<div>Hello,</div>
<div> </div>
<div>I have used AppArmor a bit, and must say that I like it a lot. I have used it on a few servers, and in some security competitions. As a HIPS, it is easy to use and fairly effective (from what I have seen).</div>
<div> </div>
<div>I just saw your question and it sparked my curiousity. From some quick googling, I presume that cap_setuid allows a process or call to be passed as another user (we'll say root for now). I wondered if root was exempt from the AppArmor rules (although I doubted it), so I configured my VMed webserver to access a denied config file for mod_security, and then started apache as root. It failed with an error from AppArmor claiming that access was denied to the configuration file. I restored the permissions in AppArmor and received a different error, apparently the Apache developers were smart enough to disallow apache to be run as root. Nonetheless, AppArmor would not even let it get this far, so even root privileges cannot override AppArmor profiles.
</div>
<div> </div>
<div>Regards,</div>
<div>Matt<br> </div><br><br>
<div><span class="gmail_quote">On 4/6/06, <b class="gmail_sendername">Brian Eaton</b> <<a href="mailto:eaton.lists@gmail.com">eaton.lists@gmail.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">On 4/5/06, Crispin Cowan <<a href="mailto:crispin@novell.com">crispin@novell.com</a>> wrote:<br>> Pascal Meunier wrote:
<br>> > but as you posted an example profile with "capability setuid", I must<br>> > admit I am curious as to why an email client needs that.<br>> Well now that is a very good question, but it has nothing to do with
<br>> AppArmor. The AppArmor learning mode just records the actions that the<br>> application performs. With or without AppArmor, the Thunderbird mail<br>> client is using cap_setuid. AppArmor gives you the opportunity to *deny*
<br>> that capability, so you can try blocking it and find out. But for<br>> documentation on why Thunderbird needs it, you would have to look at<br>> <a href="http://mozilla.org">mozilla.org</a> not the AppArmor pages.
<br><br>Does cap_setuid give a program enough authority to break out of the<br>AppArmor profile?<br><br>Regards,<br>Brian<br><br>_______________________________________________<br>Full-Disclosure - We believe in it.<br>Charter:
<a href="http://lists.grok.org.uk/full-disclosure-charter.html">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>Hosted and sponsored by Secunia - <a href="http://secunia.com/">http://secunia.com/</a><br></blockquote>
</div><br><br clear="all"><br>-- <br>Matt Lidestri