Hello,
I just found out nobody pointed me to art_apparmor_quick.xml in the SLE
doc. I just accidently ;-) found it - and as always when I first touch
something, it breaks into its parts ;-)
For details, see the attached review patch (for SVN r12170)
Regards,
Christian Boltz
--
Eine Sig ist genauso überflüssig wie beim Einkaufen die Hose. In
irgendeinem abstrakten Sinne käme man natürlich ohne aus, wenn man
sein Portemonnaie in die Jeansjacke steckt. Aber es wäre mächtig
kühl, und man hätte das unangenehme Gefühl, daß untenrum irgendwas
Wichtiges fehlt. [Peter `g' Bouillon in dafu]
Index: art_apparmor_quick.xml
===================================================================
--- art_apparmor_quick.xml (Revision 12170)
+++ art_apparmor_quick.xml (Arbeitskopie)
@@ -12,6 +12,7 @@
<article lang="en" id="art.aaquick">
<?suse-quickstart color="suse"?>
<title>&aa; (2.3.1) Quick Start</title>
+ <!-- ^^^^^ translated: needs an update ;-) -->
<articleinfo>
<productnumber>&productnumber;</productnumber><productname>&productname;</productname>
</articleinfo>
@@ -24,6 +25,7 @@
&aa; &yast; modules, which can be used either in graphical or ncurses
mode. The same functionality is provided by the &aa; command line tools
or by editing the profiles in a text editor.
+<!-- YaST has less features nowadays -->
</para>
</abstract>
<sect1 id="sec.aaquick.modes">
@@ -60,7 +62,7 @@
Use the <command>systemctl</command> command with one of the following
parameters:
</para>
-
+<!-- this would probably be less confusing if you add "systemctl" at each of the <option>s -->
<variablelist>
<varlistentry>
<term><option>start apparmor.service</option>
@@ -80,6 +82,7 @@
<listitem>
<para>
Unmount securityfs, and invalidate profiles.
+<!-- this also makes running processes unconfined -->
</para>
</listitem>
</varlistentry>
@@ -99,6 +102,7 @@
<para>
If &aa; is enabled, output how many profiles are loaded in complain or
enforce mode.
+<!-- systemctl output is different, text update needed (and BTW, "rcapparmor status" still does what the text describes) -->
</para>
</listitem>
</varlistentry>
@@ -110,6 +114,7 @@
<option>start</option> and <option>stop</option> options to toggle the
status of the <systemitem class="daemon">aa-eventd</systemitem> and check
its status using <option>status</option>.
+<!-- aa-eventd no longer exists - please drop this paragraph -->
</para>
</sect1>
<sect1 id="sec.aaquick.cmdline">
@@ -117,10 +122,10 @@
<variablelist>
<varlistentry>
- <term>autodep</term>
+ <term>aa-autodep</term>
<listitem>
<para>
- Guess basic &aa; profile requirements. autodep creates a stub profile
+ Guess basic &aa; profile requirements. aa-autodep creates a stub profile
for the program or application examined. The resulting profile is
called <quote>approximate</quote> because it does not necessarily
contain all of the profile entries that the program needs in order to
@@ -129,7 +134,7 @@
</listitem>
</varlistentry>
<varlistentry>
- <term>complain</term>
+ <term>aa-complain</term>
<listitem>
<para>
Set an &aa; profile to complain mode.
@@ -142,7 +147,7 @@
</listitem>
</varlistentry>
<varlistentry>
- <term>enforce</term>
+ <term>aa-enforce</term>
<listitem>
<para>
Set an &aa; profile to enforce mode from complain mode.
@@ -155,21 +160,21 @@
</listitem>
</varlistentry>
<varlistentry>
- <term>genprof</term>
+ <term>aa-genprof</term>
<listitem>
<para>
Generate or update a profile. When running, you must specify a program
- to profile. If the specified program is not an absolute path, genprof
+ to profile. If the specified program is not an absolute path, aa-genprof
searches the <envar>$PATH</envar> variable. If a profile does not
- exist, genprof creates one using autodep.
+ exist, aa-genprof creates one using aa-autodep.
</para>
</listitem>
</varlistentry>
<varlistentry>
- <term>logprof</term>
+ <term>aa-logprof</term>
<listitem>
<para>
- Manage &aa; profiles. logprof is an interactive tool used to review
+ Manage &aa; profiles. aa-logprof is an interactive tool used to review
the learning or complain mode output found in the &aa; syslog entries
and to generate new entries in &aa; profiles.
</para>
@@ -176,7 +181,7 @@
</listitem>
</varlistentry>
<varlistentry>
- <term>unconfined</term>
+ <term>aa-unconfined</term>
<listitem>
<para>
Output a list of processes with open TCP or UDP ports that do not have
@@ -194,7 +199,7 @@
<term>Stand-Alone Profiling</term>
<listitem>
<para>
- Using genprof. Suitable for profiling small applications.
+ Using aa-genprof. Suitable for profiling small applications.
</para>
</listitem>
</varlistentry>
@@ -212,12 +217,13 @@
<listitem>
<para>
Create profiles for the individual programs that make up your
- application (autodep).
+ application (aa-autodep).
</para>
</listitem>
<listitem>
<para>
Put relevant profiles into learning or complain mode.
+ <!-- "... into complain mode." is less confusing -->
</para>
</listitem>
<listitem>
@@ -227,7 +233,7 @@
</listitem>
<listitem>
<para>
- Analyze the log (logprof).
+ Analyze the log (aa-logprof).
</para>
</listitem>
<listitem>
@@ -259,7 +265,8 @@
<title>Learning Mode</title>
<para>
- When using genprof, logprof, or &yast; in learning mode, you get several
+ When using aa-genprof or aa-logprof in learning mode, you get several
+ <!-- I'd remove "in learning mode" - it's also valid for enforce mode -->
options for how to proceed:
</para>
@@ -305,7 +312,7 @@
<para>
Enable editing of the highlighted line. The new (edited) line appears
at the bottom of the list. This option is called
- <guimenu>New</guimenu> in the logprof and genprof command line tools.
+ <guimenu>New</guimenu> in the aa-logprof and aa-genprof command line tools.
</para>
</listitem>
</varlistentry>
@@ -313,7 +320,7 @@
<term>Abort</term>
<listitem>
<para>
- Abort logprof or &yast;, losing all rule changes entered so far and
+ Abort logprof, losing all rule changes entered so far and
leaving all profiles unmodified.
</para>
</listitem>
@@ -322,7 +329,7 @@
<term>Finish</term>
<listitem>
<para>
- Close logprof or &yast;, saving all rule changes entered so far and
+ Close logprof, saving all rule changes entered so far and
modifying all profiles.
</para>
</listitem>
@@ -341,7 +348,7 @@
network inet tcp,
capability setgid,
- /bin/mount ux,
+ /bin/mount Ux,
/dev/{,u}random r,
/etc/ld.so.cache r,
/etc/foo/* r,
@@ -350,8 +357,8 @@
/proc/[0-9]** r,
/usr/lib/** mr,
/tmp/ r,
- /tmp/foo.pid wr,
- /tmp/foo.* lrw,
+ /tmp/foo.pid rw,
+ /tmp/foo.* rwl,
/@{HOME}/.foo_file rw,
/@{HOME}/.foo_lock kw,
@@ -359,8 +366,8 @@
deny /etc/shadow w,
owner /home/*/** rw,
- /usr/bin/foobar cx,
- /bin/** px -> bin_generic
+ /usr/bin/foobar Cx,
+ /bin/** Px -> bin_generic
# comment on foo's local profile, foobar.
foobar {
@@ -428,6 +435,8 @@
...
# chrooted applications
@{CHROOT_BASE}/var/lib/*/dev/log w,
+<!-- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ looks like a bad example, typically /var/lib/* is
+ the chroot, and the log socket is /dev/log (from "inside the chroot" POV) -->
@{CHROOT_BASE}/var/log/** w,
...
}</screen>
@@ -450,9 +459,9 @@
&aa; provides network access mediation based on network domain and type:
</para>
<screen>/bin/ping {
-network inet dgram,
-network inet raw,
-...
+ network inet dgram,
+ network inet raw,
+ ...
}</screen>
<para>
The example would allow IPv4 network access of the datagram and raw type
@@ -592,6 +601,7 @@
rule, the resulting permissions will be that of the regular file rule.
</para>
</sect2>
+<!-- "other" and "audit" are missing -->
<sect2 id="sec.aaquick.profile_structure.exec">
<title>Rules: Defining Execute Permissions</title>
@@ -654,6 +664,7 @@
<para>
Requires that a separate profile exists for the executed program.
Use <literal>Px</literal> to make use of environment scrubbing.
+<!-- I'd write it the other way round - highlight Px and then mention px as evil alternative -->
</para>
</entry>
</row>
@@ -661,6 +672,7 @@
<entry>
<para>
Local profile
+ <!-- "child profile"? -->
</para>
</entry>
<entry>
@@ -672,6 +684,7 @@
<para>
Requires that a local profile exists for the executed program. Use
<literal>Cx</literal> to make use of environment scrubbing.
+<!-- I'd write it the other way round - highlight Cx and then mention cx as evil alternative -->
</para>
</entry>
</row>
@@ -678,7 +691,7 @@
<row>
<entry>
<para>
- Unconstrained
+ Unconfined
</para>
</entry>
<entry>
@@ -689,8 +702,9 @@
<entry>
<para>
Executes the program without a profile. Avoid running programs in
- unconstrained or unconfined mode for security reasons. Use
+ <!-- unconstrained or --> unconfined mode for security reasons. Use
<literal>Ux</literal> to make use of environment scrubbing.
+<!-- I'd write it the other way round - highlight Ux and then mention ux as evil alternative -->
</para>
</entry>
</row>
@@ -732,6 +746,7 @@
<command>ld.so(8)</command> man page.
</para>
</sect2>
+<!-- should fall back modes like Pix be mentioned here? -->
<sect2 id="sec.aaquick.profile_structure.pathnames_globbing">
<title>Rules: Paths and Globbing</title>
@@ -766,6 +781,7 @@
<listitem>
<para>
Give read access to any directories below <filename>/some</filename>.
+ <!-- (but not to any file) -->
</para>
</listitem>
</varlistentry>
@@ -854,6 +870,7 @@
<entry>
<para>
<literal>[ abc ]</literal>
+ <!-- I'd guess that this example also allows spaces ;-) -->
</para>
</entry>
<entry>
@@ -867,6 +884,7 @@
<entry>
<para>
<literal>[ a-c ]</literal>
+ <!-- I'd guess that this example also allows spaces ;-) -->
</para>
</entry>
<entry>
@@ -880,6 +898,7 @@
<entry>
<para>
<literal>{ ab,cd }</literal>
+ <!-- I'd guess that this example allows " ab" and "cd " ;-) -->
</para>
</entry>
<entry>
@@ -893,6 +912,7 @@
<entry>
<para>
<literal>[ ^a ]</literal>
+ <!-- again, remove the spaces (with ^ not being the first char, this could in theory allow space, ^ and a) -->
</para>
</entry>
<entry>
@@ -952,6 +972,7 @@
during execution. Currently the packages
<systemitem class="resource">apache2-mod_apparmor</systemitem> and
<systemitem class="resource">tomcat_apparmor</systemitem> utilize
+<!-- tomcat_apparmor is not really maintained, remove it? -->
ChangeHat to provide sub-process confinement for the Apache Web server
and the Tomcat servlet container.
</para>
@@ -974,9 +995,14 @@
available at
<ulink
url="http://developer.novell.com/wiki/index.php/Apparmor_RBAC_in_version_2.3"/>.
+ <!-- dead link! (change to wiki.apparmor.net) -->
</para>
</sect1>
<!--
+why is this section commented out? If you s/Subdomain.vim/apparmor.vim/ it looks valid
+(maybe the headline should mention "syntax highlighting in vim")
+Note: I don't know anything about sitar, so double-check if you also re-enable the section about it)
+
<sect1 id="sec.aaquick.additions">
<title>Helpful Additions</title>
@@ -994,6 +1020,9 @@
<para>
#include lines that pull in other &aa; rules and comments that begin
with <literal>#</literal>
+
+#include lines have a different color
+
</para>
</listitem>
</varlistentry>
@@ -1026,6 +1055,7 @@
<listitem>
<para>
Lines that grant execute permission (either ix or px)
+... or Px
</para>
</listitem>
</varlistentry>
@@ -1034,6 +1064,7 @@
<listitem>
<para>
Lines that grant unconfined access (ux)
+... or Ux
</para>
</listitem>
</varlistentry>
@@ -1068,6 +1099,7 @@
feature using &yast;. It is based on severity levels according to
<filename>/etc/apparmor/severity.db</filename>. Notification frequency
and type of notification (such as e-mail) can be configured.
+ <!-- notifications via YaST were done via the no longer existing aa-eventd, remove this part -->
</para>
<para>
@@ -1075,9 +1107,11 @@
<filename>/var/log/messages</filename> using the <envar>LOG_KERN</envar>
facility.
</para>
+ <!-- or journalctl if no syslog is running-->
<para>
Use &yast; for generating reports in CSV or HTML format.
+ <!-- gone. -->
</para>
<para>
@@ -1092,7 +1126,9 @@
<screen>dispatcher=/usr/bin/apparmor-dbus
</screen>
-
+<!-- not sure about this dispatcher - it's the first time I hear about it...
+ I wouldn't be surprised if it's also dead code, and I'd guess the
+ AA Desktop Monitor is even more dead -->
<para>
Once the dbus dispatcher is configured correctly, add the &aa; Desktop
Monitor to the GNOME panel. As soon as a <literal>REJECT</literal> event
@@ -1099,8 +1135,7 @@
is logged, the applet's panel icon changes appearance and you can click
the applet to see the number of reject events per confined application.
To view the exact log messages, refer to the audit log under
- <filename>/var/log/audit/audit.log</filename>. Use the &yast; Update
- Profile Wizard to adjust the respective profile.
+ <filename>/var/log/audit/audit.log</filename>.
</para>
</sect1>
<sect1 id="sec.aaquick.directories_files">
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
