Now as we said,
a profile is just a set of rules, but we can create these rules really
simply using the tools provided to us by AppArmor.
Now to have AppArmor create a profile for us,
it's going to have to read the log files. Now on a very minimal
install that we have with the openSUSE and Vagrant,
we don't have our standard logging mechanisms, so we're not going to be able
to read from those log files. So the first thing I'm going to do is just run
through and do a zypper in ‑y, because we don't want to be prompted, and
rsyslog. If we hit the big Enter key on that,
that's going to put in our rsyslog daemon, and, of course, then we're going to
be able to use that for logging. So once that's installed, we need to make
sure it's up and running, so we can do a systemctl enable ‑‑now, so it will
also start it, and our syslog. And with that, we should be ready to go, but
I've got two windows open because we're going to run the profiling in one
window and then our application, which is our script in another window. So as
we go through, we can run our aa‑genprof,
which as you can probably guess is going to generate one of our AppArmor
profiles. We need to put the path or the name of the executable. So it's
in my current directory. That's going to be easy, so test.py. But
remember, this could be a script, it could be a binary,
it could be one of your services. As we go through and enter
this, we get a lot of output, but it creates the profile straight
away and sets it into complain mode,
which is why we need to make sure we've got our
logging operation up and running.
It tells me as well that there might well be precreated
profiles that we can go through and grab.
So it says go through and check a wiki page to see if the
profile you want is already created.
We, of course, want to see the idea of this.
So I need to now go through to my second window. And in my second
window, I run every function within my script.
I need to make sure that I run it in its entirety.
Now ours is really simple, so it doesn't really come into
it. It's only creating that one file.
But if there were more tests that I needed to do, I
would have to run it in its entirety.
But that's it.
We've now tested our program. I can move back to the profile
generation, and I can see from the bottom of the screen that I can
then go through and scan the system logs.
So we hit s to scan the logs, and then we start looking at what it's found.
So we said, well okay, you were running the test.py script, and
we were then trying to write to the file,
/root/mytextfile. If we want to allow this,
I can then go through and put a for allow. Now remember, all
we're doing is allowing us to write to this file.
If I go through then and save this, we're then finished.
I can go through and hit F for finished, and we've generated our profile.
This profile now will no longer be in complain mode, and it will
be in our enforce mode. If I clear my screen,
we can check that it's still able to run. As I go through then and execute it,
we're still having no problems executing it because all we're doing is what is allowed. We are writing through to the file.