1 - include <abstractions/nvidia>] 2 - capability ipc_lock, (A)llow / [(D)eny] / (I)gnore / Audi(t) / Abo(r)t / (F)inish # set policy to the unauthorized action Adding include <abstractions/nvidia> to profile. Profile: /usr/bin/node Capability: dac_override Severity: 9 [1 - capability dac_override,] (A)llow / [(D)eny] / (I)gnore / Audi(t) / Abo(r)t / (F)inish # select all in the same way below ..... ..... = Changed Local Profiles = The following local profiles were changed. Would you like to save them? [1 - /usr/bin/node] (S)ave Changes / Save Selec(t)ed Profile / [(V)iew Changes] / View Changes b/w (C)lean profiles / Abo(r)t Writing updated profile for /usr/bin/node. # back to the [enforce] mode and verify target app runs normally root@dlp:~# aa-enforce /usr/bin/node root@dlp:~# node /usr/local/bin/nodejs_test.js & [1] 1919 root@dlp:~# curl localhost:8080 Hello, This is the Node.js Simple Web Server!
root@dlp:~#
kill 1919
# completed profile for the app root@dlp:~# cat /etc/apparmor.d/usr.bin.node
# Last Modified: Thu Jun 11 00:28:09 2026
abi <abi/5.0>,
include <tunables/global>
/usr/bin/node {
include <abstractions/apache2-common>
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nvidia>
capability dac_override,
/usr/bin/node mr,
owner /proc/*/cgroup r,
owner /proc/version_signature r,
owner /sys/fs/cgroup/user.slice/user-0.slice/session-1.scope/memory.high r,
owner /sys/fs/cgroup/user.slice/user-0.slice/session-1.scope/memory.max r,
owner /sys/fs/cgroup/user.slice/user-1000.slice/session-3.scope/memory.high r,
owner /sys/fs/cgroup/user.slice/user-1000.slice/session-3.scope/memory.max r,
owner /usr/local/bin/nodejs_test.js r,
owner /usr/share/nodejs/acorn-walk/dist/walk.js r,
owner /usr/share/nodejs/acorn/dist/acorn.js r,
owner /usr/share/nodejs/cjs-module-lexer/dist/lexer.js r,
owner /usr/share/nodejs/cjs-module-lexer/lexer.js r,
owner /usr/share/nodejs/minimatch/dist/cjs/index.bundle.js r,
owner /usr/share/nodejs/undici/undici-fetch.js r,
}
|
| Sponsored Link |
|
|