I am trying to implement Apparmor full system implementation on Ubuntu Bionic in AWS EC2 instances.
https://gitlab.com/apparmor/apparmor/-/wikis/FullSystemPolicy#distribution
My goal is employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.
I have a couple of questions:
- Following the link, I am not able to do profile init-systemd /lib/systemd/** because udevd and timesyncd disrupts the boot up process and box fails to reboot. So I have individually captured everything in /lib/systemd and added it to
/etc/initramfs-tools/scripts/init-bottom/apparmor file.
echo "profile init-systemd /lib/systemd/systemd-logind flags=(complain) {}" | /sbin/apparmor_parser -a
echo "profile lib-systemd-systemd-journald /lib/systemd/systemd-journald flags=(complain) {}" | /sbin/apparmor_parser -a
echo "profile init-systemd /lib/systemd/systemd flags=(complain) {}" | /sbin/apparmor_parser -a
What can I do for udevd and timesyncd? How can I include them and still get a functioning box.
Secondly, right now I am passing empty profiles in /etc/initramfs-tools/scripts/init-bottom/apparmor
. What is the best way to identify the permissions I should be giving in the profiles to achieve my goal?
Any help would be appreciated.
Thanks