Lab 33.2. Explore the apparmor Security not practicable under ubuntu 22.04?

michibr

I cannot do the lab exercise 33.2 in the described form.

Essentially there are two main issues:

Creating a new binary ping-x makes that one entirely accesible without any restrictions from apparmor as there is no global rule to block anything new.
I created a resticted file /etc/apparmor.d/usr.bin.ping-x and the digged further to allow functionallity with dmesg | grep DENIED
As the second issue aa-genprof /usr/bin/ping-x didn't do a correct job (seems like apparmor="DENIED" operation="file_mmap" is not detected correct and only given read-permissions.
So I reviewed by my own and added the neccessary permissions:

/usr/bin/ping-x {

capability net_raw,

network inet,
deny network inet6,

/etc/ld.so.cache rm,
/usr/lib/** rm,

}

followed by apparmor_parser -r /etc/apparmor.d/usr.bin.ping-x .

Then I could follow the exercise in some way. Blocking ipv6 did not work either but I did not follow that further.

Did I miss anything or is the exercise tested under openSuse which behaves otherwise?

luisviveropena

Hi @michibr,

Can you try on Ubuntu 24.04? I just tested it and I couldn't ping anything with 'ping-x'.

Regards,
Luis.

michibr

Hi @luisviveropena,

thanks for your reply. Not instantly but I will keep it in mind and try if.

Regards
Michael