AppArmor : Create Profiles : aa-autodep2026/06/11

Create a profile for a program with [aa-autodep] command.

The different point from [aa-genprof] is that [aa-autodep] creates an empty profile and finish at once, and then target program is entered in [complain] mode control.

[1]

For example, create a profile for Samba with [aa-autodep] command.

# create a profile for Samba

root@dlp:~#

aa-autodep /usr/sbin/smbd

Writing updated profile for /usr/sbin/smbd.

# it is entered in [complain] mode

root@dlp:~#

aa-status

apparmor module is loaded.
107 profiles are loaded.
7 profiles are in enforce mode.
   /usr/bin/man
   /usr/bin/node
   lsb_release
   man_filter
   man_groff
   nvidia_modprobe
   nvidia_modprobe//kmod
24 profiles are in complain mode.
   /usr/sbin/smbd
.....
.....

# after this, it needs to learn required operations in [complain] mode
# for large scale application like Samba, it needs to learn many required operations
# in logs for a long time, maybe in a few months

# set policy for each unauthorized action in logs step by step

root@dlp:~#

aa-logprof

Updating AppArmor profiles in /etc/apparmor.d.
Reading log entries from /var/log/audit/audit.log.
Complain-mode changes:

Profile:    /usr/sbin/smbd
Capability: setuid
Severity:   9

 [1 - include <abstractions/postfix-common>]
  2 - include <abstractions/samba-rpcd>
  3 - capability setuid,
(A)llow / [(D)eny] / (I)gnore / Audi(t) / Abo(r)t / (F)inish
Adding include <abstractions/postfix-common> to profile.

Profile:    /usr/sbin/smbd
Capability: net_admin
Severity:   8

 [1 - capability net_admin,]
(A)llow / [(D)eny] / (I)gnore / Audi(t) / Abo(r)t / (F)inish

.....
.....

# if profile is completed finally, move to [enforce] mode to protect target app

root@dlp:~#

aa-enforce /usr/sbin/smbd

[2]	By the way, it uses Samba as an example to create a profile with [aa-autodep] on here, though, however some profiles are provided as a package for well known and often used applications like Samba.

root@dlp:~#

apt -y install apparmor-profiles

root@dlp:~#

dpkg -L apparmor-profiles

/.
/etc
/etc/apparmor.d
/etc/apparmor.d/apache2.d
/etc/apparmor.d/apache2.d/phpsysinfo
/etc/apparmor.d/bin.ping
/etc/apparmor.d/local
/etc/apparmor.d/php-fpm
/etc/apparmor.d/samba-bgqd
/etc/apparmor.d/samba-dcerpcd
/etc/apparmor.d/samba-rpcd
/etc/apparmor.d/samba-rpcd-classic
/etc/apparmor.d/samba-rpcd-spoolss
/etc/apparmor.d/sbin.klogd
/etc/apparmor.d/sbin.syslog-ng
.....
.....

root@dlp:~#

aa-status

apparmor module is loaded.
203 profiles are loaded.
127 profiles are in enforce mode.
   /usr/bin/man
   /usr/bin/node
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/chronyd
   alsamixer
   avahi-daemon
   babeld
   bfdd
   bgpd
   bwrap
   dig
.....
.....

Matched Content