Add AppArmor support to sudo #148
Conversation
|
This PR doesn't include some of the larger autogenerated files since I figured you'd rather generate them yourself than go through and audit them. In particular, I've excluded the new versions of but you should be able to recreate them with I also haven't included any regression tests here since truthfully I'm not sure what the best way is to write tests for this feature that works with your CI/testing pipeline (although I've verified that it works locally). I wanted to confirm whether this was a feature you'd be interested in including into sudo before figuring out whether there's a good way to incorporate it into your regression testing. |
kernelmethod
force-pushed
the
apparmor_support
branch
2 times, most recently
from
c282c22 to
5e12da6
Compare
Add a new build flag, --with-apparmor, that builds sudo with AppArmor support. Modify the build script for Debian and Ubuntu to enable this flag by default.
Define a new sudo setting, `apparmor_profile`, that can be used to pass in an AppArmor profile that should be used to confine commands. If apparmor_profile is specified, sudo will execute the command using the new `apparmor_execve` function, which confines the command under the provided profile before exec'ing it.
sudoers now supports an APPARMOR_PROFILE option, which can be specified
as e.g.
alice ALL=(ALL:ALL) APPARMOR_PROFILE=foo ALL
The line above says "user alice can run any command as any user/group,
under confinement by the AppArmor profile 'foo'." Profiles can be
specified in any way that complies with the rules of
aa_change_profile(2). For instance, the sudoers configuration
alice ALL=(ALL:ALL) APPARMOR_PROFILE=unconfined ALL
allows alice to run any command unconfined (i.e., without an AppArmor
profile), while
alice ALL=(ALL:ALL) APPARMOR_PROFILE=foo//&bar ALL
tells sudoers that alice can run any command under the stacked AppArmor
profiles 'foo' and 'bar'.
The intention of this option is to give sysadmins on Linux distros
supporting AppArmor better options for fine-grained access control.
Among other things, this option can enforce mandatory access control
(MAC) over the operations that a privileged user is able to perform to
ensure that they cannot privesc past the boundaries of a specified
profile. It can also be used to limit which users are able to get
unconfined system access, by enforcing a default AppArmor profile on all
users and then specifying 'APPARMOR_PROFILE=unconfined' for a privileged
subset of users.
Install libapparmor-dev on Debian- and Ubuntu-based Docker images so that they can build sudo with AppArmor support.
- Document the AppArmor userspec option in the sudoers man pages. - Add information about the --with-apparmor build configuration option to INSTALL.md.
kernelmethod
force-pushed
the
apparmor_support
branch
from
5e12da6 to
d8184fd
Compare
millert
left a comment
millert
left a comment
There was a problem hiding this comment.
This looks really good, thanks. I appreciate how complete your changes are. I'm afraid that my recent commits have created some minor conflicts but those should be easy to address. Once that is done I will merge this PR.
2 participants
This pull request adds AppArmor support to sudo by making it possible to specify
an AppArmor profile that should be used to confine a command. In particular, it
adds a new
APPARMOR_PROFILEuser specification option to sudoers, which can bespecified as e.g.
This sudoers entry says "user
alicecan run any command asrootunderconfinement by the AppArmor profile
my-profile." System administrators stillneed to define appropriate profile transitions to support the transition into
the specified profile.
This feature makes it possible to specify much finer-grained access controls for
users with
sudopermissions on systems supporting AppArmor, and makesprivilege escalation much harder. It can also be used to limit which users are
able to obtain unconfined system access, by enabling a default AppArmor profile
for all users and specifying
APPARMOR_PROFILE=unconfinedfor a privilegedsubset of users.
To build sudo with AppArmor support, you can pass in the
--with-apparmorflagto the
configurescript. Thescripts/mkpkgshell script has also beenupdated to build sudo with AppArmor support on Debian and Ubuntu systems by
default.