systeme:apparmor
Différences
Ci-dessous, les différences entre deux révisions de la page.
Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
systeme:apparmor [2015/08/15 09:23] – [Type de permission] root | systeme:apparmor [2016/10/08 16:34] (Version actuelle) – [Liens] root | ||
---|---|---|---|
Ligne 1: | Ligne 1: | ||
====== Apparmor ====== | ====== Apparmor ====== | ||
===== Liens ===== | ===== Liens ===== | ||
+ | * [[http:// | ||
* [[https:// | * [[https:// | ||
+ | * [[https:// | ||
===== Description ===== | ===== Description ===== | ||
AppArmor permet à l' | AppArmor permet à l' | ||
====== Type de permission ====== | ====== Type de permission ====== | ||
+ | * [[http:// | ||
+ | |||
* **r** : Read mode | * **r** : Read mode | ||
* **w** : Write mode (mutually exclusive to a) | * **w** : Write mode (mutually exclusive to a) | ||
* **a** : Append mode (mutually exclusive to w) | * **a** : Append mode (mutually exclusive to w) | ||
* **k** : File locking mode | * **k** : File locking mode | ||
- | * **px** : Discrete | + | |
- | * **Px** : Discrete | + | * **ux** : Execute unconfined (preserve environment) -- WARNING: should only be used in very special cases |
- | * **ux** : Unconstrained execute mode | + | * **Ux** : Execute unconfined (scrub the environment) |
- | * **Ux** : Unconstrained execute mode—clean exec | + | |
- | * **ix** : Inherit execute mode | + | * **Px** : Execute under a specific |
+ | * **pix** : as px but fallback to inheriting the current profile if the target profile is not found | ||
+ | * **Pix** : as Px but fallback to inheriting the current profile if the target profile is not found | ||
+ | * **pux** : as px but fallback to executing unconfined if the target profile is not found | ||
+ | * **Pux** : as Px but fallback to executing unconfined if the target profile is not found | ||
+ | | ||
+ | * **cx** : Execute and transition to a child profile (preserve the environment) | ||
+ | * **Cx** : Execute and transition to a child profile (scrub the environment) | ||
+ | * **cix** : as cx but fallback to inheriting the current profile if the target profile is not found | ||
+ | * **Cix** : as Cx but fallback to inheriting the current profile if the target profile is not found | ||
+ | * **cux** : as cx but fallback to executing unconfined if the target profile is not found | ||
+ | * **Cux** : as Cx but fallback to executing unconfined if the target profile is not found | ||
* **m** : Allow PROT_EXEC with mmap(2) calls | * **m** : Allow PROT_EXEC with mmap(2) calls | ||
* **l** : Link mode | * **l** : Link mode | ||
+ | |||
+ | * **audit** : force logging | ||
+ | * **deny** : explicitly deny, without logging | ||
+ | * **audit deny** : combination to explicitly deny, but log | ||
+ | * **quiet** : clears audit qualifier off of rules. Does it take precedence over audit like deny over allow | ||
< | < | ||
Ligne 29: | Ligne 48: | ||
</ | </ | ||
+ | * **alias** : crée un mapping | ||
+ | < | ||
+ | alias /home/ -> /mnt/users/ | ||
+ | </ | ||
+ | |||
+ | * **owner** : autorise seulement si le propriétaire de la tache est le même que celui du fichier : | ||
+ | < | ||
+ | owner /foo r, | ||
+ | </ | ||
+ | |||
+ | < | ||
+ | owner=fred | ||
+ | owner=1001 | ||
+ | owner=(fred) | ||
+ | owner=(fred george) | ||
+ | owner=(fred 1001) | ||
+ | </ | ||
+ | |||
+ | * **Child profile (cx)** : | ||
+ | < | ||
+ | / | ||
+ | |||
+ | / | ||
+ | / | ||
+ | / | ||
+ | # child4, child5, ... will transition to / | ||
+ | # if matching child profile does not exist will fail | ||
+ | / | ||
+ | |||
+ | | ||
+ | |||
+ | } | ||
+ | |||
+ | | ||
+ | |||
+ | } | ||
+ | |||
+ | | ||
+ | |||
+ | } | ||
+ | |||
+ | # generic fall back profile | ||
+ | | ||
+ | |||
+ | } | ||
+ | } | ||
+ | </ | ||
====== Activer apparmor ====== | ====== Activer apparmor ====== | ||
< | < | ||
Ligne 110: | Ligne 176: | ||
===== apparmor_parser ===== | ===== apparmor_parser ===== | ||
+ | * Voir ce qu'il y a de charger dans le profil apache2 : | ||
+ | < | ||
+ | $ apparmor_parser -Q --debug / | ||
+ | </ | ||
+ | |||
+ | < | ||
+ | $ apparmor_parser -p / | ||
+ | </ | ||
+ | |||
* Recharger le profile ping : | * Recharger le profile ping : | ||
< | < | ||
$ apparmor_parser -r / | $ apparmor_parser -r / | ||
</ | </ |
systeme/apparmor.1439630591.txt.gz · Dernière modification : 2015/08/15 09:23 de root