Lab 33.2. Explore the apparmor Security. /bin/ping-x works executed as ubuntu user in EC2 instance
Hello there,
After copying /bin/ping
to /bing/ping-x
I still can run /bin/ping-x
as the ubuntu user:
- $ sudo cp /bin/ping /bin/ping-x
- $ sudo ls -l /bin/ping-x
- -rwxr-xr-x 1 root root 76672 Apr 12 10:03 /bin/ping-x
- $ sudo getcap /bin/ping-x
- $ ping-x -c3 -4 127.0.0.1
- PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
- 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.037 ms
- 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.023 ms
- 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.027 ms
- --- 127.0.0.1 ping statistics ---
- 3 packets transmitted, 3 received, 0% packet loss, time 2035ms
- rtt min/avg/max/mdev = 0.023/0.029/0.037/0.005 ms
apparmor is loaded:
- $ sudo apparmor_status
- apparmor module is loaded.
- $ systemctl status apparmor
- ● apparmor.service - Load AppArmor profiles
- Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor preset: enabled)
- Active: active (exited) since Fri 2024-04-12 09:59:51 UTC; 12min ago
- Docs: man:apparmor(7)
- https://gitlab.com/apparmor/apparmor/wikis/home/
- Main PID: 220 (code=exited, status=0/SUCCESS)
- CPU: 962ms
The ubuntu user looks like this:
- $ whoami
- ubuntu
- $ groups
- ubuntu adm dialout cdrom floppy sudo audio dip video plugdev netdev lxd
- $ sudo -l -U ubuntu
- Matching Defaults entries for ubuntu on ip-172-31-7-104:
- env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
- User ubuntu may run the following commands on ip-172-31-7-104:
- (ALL : ALL) ALL
- (ALL) NOPASSWD: ALL
And my system:
- $ lsb_release -a
- No LSB modules are available.
- Distributor ID: Ubuntu
- Description: Ubuntu 22.04.4 LTS
- Release: 22.04
- Codename: jammy
- $ uname -a
- Linux ip-172-31-7-104 6.5.0-1014-aws #14~22.04.1-Ubuntu SMP Thu Feb 15 15:27:06 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Probably I must be missing something
Thanks in advance,
Luis
ps: I must to admit that I did not try yet neither in my personal laptop nor in a VM
Comments
-
Hi @lurodrig,
I tried in a cloud VM as well. I also tried in a local VM, and it worked. The only difference is that I used Ubuntu 23.10. Can you try on that OS and version, please? Just to check if this would be related to a specific OS version.
devopsn3rd@ubuntu23:~$ sudo systemctl status apparmor
● apparmor.service - Load AppArmor profiles
Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; preset: enabled)
Active: active (exited) since Wed 2024-04-17 14:30:05 UTC; 5min ago
Docs: man:apparmor(7)
https://gitlab.com/apparmor/apparmor/wikis/home/
Main PID: 263 (code=exited, status=0/SUCCESS)
CPU: 1.241sApr 17 14:30:05 ubuntu systemd[1]: Starting apparmor.service - Load AppArmor profiles...
Apr 17 14:30:05 ubuntu apparmor.systemd[263]: Restarting AppArmor
Apr 17 14:30:05 ubuntu apparmor.systemd[263]: Reloading AppArmor profiles
Apr 17 14:30:05 ubuntu systemd[1]: Finished apparmor.service - Load AppArmor profiles.devopsn3rd@ubuntu23:~$ id
uid=1001(devopsn3rd) gid=1002(devopsn3rd) groups=1002(devopsn3rd),4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),115(netdev),116(lxd),1000(ubuntu),1001(google-sudoers)devopsn3rd@ubuntu23:~$ ping google.com
PING google.com (172.217.219.101) 56(84) bytes of data.
64 bytes from je-in-f101.1e100.net (172.217.219.101): icmp_seq=1 ttl=115 time=1.66 ms
64 bytes from je-in-f101.1e100.net (172.217.219.101): icmp_seq=2 ttl=115 time=1.15 ms
^C
--- google.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 1.145/1.402/1.659/0.257 msdevopsn3rd@ubuntu23:~$ ping -c 3 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.025 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.043 ms
^C
--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1010ms
rtt min/avg/max/mdev = 0.025/0.034/0.043/0.009 msdevopsn3rd@ubuntu23:~$ sudo cp /bin/ping /bin/ping-x
devopsn3rd@ubuntu23:~$ sudo getcap /bin/ping
/bin/ping cap_net_raw=epdevopsn3rd@ubuntu23:~$ sudo getcap /bin/ping-x
devopsn3rd@ubuntu23:~$
devopsn3rd@ubuntu23:~$ ping-x google.com
ping-x: socktype: SOCK_RAW
ping-x: socket: Operation not permitted
ping-x: => missing cap_net_raw+p capability or setuid?devopsn3rd@ubuntu23:~$ cat /etc/os-release
PRETTY_NAME="Ubuntu 23.10"
NAME="Ubuntu"
VERSION_ID="23.10"
VERSION="23.10 (Mantic Minotaur)"
VERSION_CODENAME=mantic
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=mantic
LOGO=ubuntu-logoSo, it worked for me and I was unable to reproduce the issue.
Regards,
Luis.1 -
Hello @luisviveropena
Thank you very much for your answer and sorry for the delay in my response.
You are right, in a fresh EC2 instance with ubuntu 24.04 it works.
Thank you very much,
Cheers,
Luis
1 -
0
Categories
- All Categories
- 167 LFX Mentorship
- 167 LFX Mentorship: Linux Kernel
- 802 Linux Foundation IT Professional Programs
- 358 Cloud Engineer IT Professional Program
- 181 Advanced Cloud Engineer IT Professional Program
- 82 DevOps Engineer IT Professional Program
- 127 Cloud Native Developer IT Professional Program
- 112 Express Training Courses
- 112 Express Courses - Discussion Forum
- 6.3K Training Courses
- 24 LFC110 Class Forum - Discontinued
- 17 LFC131 Class Forum
- 42 LFD102 Class Forum
- 198 LFD103 Class Forum
- 19 LFD110 Class Forum
- 41 LFD121 Class Forum
- 15 LFD133 Class Forum
- 7 LFD134 Class Forum
- 17 LFD137 Class Forum
- 63 LFD201 Class Forum
- 3 LFD210 Class Forum
- 2 LFD210-CN Class Forum
- 2 LFD213 Class Forum - Discontinued
- 128 LFD232 Class Forum - Discontinued
- 1 LFD233 Class Forum
- 2 LFD237 Class Forum
- 23 LFD254 Class Forum
- 649 LFD259 Class Forum
- 109 LFD272 Class Forum
- 3 LFD272-JP クラス フォーラム
- 12 LFD273 Class Forum
- 161 LFS101 Class Forum
- 1 LFS111 Class Forum
- 1 LFS112 Class Forum
- 3 LFS116 Class Forum
- 1 LFS118 Class Forum
- LFS120 Class Forum
- 1 LFS142 Class Forum
- 7 LFS144 Class Forum
- 3 LFS145 Class Forum
- 1 LFS146 Class Forum
- 2 LFS148 Class Forum
- 2 LFS151 Class Forum
- 1 LFS157 Class Forum
- 1 LFS158 Class Forum
- 10 LFS162 Class Forum
- 2 LFS166 Class Forum
- 1 LFS167 Class Forum
- 1 LFS170 Class Forum
- 1 LFS171 Class Forum
- 1 LFS178 Class Forum
- 3 LFS180 Class Forum
- 2 LFS182 Class Forum
- 1 LFS183 Class Forum
- 29 LFS200 Class Forum
- 736 LFS201 Class Forum - Discontinued
- 2 LFS201-JP クラス フォーラム
- 14 LFS203 Class Forum
- 135 LFS207 Class Forum
- 1 LFS207-DE-Klassenforum
- 1 LFS207-JP クラス フォーラム
- 301 LFS211 Class Forum
- 56 LFS216 Class Forum
- 48 LFS241 Class Forum
- 48 LFS242 Class Forum
- 37 LFS243 Class Forum
- 12 LFS244 Class Forum
- LFS245 Class Forum
- LFS246 Class Forum
- LFS248 Class Forum
- 43 LFS250 Class Forum
- 1 LFS250-JP クラス フォーラム
- LFS251 Class Forum
- 141 LFS253 Class Forum
- LFS254 Class Forum
- LFS255 Class Forum
- 9 LFS256 Class Forum
- 1 LFS257 Class Forum
- 1.3K LFS258 Class Forum
- 9 LFS258-JP クラス フォーラム
- 111 LFS260 Class Forum
- 149 LFS261 Class Forum
- 41 LFS262 Class Forum
- 82 LFS263 Class Forum - Discontinued
- 15 LFS264 Class Forum - Discontinued
- 11 LFS266 Class Forum - Discontinued
- 20 LFS267 Class Forum
- 18 LFS268 Class Forum
- 29 LFS269 Class Forum
- 5 LFS270 Class Forum
- 199 LFS272 Class Forum
- 1 LFS272-JP クラス フォーラム
- LFS147 Class Forum
- LFS274 Class Forum
- 3 LFS281 Class Forum
- LFW111 Class Forum
- 256 LFW211 Class Forum
- 182 LFW212 Class Forum
- 10 SKF100 Class Forum
- SKF200 Class Forum
- 1 SKF201 Class Forum
- 782 Hardware
- 198 Drivers
- 68 I/O Devices
- 37 Monitors
- 104 Multimedia
- 174 Networking
- 87 Printers & Scanners
- 83 Storage
- 743 Linux Distributions
- 80 Debian
- 66 Fedora
- 15 Linux Mint
- 13 Mageia
- 23 openSUSE
- 148 Red Hat Enterprise
- 31 Slackware
- 13 SUSE Enterprise
- 348 Ubuntu
- 468 Linux System Administration
- 39 Cloud Computing
- 70 Command Line/Scripting
- Github systems admin projects
- 90 Linux Security
- 77 Network Management
- 101 System Management
- 46 Web Management
- 55 Mobile Computing
- 17 Android
- 28 Development
- 1.2K New to Linux
- 1K Getting Started with Linux
- 373 Off Topic
- 115 Introductions
- 169 Small Talk
- 23 Study Material
- 507 Programming and Development
- 304 Kernel Development
- 204 Software Development
- 1.1K Software
- 211 Applications
- 180 Command Line
- 3 Compiling/Installing
- 405 Games
- 317 Installation
- 59 All In Program
- 59 All In Forum
Upcoming Training
-
August 20, 2018
Kubernetes Administration (LFS458)
-
August 20, 2018
Linux System Administration (LFS301)
-
August 27, 2018
Open Source Virtualization (LFS462)
-
August 27, 2018
Linux Kernel Debugging and Security (LFD440)