Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Include code and policy for AppArmor #9

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
+58 −1
Open

Include code and policy for AppArmor #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f38b7f6
Check for apparmor, and if system provides it, change the profile bef…
Jul 31, 2018
7f9625b
Add an apparmor profile for thttpd
Jul 31, 2018
116483f
Add a conditional flag for building with AppArmor support
Jul 31, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,12 @@ AC_CHECK_LIB(crypt, crypt)
AC_CHECK_LIB(rt, clock_gettime)
AC_CHECK_LIB(resolv, hstrerror)

# Apparmor
AC_ARG_WITH([apparmor], AS_HELP_STRING([--with-apparmor], [Build with support for AppArmor]))
AS_IF([test "x$with_apparmor" = "xyes"], [
PKG_CHECK_MODULES([APPARMOR], [libapparmor], [AC_DEFINE([HAVE_APPARMOR],[1],[Use Apparmor])])
])

# Checks for header files.
AC_CHECK_HEADERS([arpa/inet.h fcntl.h grp.h memory.h netdb.h netinet/in.h osreldate.h paths.h poll.h stdlib.h string.h sys/devpoll.h sys/event.h sys/param.h sys/poll.h sys/socket.h sys/time.h syslog.h unistd.h])
AC_HEADER_TIME
Expand Down
30 changes: 30 additions & 0 deletions dist/apparmor/usr.sbin.thttpd
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
include <tunables/kernelvars>
include <tunables/multiarch>
include <tunables/proc>
include <tunables/sys>
include <tunables/home>

/usr/sbin/thttpd {
include <abstractions/nameservice>
include <abstractions/base>
include <abstractions/apparmor_api/change_profile>
include <abstractions/apparmor_api/is_enabled>

capability setuid setgid,
capability sys_chroot,
capability fsetid chown fowner dac_override,

/etc/thttpd/thttpd.conf r,
/var/log/thttpd.log rw,
/run/thttpd.pid rw,
/run/ rw,
change_profile -> thttpd_confined,

profile ^thttpd_confined {
/var/www/** rpx,
/var/log/thttpd.log w,
}

}


5 changes: 4 additions & 1 deletion src/Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@

AM_CPPFLAGS = $(APPARMOR_CFLAGS)

sbin_PROGRAMS = thttpd
thttpd_SOURCES = thttpd.c thttpd.h \
fdwatch.c fdwatch.h \
Expand All @@ -6,7 +9,7 @@ thttpd_SOURCES = thttpd.c thttpd.h \
timers.c timers.h \
tdate_parse.c tdate_parse.h \
mime_encodings.h mime_types.h version.h
thttpd_LDADD = libmatch.a
thttpd_LDADD = libmatch.a $(APPARMOR_LIBS)

noinst_LIBRARIES = libmatch.a
libmatch_a_SOURCES = match.c match.h
18 changes: 18 additions & 0 deletions src/thttpd.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,10 @@
#include <timers.h>
#include <version.h>

#ifdef HAVE_APPARMOR
#include <sys/apparmor.h>
#endif

#ifndef SHUT_WR
#define SHUT_WR 1
#endif
Expand Down Expand Up @@ -714,6 +718,20 @@ main( int argc, char** argv )
"started as root without requesting chroot(), warning only" );
}

/* Drop to another profile after binding to stuff */
#ifdef HAVE_APPARMOR
if ( aa_is_enabled() )
{
if( aa_change_profile( "thttpd_confined" ) < 0 )
{
syslog(
LOG_WARNING,
"could not change the AppArmor profile - %m" );
perror("aa_change_profile ");
}
}
#endif

/* Initialize our connections table. */
connects = NEW( connecttab, max_connects );
if ( connects == (connecttab*) 0 )
Expand Down