Main Inclusion Report for apparmor

Requirements

1. Availability: http://archive.ubuntu.com/ubuntu/pool/universe/a/apparmor/; available for i386, amd64, ppc, ppc64.

2. Rationale:

   • [http://en.opensuse.org/Apparmor AppArmor] proactively protects the system from security threats, both internal and external. It enforce the applications to only be able to access resources aimed to be accessed by the application. In this way the system is protected to both known and unknown threats.

   • For each application we want to protect or increase the security around, a security profile is created. The profile describes what files or devices the application is allowed to read, write and/or execute.

3. Security:

   • [http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=apparmor CVE entries]: None

   • [http://secunia.com/search/?search=apparmor Secunia history]:

     • [http://secunia.com/advisories/21179/ Suse kernel update]

   • All management scripts (written in perl) have to run as root, because they access information in /sys/kernel/security/apparmor/. There is also a module loaded into the kernel. Apparmor comes with a daemon, 'aa-eventd', that scans log files to extract apparmor audit messages and put them into a sqlite database for later analysis. It is not started by default.

   • Network activity: None.
   • Source code review:
     • kernel module: No.
     • User space utilities: I've improved some management scripts, so I've looked at the code a little bit.

4. Quality assurance:

   • In what situations does the package not work out of the box without configuration ?
     • All the profiles are in complain mode by default. So no improved security is provided by default. The user has to put the profiles into enforce mode via the command line. This is done to avoid breaking user's systems since profiles are not well tested yet. In the long term, profiles should be shipped in enforce mode by default to provide additional security out-of-the-box.
     • Apparmor kernel module is not included into the kernel. It requires a manual compilation using module-assistant. Apparmor will stop working when the kernel is updated but the user hasn't recompiled apparmor module.
   • Does the package ask any debconf questions higher than priority 'medium' ? No.

   • AppArmor is not packaged in Debian. A request was made : [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=347558 RFP: apparmor -- an application security framework for high security and easy usabilty]. But the bug was closed.

   • [http://en.opensuse.org/Apparmor] is vigorous. It is backed by Novell and included in SLES/Suse Linux/OpenSuse.

   • [https://bugzilla.novell.com/ Upstream bug tracker]: Classification: opensuse, Component AppArmor

   • Hardware: No

5. Standards compliance:

   • [http://www.pathname.com/fhs/ FHS], [http://www.de.debian.org/doc/debian-policy/ Debian Policy] compliance : Yes

   • [http://www.netfort.gr.jp/~dancer/column/libpkg-guide/libpkg-guide.html Debian library packaging guide] standards compliance: No library.

   • Packaging system (debhelper/cdbs/dbs) : debhelper
     • Patch system: dpatch.

6. Dependencies:

   • in main:
     • perl
     • libc6
     • upstart-compat-sysv
   • in universe:
     • libtimedate-perl
     • libdbd-sqlite3-perl
     • libfile-tail-perl
     • liblocale-gettext-perl

       All the packages in universe are required to make aa-eventd working. aa-eventd is not required to make the AppArmor framework working. It's used to dump audit log in an sqlite database. The database is then used by reporting tools (currently only by YasT, which is not packaged). Currently audit messages are logged to syslog. In the long term, the audit daemon is planned to be used. See [https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/116921 aa-eventd dependencies missing (from apparmor-utils)] and AppArmorGutsy.

7. Background information:

   • What do upstream call this software : AppArmor.

   • Has it had different names in the past : Part of Novell/Suse now. Started as Immunix, with the name subdomain (the code still as some references to subdomain).

Reviewers