make /boot and /lib/modules unreadable even for root

[phabricator-migrator]

Information

ID: 943
PHID: PHID-TASK-ikdtkehxadknzfoo7keb
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Similar to T937 but this is for defense in depth and even preventing root from getting access to kernel symbols.

Comments

---

madaidan

2019-12-23 20:27:00 UTC

/boot/ is already unreadable.

Prevent attackers from messing with kernel modules by madaidan · Pull Request #31 · Kicksecure/apparmor-profile-everything · GitHub

---

Patrick

2019-12-24 11:17:33 UTC

Still need to add /boot to apparmor-profile-everything/etc/apparmor.d/abstractions/dangerous-files at master · Kicksecure/apparmor-profile-everything · GitHub? Currently cannot find it there.

---

madaidan

2019-12-24 15:37:16 UTC

/boot isn’t allowed in init-systemd anyway so we don’t need to add it to dangerous-files. Apparmor denies access to files that aren’t explicitly allowed. The only reason we need to blacklist /lib/modules and not /boot is because we give access to all libraries.

---

Patrick

2019-12-24 15:49:02 UTC

Awesome!

Would an audit denyrule for /boot be useful for the sake of audit?

---

madaidan

2019-12-24 16:07:30 UTC

Any attempted access of /boot would be logged the same way anyway although it might be good to use that to stop it from showing up in aa-logprof.