Sclinux is what you use on Red Hat and Family.
On Ubuntu, it's apparmor.
You want to know what's going on? Start by using sudo aa status that will show you the current state.
Apparmor profiles are stored in etcapparmor d and they have a name
that corresponds to the full pathname of the file that it protects.
Only if an application has an apparmor profile, it will be protected and otherwise it can do whatever it wants to do.
Now you can use sudo apparmorparser a to load a profile or r to remove a profile.
Sudo aa genprof is what you use to generate a profile for the new application.
If you want to temporarily disable a profile and put it in logging mode so
that you can optimize it, sudo aa complain followed by the name of the profile.
Then you can put it back in enforcing mode using aa enforce followed by the name of that profile.
Let me demonstrate what is going on.
Let me start by using sudo aa status.
That's the apparmor status that's giving me information about what is currently going on.
What do we see? Well, we see all the profiles that are
in enforcing mode. These are the profiles that are really effective.
So these are the protected surfaces, and you can see that a
couple of surfaces are there and many services are also not there.
Now what I would like to do, I would like to show you how you create your
own profile. And I'm going to do that in a little bit of a ridiculous way.
I'm going to create a profile for my favorite editor, vi, so that you can experience the
process and you can tweak it for yourself if you're interested and get more information about it.
Oh no, I have AA GenProf and AA GenProf is not found. Okay,
I don't have this package. Let me use sudo apt search on aajamprof.
I want to know what to install to get access to the package.
Ah, apparmorutils.
Okay, that works to do apt
install apparmorutils and yes, and then
I can use AA GenProf.
Well, sudo AA GenProf for vim. I
want to generate a profile for vim.
Now here is what we need to do. At this point, I need to leave this screen alone and I need to start using my application.
Now the idea is that in real life you would use as much as you can about the application.
Now that's not what I'm going to do. I'm going to keep it very minimal. And
I'm using vim on etc motd there I'm putting in my message and then I'm done.
Of course, normally I repeat, you want to use as much functionality as you can but here I just
want to show you how it works. So I'm okay and I'm going to scan for apparmore events.
So I'm using S and then it will find everything that has happened while using the application. So it has created a file
viminfo tmp and it's asking me what do you want? Do you want to allow that? Yeah, I want to allow that.
And it has done a write operation on etc motd Yeah, I want to allow that as well.
But before continuing, think about what is happening. If I'm going to allow that, then I can only write
to the etc motd maybe I want to go for the G option. G is for glob and glob
means that you allow write access to everything in the etc directory. Well, in fact I like that.
And I'm going to select a for allow to allow the second operation.
Here I'm continuing and I need to allow a couple more and a couple more and I'm not
even reading anymore. I want to allow as much as possible to make sure that we are okay.
Now I'm not sure if I'm okay with home read, am I? Yeah, let's do that.
I want to be able to read everywhere in the home directory. Now it's done and I can use S to save the changes.
Then I'm using F to finish and the profile is ready.
USR bin Vim basic can we see that in AA status?
AA status pipe grab C5 Vim with the sudo in front of it. Of
course there we can see that the Vim basic profile is now active.
I've used the C5 so that you can see the five lines before as well as the five lines after.
Now I'm going to use sudo vim on walt on root.
Hello there. I'm using I for insert and typing my text and
oh boy, I'm getting canned. Open file for writing. What is that?
Well, this is apparmor profile doing its work.
Now if you want to know what is going on then you need to find the profile.
They are in etcapparmor d and in etcapparmor d we can
see it right here we have user bin vim basic.
So when I use sudo nano on user bin vim basic then I
can see what is behind this. And this is the very simple configuration
that allows Vim from now on, read access to the home directory, read,
write access to anything in the etc directory and a couple more files.
And that is what you can do.
Now in real life, this would only be the beginning and you will start tweaking your
profile from here. So you would start using Vim and analyzing what is going on and
modifying your profile until it is really doing what you want it to do.
And that is how you can work with Apparmor in a nutshell.