<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi</p>
Apparmor hasn't a Netfilter firewall support module.<br>
<br>
Network rules is a good choice for applications that have
AA-profiles,<br>
but it does not protect unconfined processes for forbidden network<br>
outgoing connections.<br>
<br>
I mean the function of the Security netfiter tables for SElinux, but
the<br>
easy way similar to xt_gradm, part of the Grsecurity project:<br>
<a class="moz-txt-link-freetext" href="https://grsecurity.net/stable/grsecurity-2.2.0-iptables.patch">https://grsecurity.net/stable/grsecurity-2.2.0-iptables.patch</a><br>
<br>
Proposed solution (userspace):<br>
NFtables (next Linux firewall):<br>
<br>
nft insert rule ip filter output meta apparmor aapolicy unconfined
drop<br>
nft insert rule ip filter output meta apparmor aapolicy enforce
accept<br>
nft insert rule ip filter output meta apparmor aapolicy complain log
accept<br>
<br>
Iptables (current/old Linux firewall):<br>
iptables -I OUTPUT ! -o lo -m apparmor --aapolicy unconfined -j DROP<br>
iptables -A OUTPUT ! -o lo -m apparmor --aapolicy enforce -j ACCEPT<br>
iptables -A OUTPUT ! -o lo -m apparmor --aapolicy complain -j LOG<br>
--log-prefix "$PROFILE_NAME - complain: $APP_NAME"<br>
iptables -A OUTPUT ! -o lo -m apparmor --aapolicy complain -j
ACCEPT<br>
<p><br>
</p>
<p><br>
</p>
<p>Example log from LSM Integrity IMA (Apparmor Variables - enforce)</p>
<p><i>audit: type=1800 audit(1546855115.951:3766): pid=12211 uid=0
auid=1001 ses=4 subj==/bin/kmod (enforce) op=appraise_data
cause=IMA-signature-required comm="modprobe"
name="/lib64/modules/4.19.13-gt5/kernel/net/sched/sch_codel.ko"
dev="sdb1" ino=1334797 res=0</i></p>
<p><i>where:</i></p>
<p>Apparmor Profile name & policy:<i> </i><i>subj==/bin/kmod
(enforce) </i><br>
Real aplication name: <i>comm="modprobe" </i></p>
<p>AA-variables - unconfined:</p>
<p>[ 1703.396288] audit: type=1800 audit(1546855383.896:3777):
pid=12347 uid=0 auid=1001 ses=4 subj==unconfined op=appraise_data
cause=IMA-signature-required comm="modprobe"
name="/lib64/modules/4.19.13-gt5/kernel/net/sched/sch_codel.ko"
dev="sdb1" ino=1334797 res=0<br>
</p>
<p>where:</p>
<p>AA-policy: subj==unconfined</p>
<p>aplication name: comm="modprobe" <br>
</p>
<p>AA-variables - complain:</p>
<p>audit: type=1800 audit(1546855552.256:3785): pid=12402 uid=0
auid=1001 ses=4 subj==/bin/kmod (complain) op=appraise_data
cause=IMA-signature-required comm="insmod"
name="/lib64/modules/4.19.13-gt5/kernel/net/sched/sch_codel.ko"
dev="sdb1" ino=1334797 res=0<br>
</p>
<p>where:<br>
</p>
<p>AA - profile & policy: subj==/bin/kmod (complain)</p>
<p>App name: comm="insmod" <br>
</p>
I'm not a programmer, is there any chance of adding a similar module
in<br>
Apparmor?<br>
<br>
Cheers<br>
<br>
<br>
<br>
<br>
</body>
</html>