apparmor

9 files changed, 156 insertions, 30 deletions

diff --git a/RELNOTES b/RELNOTES
index 3bdd21caa..ca3683838 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -3,6 +3,7 @@ firejail (0.9.42~rc2) baseline; urgency=low
   * --read-write option rework
   * allow symlinks in home directory for --whitelist option
   * AppImage support (--appimage)
+  * AppArmor support (--apparmor)
   * Sandbox auditing support (--audit)
   * remove environment variable (--rmenv)
   * noexec support (--noexec)
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 7de491f5f..12921e294 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -239,3 +239,84 @@ errout:
         exit(1);
 }
 
+
+void print_compiletime_support(void) {
+        printf("Compile time support:\n");
+        printf("\t- AppArmor support is %s\n",
+#ifdef HAVE_APPARMOR
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+
+
+        printf("\t- bind support is %s\n",
+#ifdef HAVE_BIND
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+
+        printf("\t- chroot support is %s\n",
+#ifdef HAVE_CHROOT
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+
+        printf("\t- file and directory whitelisting support is %s\n",
+#ifdef HAVE_WHITELIST
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+
+        printf("\t- file transfer support is %s\n",
+#ifdef HAVE_FILE_TRANSFER
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+
+        printf("\t- networking support is %s\n",
+#ifdef HAVE_NETWORK
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+
+
+#ifdef HAVE_NETWORK_RESTRICTED
+        printf("\t- networking features are available only to root user\n");
+#endif
+
+        printf("\t- seccomp-bpf support is %s\n",
+#ifdef HAVE_SECCOMP
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+
+        printf("\t- user namespace support is %s\n",
+#ifdef HAVE_USERNS
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+
+        printf("\t- X11 snadboxing support is %s\n",
+#ifdef HAVE_X11
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+}
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 1546dc403..821a8e003 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -263,6 +263,7 @@ extern int arg_writable_var;	// writable var
 extern int arg_appimage;        // appimage
 extern int arg_audit;           // audit
 extern char *arg_audit_prog;    // audit
+extern int arg_apparmor;        // apparmor
 
 extern int parent_to_child_fds[2];
 extern int child_to_parent_fds[2];
@@ -584,6 +585,7 @@ extern char *xephyr_screen;
 extern char *xephyr_extra_params;
 extern char *netfilter_default;
 int checkcfg(int val);
+void print_compiletime_support(void);
 
 // appimage.c
 void appimage_set(const char *appimage_path);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 8bb438ba4..b6fd745a2 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -102,6 +102,7 @@ int arg_writable_var = 0;			// writable var
 int arg_appimage = 0;                           // appimage
 int arg_audit = 0;                              // audit
 char *arg_audit_prog;                           // audit
+int arg_apparmor;                               // apparmor
 
 int parent_to_child_fds[2];
 int child_to_parent_fds[2];
@@ -241,6 +242,7 @@ void check_user_namespace(void) {
 }
 #endif
 
+
 // exit commands
 static void run_cmd_and_exit(int i, int argc, char **argv) {
         EUID_ASSERT();
@@ -255,33 +257,9 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
         }
         else if (strcmp(argv[i], "--version") == 0) {
                 printf("firejail version %s\n", VERSION);
-#ifndef HAVE_NETWORK
-                printf("Networking support is disabled.\n");
-#endif
-#ifdef HAVE_NETWORK_RESTRICTED
-                printf("Networking support is allowed only to root user.\n");
-#endif
-#ifndef HAVE_USERNS
-                printf("User namespace support is disabled.\n");
-#endif
-#ifndef HAVE_SECCOMP
-                printf("Seccomp-bpf support is disabled.\n");
-#endif
-#ifndef HAVE_BIND
-                printf("Bind support is disabled.\n");
-#endif
-#ifndef HAVE_CHROOT
-                printf("Chroot support is disabled.\n");
-#endif
-#ifndef HAVE_X11
-                printf("X11 support is disabled.\n");
-#endif
-#ifndef HAVE_FILE_TRANSFER
-                printf("File transfer support is disabled.\n");
-#endif
-#ifndef HAVE_WHITELIST
-                printf("whitelisting support is disabled.\n");
-#endif
+                printf("\n");
+                print_compiletime_support();
+                printf("\n");
                 exit(0);
         }
 #ifdef HAVE_X11
@@ -905,6 +883,10 @@ int main(int argc, char **argv) {
                 //*************************************
                 // filtering
                 //*************************************
+#ifdef HAVE_APPARMOR
+                else if (strcmp(argv[i], "--apparmor") == 0)
+                        arg_apparmor = 1;
+#endif  
 #ifdef HAVE_SECCOMP
                 else if (strncmp(argv[i], "--protocol=", 11) == 0) {
                         if (checkcfg(CFG_SECCOMP)) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 8c2970639..15cc1e55a 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -446,6 +446,13 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
 
+        if (strcmp(ptr, "apparmor") == 0) {
+#ifdef HAVE_APPARMOR            
+                arg_apparmor = 1;
+#endif
+                return 0;
+        }
+
         if (strncmp(ptr, "protocol ", 9) == 0) {
 #ifdef HAVE_SECCOMP
                 if (checkcfg(CFG_SECCOMP))
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 1502a0312..9bf2a0a39 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -804,9 +804,17 @@ int sandbox(void* sandbox_arg) {
 
         if (app_pid == 0) {
 #ifdef HAVE_APPARMOR
-                errno = 0;
-                if (aa_change_onexec("firejail-default")) 
-                        fprintf(stderr, "Warning: apparmor profile not loaded, errno %d\n", errno);
+                if (arg_apparmor) {
+                        errno = 0;
+                        if (aa_change_onexec("firejail-default")) {
+                                fprintf(stderr, "Error: cannot confine the application using AppArmor.\n");
+                                fprintf(stderr, "Maybe firejail-default AppArmor profile is not loaded into the kernel.\n");
+                                fprintf(stderr, "As root, run \"aa-enforce firejail-default\" to load it.\n");
+                                exit(1);
+                        }
+                        else if (arg_debug)
+                                printf("AppArmor enabled\n");
+                }
 #endif          
                 prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); // kill the child in case the parent died
                 start_application();    // start app
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index f7a93174f..958a16da7 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -34,6 +34,7 @@ void usage(void) {
         printf("\n");
         printf("Options:\n\n");
         printf("    -- - signal the end of options and disables further option processing.\n\n");
+        printf("    --apparmor - enable AppArmor confinement\n\n");
         printf("    --appimage - sandbox an AppImage application\n\n");
         printf("    --audit - audit the sandbox, see Audit section for more details\n\n");
         printf("    --audit=test-program - audit the sandbox, see Audit section for more details\n\n");
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index b6908dd00..637519902 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -211,6 +211,9 @@ Mount /var directory read-write.
 The following security filters are currently implemented:
 
 .TP
+\fBapparmor
+Enable AppArmor confinement.
+.TP
 \fBcaps
 Enable default Linux capabilities filter.
 .TP
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index d34cfdb20..9e6916534 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -75,6 +75,9 @@ $ firejail [OPTIONS] firefox        # starting Mozilla Firefox
 \fB\-\-
 Signal the end of options and disables further option processing.
 .TP
+\fB\-\-apparmor
+Enable AppArmor confinement. Formore information, please see \fBAPPARMOR\fR section below.
+.TP
 \fB\-\-appimage
 Sandbox an AppImage (http://appimage.org/) application.
 .br
@@ -1672,6 +1675,44 @@ $ firejail --tree
       1221:netblue:/usr/lib/firefox/firefox
 .RE
 
+.SH APPARMOR
+.TP
+AppArmor support is disabled by default at compile time. Use --enable-apparmor configuration option to enable it:
+.br
+
+.br
+$ ./configure --prefix=/usr --enable-apparmor
+.TP
+During software install, a generic AppArmor profile file, firejail-default, is placed in /etc/apparmor.d directory. The profile needs to be loaded into the kernel by running the following command as root:
+.br
+
+.br
+# aa-enforce firejail-default
+.TP
+The installed profile tries to replicate some advanced security features inspired by kernel-based Grsecurity:
+.br
+
+.br
+- Prevent information leakage in /proc and /sys directories. The resulting filesystem is barely enough for running
+commands such as "top" and "ps aux".
+.br
+
+.br
+- Allow running programs only from well-known system paths, such as /bin, /sbin, /usr/bin etc. Running
+programs and scripts from user home or other directories writable by the user is not allowed.
+.br
+
+.br
+- Disable D-Bus. D-Bus has long been a huge security hole, and most programs don't use it anyway.
+You should have no problems running Chromium or Firefox.
+
+.TP
+To enable AppArmor confinement on top of your current Firejail security features, pass \fB\-\-apparmor\fR flag to Firejail command line. You can also include \fBapparmor\fR command in a Firejail profile file. Example:
+.br
+
+.br
+$ firejail --apparmor firefox
+
 .SH FILE TRANSFER
 These features allow the user to inspect the filesystem container of an existing sandbox
 and transfer files from the container to the host filesystem.