API tools faq
paste
Advertisement
xe1phix

Xe1phix-[Apparmor]-Setup-[v5.5.85].sh

xe1phix
Nov 10th, 2022
952
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 13.45 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/sh
  2.  
  3.  
  4.  
  5. /usr/share/doc/firejail/profile.template
  6.  
  7.  
  8.  
  9.  
  10. r = read
  11. w = write
  12. l = link
  13. k = lock
  14. a = append
  15.  
  16. r   ## read access
  17. w   ## write access
  18. a   ## limited write access (append)*
  19. k   ## lock a file
  20. m   ## load into memory - executable mapping
  21. x   ## allows execution
  22.  
  23. ix: executes the file under the constraints of the profile (inherit)
  24. ux**: executes the file outside of the profile (unconfined)
  25. Cx: executes the file in its own profile, which is specific to the parent process
  26. Px**: executes the file in its own profile, which you will have to define (profile)
  27. **Capital C, P or U means that the environment is sanitized before executing the code. You want
  28. to sanitize whenever possible.
  29.  
  30.  
  31. ix = inherit = Inherit the parents profile.
  32. px = requires a separate profile exists for the application, with environment scrubbing.
  33. Px = requires a separate profile exists for the application, without environment scrubbing.
  34.  
  35. ux and Ux = Allow execution of an application unconfined, with and without environmental scrubbing. (use with caution if at all).
  36.  
  37.  
  38.  
  39.  
  40. sudo perl ‐pi ‐e 's,GRUB_CMDLINE_LINUX="(.*)"$,GRUB_CMDLINE_LINUX="$1 apparmor=1 security=apparmor",' /etc/default/grub
  41. set CONFIG_SECURITY_APPARMOR=y
  42. set CONFIG_DEFAULT_SECURITY="apparmor"
  43. set CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
  44. sudo update‐grub
  45. sudo reboot
  46.  
  47.  
  48. ##-========================================-##
  49. ##   [+] Show the kernel boot arguements:
  50. ##-========================================-##
  51. cat -vET /proc/cmdline | xxd
  52.  
  53.  
  54. ##-===================================-##
  55. ##   [+] Start the AppArmor daemon:
  56. ##-===================================-##
  57. /etc/init.d/apparmor start
  58.  
  59. ## --------------------------------- ##
  60. systemctl enable apparmor
  61. systemctl start apparmor
  62. ## --------------------------------- ##
  63. ##
  64. ##
  65. ## ----------------------------------------------------- ##
  66. ##  [?] The AppArmor profile file (firejail-default)
  67. ##  [?] is placed in /etc/apparmor.d
  68. ## ----------------------------------------------------- ##
  69. ##
  70. ##
  71. ## ----------------------------------------------------- ##
  72. ##  [?] The local customizations must be placed in
  73. ## ----------------------------------------------------- ##
  74. ##  [?] /etc/apparmor.d/local/firejail-local
  75. ##
  76. ##
  77. ## ----------------------------------------------------- ##
  78. ##  [?] The profile needs to be loaded into the kernel
  79. ##      by reloading apparmor.service.
  80. ## ----------------------------------------------------- ##
  81. service apparmor reload
  82. /etc/init.d/apparmor restart
  83.  
  84.  
  85. ##-===================================================================-##
  86. ##   [+] apparmor_parser - loads AppArmor profiles into the kernel
  87. ##-===================================================================-##
  88. apparmor_parser --verbose -r /etc/apparmor.d/firejail-default
  89.  
  90.  
  91. ##-===============================================-##
  92. ##   [+] Enforce all of the AppArmor profiles
  93. ##       in the /etc/apparmor.d/ directory:
  94. ##-===============================================-##
  95. apparmor_parser --verbose -r /etc/apparmor.d/*
  96.  
  97.  
  98. ## ---------------------------------------------------------------- ##
  99. ##    [?] You may need to mount the securityFS into the kernel:
  100. ## ---------------------------------------------------------------- ##
  101. ##  mount -tsecurityfs securityfs /sys/kernel/security
  102. ##
  103. ##
  104. ## ------------------------------------------------- ##
  105. ##   [?] see if AppArmor is loaded and enabled
  106. ##   [?]         (should print “Y”):
  107. ## ------------------------------------------------- ##
  108. ##  cat /sys/module/apparmor/parameters/enabled
  109. ##
  110. ##
  111. ## ---------------------------------------------------------------- ##
  112. ##  cat /sys/kernel/security/apparmor/profiles
  113. ## ---------------------------------------------------------------- ##
  114. ##  cat /sys/kernel/security/apparmor/policy/profiles/
  115. ## ---------------------------------------------------------------- ##
  116. ##  cat /sys/kernel/security/apparmor/profiles | grep firejail
  117. ## ---------------------------------------------------------------- ##
  118. ##
  119. ##
  120. ##-======================================================================-##
  121. ##   [+] aa-status - report the current state of AppArmor confinement
  122. ##-======================================================================-##
  123. sudo apparmor_status --verbose
  124.  
  125.  
  126. ##-========================================================================-##
  127. ##   [+] aa-complain - set an AppArmor security profile to complain mode
  128. ##-========================================================================-##
  129. ## ------------------------------------------------------------------------ ##
  130. ##  [?] In complain mode, the security policy is not enforced
  131. ##  [?] but rather access violations are logged to the system log.
  132. ## ------------------------------------------------------------------------ ##
  133. ##
  134. ## -------------------------------------------------- ##
  135. ##   [+] Place all of the apparmor profiles
  136. ##       in /etc/apparmor.d/* into complain mode:
  137. ## -------------------------------------------------- ##
  138. sudo aa-complain /etc/apparmor.d/*
  139.  
  140.  
  141. ##-======================================================================-##
  142. ##   [+] aa-enforce - set an AppArmor security profile to enforce mode
  143. ##-======================================================================-##
  144. ##
  145. ## -------------------------------------------------- ##
  146. ##   [+] Place all of the apparmor profiles
  147. ##       in /etc/apparmor.d/* into enforce mode:
  148. ## -------------------------------------------------- ##
  149. sudo aa-enforce /etc/apparmor.d/*
  150.  
  151.  
  152. ##-===============================================-##
  153. ##   [+] Enforce the Firejail AppArmor profile:
  154. ##-===============================================-##
  155. sudo aa-enforce firejail-default
  156.  
  157.  
  158. ## ----------------------------------------------------------- ##
  159. ##   [?] Allow your desktop user to read audit logs
  160. ##       in /var/log/audit by adding it to audit user group
  161. ## ----------------------------------------------------------- ##
  162. groupadd -r audit
  163. gpasswd -a xe1phix audit
  164. sudo adduser xe1phix adm
  165. usermod xe1phix --groups adm audit
  166.  
  167. ##-========================================-##
  168. ##   [+] Add audit group to auditd.conf:
  169. ##-========================================-##
  170. /etc/audit/auditd.conf
  171.  
  172. log_group = audit
  173.  
  174.  
  175. AppArmor Notify
  176. /usr/bin/aa-notify -p -s 1 -w 60
  177.  
  178.  
  179. ##-=======================================================-##
  180. ##   [+] set an AppArmor security profile to audit mode
  181. ##-=======================================================-##
  182. aa-audit --dir /etc/apparmor.d/
  183.  
  184.  
  185. ## ---------------------------------------------------------------------- ##
  186. ##  [?] aa-notify - display information about logged AppArmor messages
  187. ## ---------------------------------------------------------------------- ##
  188. /etc/apparmor/notify.conf
  189. ~/.apparmor/notify.conf
  190.  
  191. --verbose
  192.  
  193.  
  194. ##-===================================================-##
  195. ##   [+] Get desktop notification on DENIED actions
  196. ##-===================================================-##
  197. sudo aa-notify -p -f /var/log/audit/audit.log
  198. aa-notify -p -f /var/log/audit /audit.log --display $DISPLAY
  199.  
  200.  
  201.  
  202. ##-=====================================-##
  203. ##   [+]
  204.  
  205. ~/.config/autostart/apparmor-notify.desktop
  206.  
  207. [Desktop Entry]
  208. Type=Application
  209. Name=AppArmor Notify
  210. Comment=Receive on screen notifications of AppArmor denials
  211. TryExec=aa-notify
  212. Exec=aa-notify -p -s 1 -w 60 -f /var/log/audit/audit.log
  213. StartupNotify=false
  214. NoDisplay=true
  215.  
  216.  
  217.  
  218. ##-===================================================-##
  219. ##   [+] check if the aa-notify process is running:
  220. ##-===================================================-##
  221. pgrep -ax aa-notify
  222.  
  223.  
  224.  
  225. ##-============================-##
  226. ##   [+] generate a profile:
  227. ##-============================-##
  228. sudo genprof $Profile
  229.  
  230.  
  231.  
  232.  
  233. ##-===================================================-##
  234. ##   [+] search your logs and modify your profile
  235. ##-===================================================-##
  236. sudo aa-logprof $Profile
  237.  
  238.  
  239.  
  240.  
  241. cat /sys/module/apparmor/parameters/enabled
  242. cat /sys/module/apparmor/parameters/mode
  243. cat /sys/module/apparmor/parameters/debug
  244.  
  245.  
  246.  
  247. ##-=====================================-##
  248. ##   [+] turn off deny audit quieting:
  249. ##-=====================================-##
  250. echo -n noquiet > /sys/module/apparmor/parameters/audit
  251.  
  252.  
  253. ##-==================================-##
  254. ##   [+] Force audit mode globally:
  255. ##-==================================-##
  256. echo -n all > /sys/module/apparmor/parameters/audit
  257.  
  258.  
  259. cat /sys/module/apparmor/parameters/audit
  260.  
  261.  
  262. cat /sys/module/apparmor/parameters/audit_header
  263. echo "1" > /sys/module/apparmor/parameters/audit_header
  264.  
  265. cat /sys/module/apparmor/parameters/debug
  266. cat /sys/module/apparmor/parameters/enabled
  267.  
  268.  
  269. cat /sys/module/apparmor/parameters/hash_policy
  270. echo "1" > /sys/module/apparmor/parameters/hash_policy
  271.  
  272. cat /sys/module/apparmor/parameters/lock_policy
  273.  
  274.  
  275. cat /sys/module/apparmor/parameters/logsyscall
  276.  
  277.  
  278. cat /sys/module/apparmor/parameters/mode
  279.  
  280.  
  281. cat /sys/module/apparmor/parameters/paranoid_load
  282. echo "1" > /sys/module/apparmor/parameters/paranoid_load
  283.  
  284. cat /sys/module/apparmor/parameters/path_max
  285.  
  286. cat /sys/module/apparmor/parameters/rawdata_compression_level
  287.  
  288.  
  289. ##-============================-##
  290. ##   [+] Enable debug mode:
  291. ##-============================-##
  292. echo 1 > /sys/module/apparmor/parameters/debug
  293.  
  294.  
  295. ##-=======================================-##
  296. ##   [+] Check if SecurityFS is mounted:
  297. ##-=======================================-##
  298. cat /proc/mounts | grep "/sys/kernel/security"
  299.  
  300.  
  301. --apparmorfs /sys/kernel/security/apparmor
  302.  
  303.  
  304. ##-==================================================-##
  305. ##   [+] Mount the AppArmor securityfs filesystem:
  306. ##-==================================================-##
  307. mount -tsecurityfs securityfs /sys/kernel/security
  308.  
  309.  
  310. cat /sys/kernel/security/apparmor/profiles
  311. cat /sys/module/apparmor/parameters/enabled
  312. cat /sys/kernel/security/apparmor/policy/profiles/
  313.  
  314.  
  315.  
  316. sudo cat /sys/kernel/security/apparmor/profiles | grep firejail
  317. cat /sys/kernel/security/apparmor/policy/profiles/firejail-default.52/mode
  318.  
  319.  
  320. sudo apparmor_status --verbose
  321.  
  322.  
  323.  
  324. aa-status --verbose                 ## displays multiple data points about loaded AppArmor policy set
  325. aa-status --profiled                ## displays the number of loaded AppArmor policies
  326. aa-status --enabled                 ## returns error code if AppArmor is not enabled.
  327. aa-status --enforced                ## displays the number of loaded enforcing AppArmor policies
  328. aa-status --complaining             ## displays the number of loaded non-enforcing AppArmor policies
  329.  
  330. sudo aa-complain /bin/ping                      ## put a profile in complain mode:
  331.  
  332. sudo aa-complain --dir /etc/apparmor.d/*                ## put all profiles into complain mode:
  333.  
  334. sudo aa-enforce /bin/ping                       ## put a profile in enforcing mode:
  335.  
  336. sudo aa-enforce                                 ## put all profiles into enforcing mode:
  337.  
  338.  
  339. sudo aa-enforce /etc/apparmor.d/usr.lib.firefox.firefox
  340. sudo aa-enforce --dir /etc/apparmor.d/*
  341.  
  342.  
  343.  
  344. apparmor_parser --warn=rules-not-enforced
  345.  
  346.  
  347.  
  348. invoke-rc.d apparmor reload                     ## Reload all profiles
  349. /etc/init.d/apparmor restart
  350. /etc/init.d/apparmor reload                     ## Reload all profiles
  351.  
  352.  
  353. ##-======================================================-##
  354. ##   [+] replace the definition already in the kernel
  355. ##-======================================================-##
  356. apparmor_parser --replace /etc/apparmor.d/bin.ping
  357.  
  358.  
  359. ##-=======================================-##
  360. ##   [+] Load a profile into the kernel:
  361. ##-=======================================-##
  362. apparmor_parser --verbose --add /etc/apparmor.d/*
  363.  
  364.  
  365.  
  366. apparmor_parser --verbose --add /etc/apparmor.d/usr.lib.firefox.firefox
  367. apparmor_parser --verbose --add /etc/apparmor.d/usr.lib.firefox.firefox.sh
  368. apparmor_parser --verbose --add /etc/apparmor.d/usr.lib.firefox.mozilla-xremote-client
  369.  
  370. apparmor_parser --help=dump
  371.  
  372.  
  373. ##-=======================================================-##
  374. ##   [+] Report the cache processing (hit/miss details)
  375. ##-=======================================================-##
  376. apparmor_parser --verbose --show-cache
  377.  
  378.  
  379. ##-==================================-##
  380. ##   [+] clear out cached profiles
  381. ##-==================================-##
  382. apparmor_parser --verbose --purge-cache
  383.  
  384.  
  385.  
  386.  
  387. ## Produce a list of policies from a given set of profiles
  388.  
  389.  
  390. sudo aa-enforce /etc/apparmor.d/usr.bin.firefox     ## Enable Firefox Profile
  391.  
  392.  
  393. /etc/apparmor.d/
  394. /var/lib/apparmor/
  395. /var/log/audit/audit.log
  396. /var/log/messages
  397.  
  398.  
  399.  
  400. git clone https://github.com/netblue30/firejail.git         ## Cloning The Firejail Github Repo
  401. cd firejail
  402. ./configure && make && sudo make install-strip              ## Initiate Firejail Setup Using The Make Compiler
  403. ./configure --prefix=/usr --enable-apparmor                 ## Load The Apparmor Kernel Module
  404.                                                             ## Then Compile Into Firejail Source...
  405. aa-enforce firejail-default                                 ## Load The Apparmor Profile Into The Kernel
  406.  
  407.  
  408.  
  409. ##-=======================================================-##
  410. ##   [+] Check if process is using AppArmor confinement.
  411. ##-=======================================================-##
  412. firemon --apparmor $PID
  413.  
  414.  
  415. ##-=======================================================-##
  416. ##   [+] Check if process is using AppArmor confinement.
  417. ##-=======================================================-##
  418. firejail --apparmor.print=$PID
  419.  
  420.  
  421.  
  422.  
  423.   echo "[$SCRIPT_COUNT] Enforce apparmor profiles"
  424.  
  425.   if ! grep 'session.*pam_apparmor.so order=user,group,default' /etc/pam.d/*; then
  426.     echo 'session optional pam_apparmor.so order=user,group,default' > /etc/pam.d/apparmor
  427.   fi
  428.  
  429.  
  430.  
  431.  
Tags: apparmor ParrotSec Auditd Hardening
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!