Re: [voidlinux/void-packages] RFC: Apparmor implementation (#6009)

Olivier Mauras at Mon, 20 Mar 2017 23:09:54 -0700
coredumb commented on this pull request. > +# Load config +[ -r /etc/rc.apparmor ] && . /etc/rc.apparmor + +# Proceed to load profiles depending on user settings +msg "Loading AppArmor profiles..." + +if [ "$APPARMOR" != "disable" -a -n "$APPARMOR" ]; then + if [ "$APPARMOR" != "complain" -a "$APPARMOR" != "enforce" ]; then + printf '! AppArmor incorrect option %s - ignoring profiles\n' "$APPARMOR" + exit 0 + fi + + [ "$APPARMOR" = "complain" ] && AACOMPLAIN="-C" + + if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then + for profile in $(find /etc/apparmor.d -maxdepth 1 -type f); do apparmor_parser will then try to load everythin recursively as well as files supposed to be included and not loaded directly which ends with a lot of error. Indeed you end up with your profiles loaded but I think it's nicer to only load profiles
Olivier Mauras at Mon, 20 Mar 2017 23:12:21 -0700
coredumb commented on this pull request. > @@ -0,0 +1,30 @@ +# vim: set ts=4 sw=4 et: + +# AppArmor is not enabled in kernel, silently exit +[ ! -d /sys/kernel/security/apparmor ] && exit You're right I overlooked that, I should use return instead of exit Will fix
Olivier Mauras at Mon, 20 Mar 2017 23:13:21 -0700
coredumb commented on this pull request. > @@ -0,0 +1,30 @@ +# vim: set ts=4 sw=4 et: + +# AppArmor is not enabled in kernel, silently exit +[ ! -d /sys/kernel/security/apparmor ] && exit + +# Load config +[ -r /etc/rc.apparmor ] && . /etc/rc.apparmor + +# Proceed to load profiles depending on user settings +msg "Loading AppArmor profiles..." + +if [ "$APPARMOR" != "disable" -a -n "$APPARMOR" ]; then I wanted to match explicit "disable" as well but you're right check on unset would be sufficient will fix
Olivier Mauras at Wed, 22 Mar 2017 06:25:37 -0700
So I made some unixbenchmark runs on linux4.10-4.10.4_1. The result is an average on 5 runs on 2CPUs VM: - No LSM enabled (Void repo) - Index score: **1650** - AppArmor enabled Kernel with securityfs not mounted - Index score: **1412** - AppArmor enabled and the 3 profiles loaded - Index score: **1661** I'm pretty sure the result of the run with AppArmor disabled is not relevant. I'll see if I have 2.5h ahead of me to rerun it :)
Andrea Brancaleoni at Wed, 22 Mar 2017 11:31:49 -0700
The results are totally unexpected. I would expect a slightly slower performance on Apparmor kernel enabled (it needed profiling enabled) and worsen with Apparmom userspace enabled. I think i have to run the tests myself :S
Olivier Mauras at Wed, 22 Mar 2017 12:25:06 -0700
When you have ~3% drop with a full grsec kernel I wouldn't expect anything noticeable with just a LSM module enabled. Now benchmarking a userland app confined would certainly give some more relevant numbers.
Andrea Brancaleoni at Sun, 23 Apr 2017 00:21:51 -0700
Are the Linux patches needed?
Olivier Mauras at Sun, 23 Apr 2017 07:36:16 -0700
Yes the patches are very much needed ... Mainline AppArmor is running very old code and is full of bugs.
Olivier Mauras at Thu, 05 Apr 2018 10:20:43 -0700
Closed #6009.
Olivier Mauras at Thu, 05 Apr 2018 10:20:43 -0700
I'm updating everything from https://github.com/voidlinux/void-packages/issues/6879
Enno Boland at Tue, 15 May 2018 20:38:35 +0000 (UTC)
Gottox commented on this pull request. Neat! :) > @@ -32,9 +32,20 @@ post_install() { vconf ${FILESDIR}/hostname vconf ${FILESDIR}/os-release vconf ${FILESDIR}/locale.conf + vconf ${FILESDIR}/rc.apparmor This should go to `/etc/defaults/apparmor` > @@ -0,0 +1,8 @@ +#!/bin/sh +[ -r conf ] && . ./conf + +# Find all profiles in $APPARMORD and load them +for profile in $(find ${APPARMORD} -maxdepth 1 -type f); do + apparmor_parser -a $profile +done +exec chpst -b apparmor pause Why do we need a sv-service if there's already a core-service? Can you explain? > @@ -0,0 +1,8 @@ +#!/bin/sh +[ -r conf ] && . ./conf + +# Find all profiles in $APPARMORD and load them +for profile in $(find ${APPARMORD} -maxdepth 1 -type f); do `APPARMORD` should default to `/etc/apparmor.d`: ```bash ${APPARMORD:-/etc/apparmor.d} ``` conf file can be removed then.
Olivier Mauras at Tue, 15 May 2018 15:02:58 -0700
olivier-mauras commented on this pull request. > @@ -0,0 +1,8 @@ +#!/bin/sh +[ -r conf ] && . ./conf + +# Find all profiles in $APPARMORD and load them +for profile in $(find ${APPARMORD} -maxdepth 1 -type f); do https://github.com/voidlinux/void-packages/pull/13309 let's get the details there ^^