Please enable JavaScript.
Coggle requires JavaScript to display documents.
🛡️ AppArmor Enterprise Linux Security Framework - Coggle Diagram
🛡️ AppArmor Enterprise Linux Security Framework
1️⃣ AppArmor Introduction
📌 Definition of AppArmor
AppArmor = Application Armor
Linux Security Module (LSM)
Mandatory Access Control (MAC) security framework
Controls what applications are allowed to access
Uses security profiles to restrict programs
Protects applications from:
Unauthorized file access
Unauthorized network access
Unauthorized execution
Privilege abuse
Malware damage
📌 Purpose of AppArmor
Reduce attack surface
Apply Principle of Least Privilege (PoLP)
Contain compromised applications
Protect critical services
Enforce security policies
Prevent unauthorized actions
📌 AppArmor Security Model
Traditional Linux Security
User permissions
Group permissions
File ownership
UNIX permissions
Read (r)
Write (w)
Execute (x)
AppArmor Adds Additional Layer
User permission says:
"User can access this file"
AppArmor says:
"Application is allowed or denied"
📌 Example
Apache Web Server
Without AppArmor
Apache compromised
Attacker may access sensitive files
With AppArmor
Apache restricted
Only allowed directories accessible
Attack impact reduced
2️⃣ Linux Security Architecture
🔐 Linux Security Layers
Layer 1
File Permissions
chmod
chown
chmod 755
Layer 2
User Authentication
PAM
Password policies
Layer 3
Privilege Control
sudo
sudoers
Layer 4
Mandatory Access Control
SELinux
AppArmor
Layer 5
Network Security
Firewall
IPTables
FirewallD
3️⃣ AppArmor Core Concepts
🧩 Mandatory Access Control (MAC)
Definition
Security policy is controlled by system administrator
Users cannot override restrictions
Example
root user can still be restricted by AppArmor
🧩 Profile
Definition
Security policy file for an application
Contains:
Allowed files
Allowed capabilities
Network permissions
Execution permissions
Example:
/etc/apparmor.d/usr.sbin.nginx
🧩 Policy
Definition
Rules that define allowed and denied actions
🧩 Enforcement Mode
Definition
Blocks unauthorized actions
🧩 Complain Mode
Definition
Logs violations but does not block
4️⃣ AppArmor Installation
🐧 Ubuntu / Debian Installation
Update system
sudo apt update
Install AppArmor packages
sudo apt install apparmor apparmor-utils apparmor-profiles apparmor-profiles-extra
Install audit tools
sudo apt install auditd audispd-plugins
🔴 RHEL / CentOS Note
SELinux is default security framework
AppArmor usually used in:
Ubuntu
Debian
SUSE Linux
5️⃣ AppArmor Important Paths
📂 Main Configuration Directory
/etc/apparmor.d/
📂 Profiles Location
/etc/apparmor.d/
📂 Parser Configuration
/etc/apparmor/
📂 Logs
/var/log/syslog
/var/log/kern.log
📂 Audit Logs
/var/log/audit/audit.log
6️⃣ AppArmor Service Management
Check service status
systemctl status apparmor
Start service
sudo systemctl start apparmor
Enable at boot
sudo systemctl enable apparmor
Restart service
sudo systemctl restart apparmor
7️⃣ AppArmor Command Line Tools
🔎 aa-status
Purpose:
Shows AppArmor status
Command:
sudo aa-status
Output shows:
Loaded profiles
Enforced profiles
Complain profiles
🔎 aa-enabled
Check if AppArmor is enabled
Command:
aa-enabled
🔎 aa-enforce
Enable blocking mode
Example:
sudo aa-enforce /etc/apparmor.d/usr.sbin.nginx
🔎 aa-complain
Enable learning mode
Example:
sudo aa-complain /etc/apparmor.d/usr.sbin.nginx
🔎 aa-disable
Disable profile
Example:
sudo aa-disable /etc/apparmor.d/usr.sbin.nginx
🔎 aa-logprof
Automatically creates rules from logs
Command:
sudo aa-logprof
🔎 aa-genprof
Create new profile
Command:
sudo aa-genprof /usr/bin/application
8️⃣ AppArmor Profile Structure
Example:
/etc/apparmor.d/usr.sbin.nginx
Profile Name
profile nginx {
File Rules
Read permission
/var/www/** r
Write permission
/var/log/nginx/** rw
Execute permission
/usr/bin/php ix
Capability Rules
capability net_bind_service
Network Rules
network inet tcp
Closing Profile
}
9️⃣ AppArmor File Permission Rules
Permission Symbols
r
Read
w
Write
x
Execute
ix
Inherit execute
px
Profile execute
ux
Unconfined execute
Example
/etc/passwd r
Application can read passwd file
/var/log/app.log rw
Application can read and write log
🔟 AppArmor Modes
🟢 Enforce Mode
Definition:
Blocks unauthorized actions
Command:
sudo aa-enforce profile_name
🟡 Complain Mode
Definition:
Allows action
Creates log entry
Command:
sudo aa-complain profile_name
🔴 Disabled Mode
Definition:
Profile not loaded
1️⃣1️⃣ Creating Custom AppArmor Profile
Step 1
Install tools
sudo apt install apparmor-utils
Step 2
Generate profile
sudo aa-genprof /usr/local/bin/myapp
Step 3
Run application
Execute normal functions
Step 4
Analyze logs
sudo aa-logprof
Step 5
Load profile
sudo apparmor_parser -r /etc/apparmor.d/myapp
1️⃣2️⃣ AppArmor with Web Servers
🌐 Apache
Profile:
/etc/apparmor.d/usr.sbin.apache2
Protect:
Website files
Configuration files
Logs
🌐 Nginx
Profile:
/etc/apparmor.d/usr.sbin.nginx
Restrictions:
Web root access
Log access
Script execution
1️⃣3️⃣ AppArmor with Database Servers
🗄️ MySQL
Protect:
Database files
Configuration
Logs
Example restrictions:
/var/lib/mysql/** rw
/etc/mysql/** r
PostgreSQL
Protect:
Database cluster
Backup files
1️⃣4️⃣ AppArmor with SSH
SSH Protection
Profile:
usr.sbin.sshd
Controls:
SSH daemon access
File access
Commands
1️⃣5️⃣ Monitoring AppArmor
Logs
journalctl
journalctl -k | grep apparmor
Syslog
grep apparmor /var/log/syslog
Audit
ausearch -m AVC
1️⃣6️⃣ Enterprise Deployment Strategy
Phase 1
Assessment
Identify critical applications
Identify risks
Collect application behavior
Phase 2
Learning Mode
Run profiles in complain mode
Collect logs
Phase 3
Policy Development
Create rules
Remove unnecessary permissions
Phase 4
Testing
Application testing
Performance testing
Phase 5
Production Deployment
Enable enforce mode
Monitor violations
1️⃣7️⃣ Enterprise Security Integration
SIEM Integration
Send logs to:
Elastic SIEM
Splunk
QRadar
Monitor:
AppArmor denied events
Policy violations
Incident Response
Detect:
Unauthorized access
Investigate:
Logs
Process
User activity
1️⃣8️⃣ AppArmor vs SELinux
AppArmor
Path based security
Easier configuration
Used by Ubuntu
Profiles stored:
/etc/apparmor.d
SELinux
Label based security
More complex
Used by RHEL
Policies stored:
/etc/selinux
1️⃣9️⃣ Enterprise Best Practices
Use Least Privilege
Enable AppArmor for critical services
Keep profiles updated
Monitor audit logs
Test before enforcement
Use change management
Integrate with SIEM
Document security policies
2️⃣0️⃣ Real Enterprise Example
Application:
Nginx Web Server
Goal:
Limit damage if compromised
Allow:
Read website files
Write logs
Deny:
Access to /etc/shadow
Execute unauthorized binaries
Modify system files
Result:
Compromised nginx remains contained
2️⃣1️⃣ AppArmor Administrator Commands Summary
Check Status
sudo aa-status
Enable Profile
sudo aa-enforce PROFILE
Learning Mode
sudo aa-complain PROFILE
Disable Profile
sudo aa-disable PROFILE
Reload Profile
sudo apparmor_parser -r PROFILE
View Logs
journalctl -k | grep apparmor
Generate Profile
sudo aa-genprof APPLICATION