| 1 | ========
|
| 2 | AppArmor
|
| 3 | ========
|
| 4 |
|
| 5 | What is AppArmor?
|
| 6 | =================
|
| 7 |
|
| 8 | AppArmor is MAC style security extension for the Linux kernel. It implements
|
| 9 | a task centered policy, with task "profiles" being created and loaded
|
| 10 | from user space. Tasks on the system that do not have a profile defined for
|
| 11 | them run in an unconfined state which is equivalent to standard Linux DAC
|
| 12 | permissions.
|
| 13 |
|
| 14 | How to enable/disable
|
| 15 | =====================
|
| 16 |
|
| 17 | set ``CONFIG_SECURITY_APPARMOR=y``
|
| 18 |
|
| 19 | If AppArmor should be selected as the default security module then set::
|
| 20 |
|
| 21 | CONFIG_DEFAULT_SECURITY_APPARMOR=y
|
| 22 |
|
| 23 | The CONFIG_LSM parameter manages the order and selection of LSMs.
|
| 24 | Specify apparmor as the first "major" module (e.g. AppArmor, SELinux, Smack)
|
| 25 | in the list.
|
| 26 |
|
| 27 | Build the kernel
|
| 28 |
|
| 29 | If AppArmor is not the default security module it can be enabled by passing
|
| 30 | ``security=apparmor`` on the kernel's command line.
|
| 31 |
|
| 32 | If AppArmor is the default security module it can be disabled by passing
|
| 33 | ``apparmor=0, security=XXXX`` (where ``XXXX`` is valid security module), on the
|
| 34 | kernel's command line.
|
| 35 |
|
| 36 | For AppArmor to enforce any restrictions beyond standard Linux DAC permissions
|
| 37 | policy must be loaded into the kernel from user space (see the Documentation
|
| 38 | and tools links).
|
| 39 |
|
| 40 | Documentation
|
| 41 | =============
|
| 42 |
|
| 43 | Documentation can be found on the wiki, linked below.
|
| 44 |
|
| 45 | Links
|
| 46 | =====
|
| 47 |
|
| 48 | Mailing List - [email protected]
|
| 49 |
|
| 50 | Wiki - http://wiki.apparmor.net
|
| 51 |
|
| 52 | User space tools - https://gitlab.com/apparmor
|
| 53 |
|
| 54 | Kernel module - git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor
|