AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy

[madaidan]

Add sys_pci and dev_ttys tunables

[Patrick]

Merged.

@madaidan

I’m not sure why this is happening but the denials you’re facing are certainly already allowed, many of them in the base abstraction.

Cannot reproduce anymore. Perhaps I missed journalctl -b or --boot.

[Patrick]

apparmor-profile-everything profile comment:

TODO: Create auditd(/journald?) profile and remove audit_*.

A start job is running for security auditing service

install no longer no longer required auditd by default

Therefore no longer required or lower priority since Whonix will be no longer installing auditd by default?

[madaidan]

Are you sure uninstalling auditd is a good idea? It’s pretty useful for debugging and uninstalling it would break e.g. apparmor-info unless I’m missing something?

[Patrick]

The audit lines in systemd journal are independent. auditd wasn’t installed on Whonix-Workstation. Only on Whonix-Gateway. Was only a Depends: in anon-gw-anonymizer-config. No other mentions of it in Whonix source code anywhere. Was only installed to debug ⚓ T537 monitor what changes /var/lib/tor/lock access rights. Since that issue doesn’t happen anymore. rip out that debugging code since causing issues (A start job is running for security auditing service - #3 by Patrick). I am confident we won’t notice a difference.

[Patrick]

Suggestion: "Tor Control Panel" on Gateway without root reminds me of upgrade-nonroot. Would it be better for security if we got rid of that for sake of apparmor-profile-everything?

Also interesting in context of:

Multiple Boot Modes for Better Security: an Implementation of Untrusted Root

Untrusted Root - improve Security by Restricting Root

Is it currently being argued towards Untrusted Root? I.e. do you think it is a good idea to try to restrict malware which gained root access? examples which may point into that direction: Blacklist more kernel modules to reduce attack surface - #8 by Algernon enforce kernel module software signature verification [module signing] / disallow kernel module loading by default enable Linux kernel gpg verification in grub and/or enable Secure Boot by default Goal of untrusted root could be: t…

[madaidan]

@Patrick

Would it be better for security if we got rid of that for sake of apparmor-profile-everything?

How would it be better? It doesn’t seem like a risk to me.

[Patrick]

Reboot failure on Debian 10 due to systemd confinement

[madaidan]

Include init-systemd tunables

[Patrick]

proper whitespace handling

copyright

[madaidan]

Fix various denial errors

[Patrick]

Thank you! Merged.

Could you please fix the whonix-firewall ALLOWED apparmor messages?

[madaidan]

https://github.com/Whonix/whonix-firewall/pull/9

Is the sdwdate profile mature enough yet to be enforced?

[Patrick]

It already is.

[Patrick]

@madaidan

Fix denial errors

Merged.

[Patrick]

@madaidan

@Patrick

Possible to just make selective edits to that systemd unit file?

haveged works with a drop-in specifying NoNewPrivileges=no but onion-grater/sdwdate didn’t seem to work that way.

This caused confusion:

Full System AppArmor Policy - Testers Wanted!

Known issue if it can be called that. https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/419 But since it got forgotten and confused all of us, a better implementation is desirable. Best to add any error messages as comment in the source code so it can at least be remembered when grepping the source code. Was introduced here: https://github.com/Whonix/apparmor-profile-everything/pull/61 → https://forums.whonix.org/t/…

Why a drop-in cannot be used? Is there an upstream bug report for this?

[madaidan]

@Patrick

Why a drop-in cannot be used?

I’m not sure. It unexplainably broke when testing.

@Patrick

Is there an upstream bug report for this?

Which upstream?

The root issue is with the no_new_privs bit. It prevents a process from gaining further privileges. AppArmor respects this and prevents a process from transitioning to another AppArmor profile that grants increased permissions: linux/security/apparmor/domain.c at 3cee6079f62f4d3a37d9dda2e0851677e08028ff · torvalds/linux · GitHub

Since a lot of sandboxing options force this enabled (e.g. seccomp), we have to disable a lot of things for this to work. Theoretically, one could transition AppArmor profile and then set no_new_privs, but I don’t know how to do this. Will update Systemd sandboxing fails when using a full system apparmor policy · Issue #14277 · systemd/systemd · GitHub

[Patrick]

@madaidan

@Patrick

Why a drop-in cannot be used?

I’m not sure. It unexplainably broke when testing.

@Patrick

Is there an upstream bug report for this?

Which upstream?

systemd about not honoring the drop-in disabling no new privs.

[madaidan]

I’m not sure if it’s actually an issue within systemd. I’ll investigate more.

[Patrick]

Made some changes. Including Ux (unconfined open). Needs to be improved. Yet, still a lot fixes required. (After bullseye release upgrade in Qubes-Whonix.)

I am still wondering if there is some shortcut to run some trusted things such as this unconfined since sorting out all of this might be unachievable in the time available?

AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**" name="/run/updatesproxycheck/" comm="inotifywait" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**" name="/proc/cmdline" comm="systemctl" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="exec" profile="/usr/lib/whonix-firewall/**" name="/usr/bin/qubesdb-cmd" comm="whonix-workstat" requested_mask="x" denied_mask="x"
AVC apparmor="ALLOWED" operation="file_inherit" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/qubesdb-cmd" name="/dev/null" comm="qubesdb-read" requested_mask="w" denied_mask="w"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/qubesdb-cmd" name="/usr/bin/qubesdb-cmd" comm="qubesdb-read" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/qubesdb-cmd" name="/usr/lib/x86_64-linux-gnu/ld-2.28.so" comm="qubesdb-read" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/qubesdb-cmd" name="/etc/ld.so.preload" comm="qubesdb-read" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/qubesdb-cmd" name="/etc/ld.so.cache" comm="qubesdb-read" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/qubesdb-cmd" name="/usr/lib/libqubesdb.so" comm="qubesdb-read" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/qubesdb-cmd" name="/usr/lib/libqubesdb.so" comm="qubesdb-read" requested_mask="rm" denied_mask="rm"
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/qubesdb-cmd" name="/usr/lib/x86_64-linux-gnu/libc-2.28.so" comm="qubesdb-read" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/qubesdb-cmd" name="/usr/lib/x86_64-linux-gnu/libc-2.28.so" comm="qubesdb-read" requested_mask="rm" denied_mask="rm"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**" name="/run/updatesproxycheck/" comm="inotifywait" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="exec" profile="/usr/libexec/whonix-firewall/**" name="/usr/bin/getent" comm="whonix-gateway-" requested_mask="x" denied_mask="x"
AVC apparmor="ALLOWED" operation="file_inherit" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/dev/null" comm="getent" requested_mask="w" denied_mask="w"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/bin/getent" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/x86_64-linux-gnu/ld-2.31.so" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/etc/ld.so.preload" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/etc/ld.so.cache" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/x86_64-linux-gnu/libc-2.31.so" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/x86_64-linux-gnu/libc-2.31.so" comm="getent" requested_mask="rm" denied_mask="rm"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/locale/locale-archive" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/etc/nsswitch.conf" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/x86_64-linux-gnu/libnss_files-2.31.so" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/x86_64-linux-gnu/libnss_files-2.31.so" comm="getent" requested_mask="rm" denied_mask="rm"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/etc/passwd" comm="getent" requested_mask="r" denied_mask="r"
user@host:~$ sudo apparmor-info -b
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**" name="/run/updatesproxycheck/" comm="inotifywait" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="exec" profile="/usr/libexec/whonix-firewall/**" name="/usr/bin/getent" comm="whonix-gateway-" requested_mask="x" denied_mask="x"
AVC apparmor="ALLOWED" operation="file_inherit" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/dev/null" comm="getent" requested_mask="w" denied_mask="w"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/bin/getent" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/x86_64-linux-gnu/ld-2.31.so" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/etc/ld.so.preload" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/etc/ld.so.cache" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/x86_64-linux-gnu/libc-2.31.so" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/x86_64-linux-gnu/libc-2.31.so" comm="getent" requested_mask="rm" denied_mask="rm"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/locale/locale-archive" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/etc/nsswitch.conf" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/x86_64-linux-gnu/libnss_files-2.31.so" comm="getent" requested_mask="r" denied_mask="r"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/usr/lib/x86_64-linux-gnu/libnss_files-2.31.so" comm="getent" requested_mask="rm" denied_mask="rm"
AVC apparmor="ALLOWED" operation="open" profile="/usr/libexec/whonix-firewall/**//null-/usr/bin/getent" name="/etc/passwd" comm="getent" requested_mask="r" denied_mask="r"