Enhancing Linux Security with AppArmor and Wazuh: Mandatory Access Control with Real-Time Monitoring#

1
flowchart LR
2
    subgraph "Discretionary Access Control (DAC)"
3
        U1[User] --> F1[File Permissions]
4
        F1 --> P1[Process]
5
        P1 --> R1[Resources]
6
        style F1 fill:#ffd43b
7
    end
8

9
    subgraph "Mandatory Access Control (MAC)"
10
        K1[Kernel] --> PP1[Policy Profile]
11
        PP1 --> P2[Process]
12
        P2 -->|Restricted| R2[Resources]
13
        style K1 fill:#ff6b6b
14
        style PP1 fill:#51cf66
15
    end
16

17
    subgraph "Combined Security"
18
        DAC --> C1[First Layer]
19
        MAC --> C2[Second Layer]
20
        C1 --> C3[Defense in Depth]
21
        C2 --> C3
22
        style C3 fill:#4dabf7
23
    end

1
<!-- Add to /var/ossec/etc/ossec.conf -->
2
<ossec_config>
3
  <syscheck>
4
    <directories realtime="yes" report_changes="yes">/etc/apparmor.d</directories>
5
  </syscheck>
6
</ossec_config>

1
<group name="syscheck,apparmor">
2
  <!-- Profile Addition -->
3
  <rule id="100601" level="3">
4
    <if_sid>554</if_sid>
5
    <field name="file">/etc/apparmor.d/</field>
6
    <description>AppArmor profile added: $(file)</description>
7
    <group>apparmor_change,</group>
8
  </rule>
9

10
  <!-- Profile Modification -->
11
  <rule id="100602" level="5">
12
    <if_sid>550</if_sid>
13
    <field name="file">/etc/apparmor.d/</field>
14
    <description>AppArmor profile modified: $(file)</description>
15
    <mitre>
16
      <id>T1562.001</id>
17
    </mitre>
18
    <group>apparmor_change,defense_evasion,</group>
19
  </rule>
20

21
  <!-- Profile Deletion -->
22
  <rule id="100603" level="7">
23
    <if_sid>553</if_sid>
24
    <field name="file">/etc/apparmor.d/</field>
25
    <description>AppArmor profile deleted: $(file)</description>
26
    <mitre>
27
      <id>T1562.001</id>
28
    </mitre>
29
    <group>apparmor_change,defense_evasion,</group>
30
  </rule>
31
</group>

1
// Save as ~/test-app.c
2
#include <stdio.h>
3
#include <stdlib.h>
4
#include <unistd.h>
5
#include <fcntl.h>
6
#include <sys/syscall.h>
7
#include <sys/ptrace.h>
8
#include <netinet/in.h>
9
#include <string.h>
10
#include <arpa/inet.h>
11

12
// Attempt file write
13
void write_to_file() {
14
    FILE *fp = fopen("/tmp/demo_output.txt", "w");
15
    if (fp) {
16
        fprintf(fp, "This is a sample output.\n");
17
        fclose(fp);
18
        printf("[+] write_to_file - Wrote to /tmp/demo_output.txt\n");
19
    } else {
20
        perror("[-] write_to_file - Failed to write to file");
21
    }
22
}
23

24
// Attempt to read sensitive file
25
void read_sensitive_file() {
26
    FILE *fp = fopen("/etc/shadow", "r");
27
    if (fp) {
28
        printf("[+] read_sensitive_file - Able to read /etc/shadow\n");
29
        fclose(fp);
30
    } else {
31
        perror("[-] read_sensitive_file - Failed to read /etc/shadow");
32
    }
33
}
34

35
// Make system call
36
void make_syscall() {
37
    pid_t pid = syscall(SYS_getpid);
38
    printf("[+] make_syscall - Syscall SYS_getpid returned: %d\n", pid);
39
}
40

41
// Attempt network connection
42
void use_network() {
43
    int sock = socket(AF_INET, SOCK_STREAM, 0);
44
    if (sock < 0) {
45
        perror("[-] use_network - Socket creation failed");
46
        return;
47
    }
48

49
    struct sockaddr_in target;
50
    target.sin_family = AF_INET;
51
    target.sin_port = htons(80);
52
    inet_pton(AF_INET, "1.1.1.1", &target.sin_addr);
53

54
    if (connect(sock, (struct sockaddr *)&target, sizeof(target)) == 0) {
55
        printf("[+] use_network - Network connection established to 1.1.1.1:80\n");
56
    } else {
57
        perror("[-] use_network - Network connection failed");
58
    }
59
    close(sock);
60
}
61

62
// Attempt ptrace
63
void use_ptrace() {
64
    long ret = ptrace(PTRACE_TRACEME, 0, NULL, NULL);
65
    if (ret == 0) {
66
        printf("[+] use_ptrace - ptrace(PTRACE_TRACEME) succeeded\n");
67
    } else {
68
        perror("[-] use_ptrace - ptrace failed");
69
    }
70
}
71

72
int main() {
73
    printf("=== Demo App Starting ===\n");
74
    write_to_file();
75
    read_sensitive_file();
76
    make_syscall();
77
    use_network();
78
    use_ptrace();
79
    printf("=== Demo App Completed ===\n");
80
    return 0;
81
}

1
#include <tunables/global>
2

3
/usr/local/bin/test-app {
4
  #include <abstractions/base>
5

6
  # Binary execution
7
  /usr/local/bin/test-app mr,
8

9
  # Allow specific file write
10
  owner /tmp/demo_output.txt w,
11

12
  # Allow network access (TCP over IPv4)
13
  network inet tcp,
14

15
  # Deny sensitive file access (implicit)
16
  # deny /etc/shadow r,
17
}

1
#include <tunables/global>
2

3
/usr/local/bin/webapp {
4
  #include <abstractions/base>
5
  #include <abstractions/nameservice>
6

7
  # Binary and libraries
8
  /usr/local/bin/webapp mr,
9
  /usr/lib/x86_64-linux-gnu/** mr,
10

11
  # Web root access
12
  /var/www/html/** r,
13
  /var/www/html/uploads/** rw,
14

15
  # Logs
16
  /var/log/webapp/** rw,
17

18
  # Network
19
  network inet tcp,
20
  network inet6 tcp,
21

22
  # Capabilities
23
  capability setuid,
24
  capability setgid,
25

26
  # Deny system access
27
  deny /etc/shadow r,
28
  deny /etc/gshadow r,
29
  deny /boot/** rwx,
30
  deny /sys/** w,
31
}

1
#include <tunables/global>
2

3
/usr/sbin/database-server {
4
  #include <abstractions/base>
5
  #include <abstractions/mysql>
6

7
  # Binary
8
  /usr/sbin/database-server mr,
9

10
  # Data directory
11
  /var/lib/database/** rwk,
12

13
  # Configuration
14
  /etc/database/my.cnf r,
15

16
  # Sockets
17
  /var/run/database/mysqld.sock rw,
18

19
  # Network - local only
20
  network inet tcp,
21
  bind 127.0.0.1,
22

23
  # Capabilities
24
  capability dac_override,
25
  capability sys_resource,
26

27
  # Deny outbound connections
28
  deny network inet tcp connect,
29
}

1
<!-- Add to /var/ossec/etc/rules/local_rules.xml -->
2
<group name="apparmor,">
3
  <!-- AppArmor denial detection -->
4
  <rule id="100700" level="7">
5
    <decoded_as>apparmor</decoded_as>
6
    <match>DENIED</match>
7
    <description>AppArmor denied operation: $(apparmor.operation) on $(apparmor.name)</description>
8
    <group>access_denied,</group>
9
  </rule>
10

11
  <!-- Critical file access attempts -->
12
  <rule id="100701" level="10">
13
    <if_sid>100700</if_sid>
14
    <field name="apparmor.name">/etc/shadow|/etc/passwd|/etc/sudoers</field>
15
    <description>AppArmor blocked access to critical file: $(apparmor.name)</description>
16
    <mitre>
17
      <id>T1003.008</id>
18
    </mitre>
19
    <group>credential_access,</group>
20
  </rule>
21

22
  <!-- Network violation -->
23
  <rule id="100702" level="8">
24
    <if_sid>100700</if_sid>
25
    <field name="apparmor.operation">connect|bind|listen</field>
26
    <description>AppArmor blocked network operation: $(apparmor.operation)</description>
27
    <mitre>
28
      <id>T1071</id>
29
    </mitre>
30
    <group>network_violation,</group>
31
  </rule>
32

33
  <!-- Capability violation -->
34
  <rule id="100703" level="9">
35
    <if_sid>100700</if_sid>
36
    <field name="apparmor.capability">^cap_</field>
37
    <description>AppArmor blocked capability: $(apparmor.capability)</description>
38
    <mitre>
39
      <id>T1548</id>
40
    </mitre>
41
    <group>privilege_escalation,</group>
42
  </rule>
43
</group>

1
# All AppArmor denials
2
rule.groups: apparmor AND data.audit.type: "APPARMOR_DENIED"
3

4
# Profile modifications
5
rule.id: (100601 OR 100602 OR 100603)
6

7
# Critical file access attempts
8
rule.id: 100701
9

10
# Network violations by process
11
rule.id: 100702 | stats count by data.audit.exe

1
flowchart LR
2
    A[Create Profile] --> B[Complain Mode]
3
    B --> C[Test Application]
4
    C --> D[Analyze Logs]
5
    D --> E[Refine Profile]
6
    E --> F{Ready?}
7
    F -->|No| C
8
    F -->|Yes| G[Enforce Mode]
9
    G --> H[Production]
10
    H --> I[Monitor]
11
    I --> J[Maintain]

1
#!/bin/bash
2
# AppArmor profile testing script
3

4
APP="/usr/local/bin/test-app"
5
PROFILE="/etc/apparmor.d/usr.local.bin.test-app"
6

7
echo "1. Setting profile to complain mode..."
8
aa-complain $APP
9

10
echo "2. Running application tests..."
11
$APP > /tmp/app-test.log 2>&1
12

13
echo "3. Checking for denials..."
14
dmesg | grep -i apparmor | grep -i denied
15

16
echo "4. Generating profile suggestions..."
17
aa-logprof
18

19
echo "5. Enforcing profile..."
20
aa-enforce $APP
21

22
echo "6. Final validation..."
23
$APP

1
#!/usr/bin/env python3
2
import subprocess
3
import json
4
from datetime import datetime
5

6
def analyze_violations():
7
    """Analyze AppArmor violations and take action"""
8

9
    # Get recent violations
10
    cmd = "journalctl -u apparmor -n 100 --output=json"
11
    result = subprocess.run(cmd.split(), capture_output=True, text=True)
12

13
    violations = []
14
    for line in result.stdout.strip().split('\n'):
15
        if line:
16
            log = json.loads(line)
17
            if 'DENIED' in log.get('MESSAGE', ''):
18
                violations.append(log)
19

20
    # Process violations
21
    for violation in violations:
22
        if '/etc/shadow' in violation['MESSAGE']:
23
            # Critical violation - immediate action
24
            alert_security_team(violation)
25
            block_process(violation)
26
        elif 'network' in violation['MESSAGE']:
27
            # Network violation - investigate
28
            log_suspicious_activity(violation)
29

30
    return violations
31

32
def block_process(violation):
33
    """Block process with suspicious behavior"""
34
    # Extract process info and take action
35
    # Implementation depends on your security policies
36
    pass
37

38
def alert_security_team(violation):
39
    """Send immediate alert to security team"""
40
    alert = {
41
        'severity': 'CRITICAL',
42
        'timestamp': datetime.now().isoformat(),
43
        'violation': violation,
44
        'action_required': 'Immediate investigation'
45
    }
46
    # Send to SIEM, Slack, PagerDuty, etc.
47
    print(f"SECURITY ALERT: {json.dumps(alert, indent=2)}")
48

49
if __name__ == "__main__":
50
    violations = analyze_violations()
51
    print(f"Processed {len(violations)} violations")

1
# .gitlab-ci.yml - AppArmor profile validation
2
apparmor_validate:
3
  stage: security
4
  script:
5
    - apparmor_parser -Q -d profiles/
6
    - aa-logprof --json profiles/ > profile_report.json
7
  artifacts:
8
    reports:
9
      junit: profile_report.json

1
# Efficient file matching
2
/var/log/app-*.log rw,          # Good - uses glob
3
/var/log/** rw,                 # Bad - too broad
4

5
# Minimize regex usage
6
owner /home/*/.config/app/** r, # Good - simple glob
7
owner /home/[^/]+/.config/app/** r, # Bad - regex overhead

1
-- Wazuh database query for compliance report
2
SELECT
3
    agent.name as hostname,
4
    rule.description,
5
    COUNT(*) as violation_count,
6
    DATE(timestamp) as date
7
FROM
8
    alerts
9
WHERE
10
    rule.groups LIKE '%apparmor%'
11
    AND timestamp > DATE_SUB(NOW(), INTERVAL 30 DAY)
12
GROUP BY
13
    hostname, rule.description, date
14
ORDER BY
15
    violation_count DESC;

1
#!/bin/bash
2
# Generate AppArmor audit report
3

4
echo "AppArmor Security Audit Report"
5
echo "Generated: $(date)"
6
echo "================================"
7

8
echo -e "\nActive Profiles:"
9
aa-status | grep "profiles are in enforce mode" -A 20
10

11
echo -e "\nRecent Violations (Last 24h):"
12
journalctl -u apparmor --since="24 hours ago" | grep DENIED | tail -20
13

14
echo -e "\nProfile Changes (Last 7 days):"
15
find /etc/apparmor.d -type f -mtime -7 -ls
16

17
echo -e "\nHigh Severity Alerts:"
18
grep "level=\"10\"" /var/ossec/logs/alerts/alerts.json | tail -10