AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy

[Patrick]

The call for testes news went live.

Full System AppArmor Policy - Testers Wanted!

apparmor-profile-everything is an experimental AppArmor policy which confines all user space processes on the system. It is still currently in development and requires testing. Install it by executing: sudo apt-get install apparmor-profile-everything Then reboot. apparmor-profile-everything supports different boot modes: aadebug and superroot. aadebug allows certain permissions necessary for advanced debugging and superroot relaxes the policy substantially, even making bypasses possible. It …

[Patrick]

Could you fix these please?

Oct 08 17:56:29 host audit[1907]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/lib/whonix-firewall/" name=“/usr/bin/whonix_firewall” pid=1907 comm=“enable-firewall” requested_mask=“x” denied_mask=“x” fsuid=0 ouid=0 target="/usr/lib/whonix-firewall///null-/usr/bin/whonix_firewall”

Oct 08 17:56:29 host audit[1907]: AVC apparmor=“ALLOWED” operation=“file_mmap” profile=“/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall” name=“/bin/bash” pid=1907 comm=“whonix_firewall” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0

Oct 08 17:56:29 host audit[1924]: AVC apparmor=“ALLOWED” operation=“open” profile=“/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-workstation-firewall//null-/usr/bin/id” name=“/lib/x86_64-linux-gnu/libnss_files-2.28.so” pid=1924 comm=“id” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0

Oct 08 17:56:29 host audit[1924]: AVC apparmor=“ALLOWED” operation=“file_mmap” profile=“/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-workstation-firewall//null-/usr/bin/id” name=“/lib/x86_64-linux-gnu/libnss_files-2.28.so” pid=1924 comm=“id” requested_mask=“rm” denied_mask=“rm” fsuid=0 ouid=0

[madaidan]

https://github.com/Whonix/whonix-firewall/pull/8

[Patrick]

Merged.

[HulaHoop]

A telegram user reported broken shared folders. Perhaps access should be very permissive to this directory?

[madaidan]

What directory? Shared folders can be set at arbitrary directories. It’s impossible to support all configurations at once. Unless you’re referring to ~/shared? That’s already allowed. You just can’t execute from it.

[HulaHoop]

@madaidan

What directory?

Yeah I was referring to /mnt/shared in the VM.

[madaidan]

Permit access to shared folders

[madaidan]

Cleanup and fix a few things

[Patrick]

AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**" name="/proc/cmdline" pid=2712 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**" name="/proc/cmdline" pid=2713 comm="systemctl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="exec" profile="/usr/lib/whonix-firewall/**" name="/usr/bin/whonix_firewall" pid=2717 comm="enable-firewall" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 target="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/bin/bash" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/ld-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/etc/ld.so.cache" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libtinfo.so.6.1" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libtinfo.so.6.1" pid=2717 comm="whonix_firewall" requested_mask="rm" denied_mask="rm" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libdl-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libdl-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="rm" denied_mask="rm" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libc-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libc-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="rm" denied_mask="rm" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/dev/tty" pid=2717 comm="whonix_firewall" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/locale/locale-archive" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/etc/nsswitch.conf" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/etc/ld.so.cache" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libnss_files-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/lib/x86_64-linux-gnu/libnss_files-2.28.so" pid=2717 comm="whonix_firewall" requested_mask="rm" denied_mask="rm" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/etc/passwd" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/bin/whonix_firewall" pid=2717 comm="whonix_firewall" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="exec" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall" name="/usr/bin/whonix-gateway-firewall" pid=2718 comm="whonix_firewall" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 target="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-gateway-firewall"
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-gateway-firewall" name="/usr/bin/bash" pid=2718 comm="whonix-gateway-" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="file_mmap" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-gateway-firewall" name="/usr/lib/x86_64-linux-gnu/ld-2.28.so" pid=2718 comm="whonix-gateway-" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
AVC apparmor="ALLOWED" operation="open" profile="/usr/lib/whonix-firewall/**//null-/usr/bin/whonix_firewall//null-/usr/bin/whonix-gateway-firewall" name="/etc/ld.so.cache" pid=2718 comm="whonix-gateway-" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

[madaidan]

All of these are already allowed.

[Patrick]

Similar to AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy - #444 by Patrick

Aren’t these just ALLOWED because the profile is still in complain mode and not yet in enforce mode? If the profile was in enforce mode, I guess these would become DENIED?

Why would the log mention ALLOWED? If apparmor profiles would log everything every time something was allowed, that would overwhelm logs. So even if allowed, that log message should be made gone somehow?

[madaidan]

I’m not sure why this is happening but the denials you’re facing are certainly already allowed, many of them in the base abstraction.

[madaidan]

Add sys_pci and dev_ttys tunables

[Patrick]

Merged.

@madaidan

I’m not sure why this is happening but the denials you’re facing are certainly already allowed, many of them in the base abstraction.

Cannot reproduce anymore. Perhaps I missed journalctl -b or --boot.

[Patrick]

apparmor-profile-everything profile comment:

TODO: Create auditd(/journald?) profile and remove audit_*.

A start job is running for security auditing service

install no longer no longer required auditd by default

Therefore no longer required or lower priority since Whonix will be no longer installing auditd by default?

[madaidan]

Are you sure uninstalling auditd is a good idea? It’s pretty useful for debugging and uninstalling it would break e.g. apparmor-info unless I’m missing something?

[Patrick]

The audit lines in systemd journal are independent. auditd wasn’t installed on Whonix-Workstation. Only on Whonix-Gateway. Was only a Depends: in anon-gw-anonymizer-config. No other mentions of it in Whonix source code anywhere. Was only installed to debug ⚓ T537 monitor what changes /var/lib/tor/lock access rights. Since that issue doesn’t happen anymore. rip out that debugging code since causing issues (A start job is running for security auditing service - #3 by Patrick). I am confident we won’t notice a difference.

[Patrick]

Suggestion: "Tor Control Panel" on Gateway without root reminds me of upgrade-nonroot. Would it be better for security if we got rid of that for sake of apparmor-profile-everything?

Also interesting in context of:

Multiple Boot Modes for Better Security: an Implementation of Untrusted Root

Untrusted Root - improve Security by Restricting Root

Is it currently being argued towards Untrusted Root? I.e. do you think it is a good idea to try to restrict malware which gained root access? examples which may point into that direction: Blacklist more kernel modules to reduce attack surface - #8 by Algernon enforce kernel module software signature verification [module signing] / disallow kernel module loading by default enable Linux kernel gpg verification in grub and/or enable Secure Boot by default Goal of untrusted root could be: t…

[madaidan]

@Patrick

Would it be better for security if we got rid of that for sake of apparmor-profile-everything?

How would it be better? It doesn’t seem like a risk to me.