Edit

AppArmor

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Basic Information

AppArmor is a kernel enhancement designed to restrict the resources available to programs through per-program profiles, effectively implementing Mandatory Access Control (MAC) by tying access control attributes directly to programs instead of users. This system operates by loading profiles into the kernel, usually during boot, and these profiles dictate what resources a program can access, such as network connections, raw socket access, and file permissions.

There are two operational modes for AppArmor profiles:

  • Enforcement Mode: This mode actively enforces the policies defined within the profile, blocking actions that violate these policies and logging any attempts to breach them through systems like syslog or auditd.

  • Complain Mode: Unlike enforcement mode, complain mode does not block actions that go against the profile's policies. Instead, it logs these attempts as policy violations without enforcing restrictions.

Components of AppArmor

  • Kernel Module: Responsible for the enforcement of policies.

  • Policies: Specify the rules and restrictions for program behavior and resource access.

  • Parser: Loads policies into the kernel for enforcement or reporting.

  • Utilities: These are user-mode programs that provide an interface for interacting with and managing AppArmor.

Profiles path

Apparmor profiles are usually saved in /etc/apparmor.d/ With sudo aa-status you will be able to list the binaries that are restricted by some profile. If you can change the char "/" for a dot of the path of each listed binary and you will obtain the name of the apparmor profile inside the mentioned folder.

For example, a apparmor profile for /usr/bin/man will be located in /etc/apparmor.d/usr.bin.man

Commands

Creating a profile

  • In order to indicate the affected executable, absolute paths and wildcards are allowed (for file globbing) for specifying files.

  • To indicate the access the binary will have over files the following access controls can be used:

    • r (read)

    • w (write)

    • m (memory map as executable)

    • k (file locking)

    • l (creation hard links)

    • ix (to execute another program with the new program inheriting policy)

    • Px (execute under another profile, after cleaning the environment)

    • Cx (execute under a child profile, after cleaning the environment)

    • Ux (execute unconfined, after cleaning the environment)

  • Variables can be defined in the profiles and can be manipulated from outside the profile. For example: @{PROC} and @{HOME} (add #include <tunables/global> to the profile file)

  • Deny rules are supported to override allow rules.

aa-genprof

To easily start creating a profile apparmor can help you. It's possible to make apparmor inspect the actions performed by a binary and then let you decide which actions you want to allow or deny. You just need to run:

Then, in a different console perform all the actions that the binary will usually perform:

Then, in the first console press "s" and then in the recorded actions indicate if you want to ignore, allow, or whatever. When you have finished press "f" and the new profile will be created in /etc/apparmor.d/path.to.binary

Using the arrow keys you can select what you want to allow/deny/whatever

aa-easyprof

You can also create a template of an apparmor profile of a binary with:

Note that by default in a created profile nothing is allowed, so everything is denied. You will need to add lines like /etc/passwd r, to allow the binary read /etc/passwd for example.

You can then enforce the new profile with

Modifying a profile from logs

The following tool will read the logs and ask the user if he wants to permit some of the detected forbidden actions:

Using the arrow keys you can select what you want to allow/deny/whatever

Managing a Profile

Logs

Example of AUDIT and DENIED logs from /var/log/audit/audit.log of the executable service_bin:

You can also get this information using:

Apparmor in Docker

Note how the profile docker-profile of docker is loaded by default:

By default Apparmor docker-default profile is generated from https://github.com/moby/moby/tree/master/profiles/apparmor

docker-default profile Summary:

  • Access to all networking

  • No capability is defined (However, some capabilities will come from including basic base rules i.e. #include <abstractions/base> )

  • Writing to any /proc file is not allowed

  • Other subdirectories/files of /proc and /sys are denied read/write/lock/link/execute access

  • Mount is not allowed

  • Ptrace can only be run on a process that is confined by same apparmor profile

Once you run a docker container you should see the following output:

Note that apparmor will even block capabilities privileges granted to the container by default. For example, it will be able to block permission to write inside /proc even if the SYS_ADMIN capability is granted because by default docker apparmor profile denies this access:

You need to disable apparmor to bypass its restrictions:

Note that by default AppArmor will also forbid the container to mount folders from the inside even with SYS_ADMIN capability.

Note that you can add/remove capabilities to the docker container (this will be still restricted by protection methods like AppArmor and Seccomp):

  • --cap-add=SYS_ADMIN give SYS_ADMIN cap

  • --cap-add=ALL give all caps

  • --cap-drop=ALL --cap-add=SYS_PTRACE drop all caps and only give SYS_PTRACE

Usually, when you find that you have a privileged capability available inside a docker container but some part of the exploit isn't working, this will be because docker apparmor will be preventing it.

Example

(Example from here)

To illustrate AppArmor functionality, I created a new Docker profile “mydocker” with the following line added:

To activate the profile, we need to do the following:

To list the profiles, we can do the following command. The command below is listing my new AppArmor profile.

As shown below, we get error when trying to change “/etc/” since AppArmor profile is preventing write access to “/etc”.

AppArmor Docker Bypass1

You can find which apparmor profile is running a container using:

Then, you can run the following line to find the exact profile being used:

In the weird case you can modify the apparmor docker profile and reload it. You could remove the restrictions and "bypass" them.

AppArmor Docker Bypass2

AppArmor is path based, this means that even if it might be protecting files inside a directory like /proc if you can configure how the container is going to be run, you could mount the proc directory of the host inside /host/proc and it won't be protected by AppArmor anymore.

AppArmor Shebang Bypass

In this bug you can see an example of how even if you are preventing perl to be run with certain resources, if you just create a a shell script specifying in the first line #!/usr/bin/perl and you execute the file directly, you will be able to execute whatever you want. E.g.:

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
PreviousAbusing Docker Socket for Privilege EscalationNextAuthZ& AuthN - Docker Access Authorization Plugin

Last updated