Advanced Docker Security with AppArmor - An Overview

So you have your Docker Containers deployed, which in turn are hosting critical applications of your organization? Great! So far, so good!

For the interest of the organization, it remains extremely crucial to keep not only the Containers but also the hosted applications protected from security threats. By default, a deployed Docker originally remains secured through an auto-generated profile docker-default for its containers.

This profile, however, provides moderate security on the application level, and thus it remains highly recommended to implement a security profile through AppArmor which works at the process/program level of an application.

What is AppArmor?

AppArmor (Application Armor) is a Linux Security Module that allows implementing security on a program/process level. Specifically developed security profiles through AppArmor can allow capabilities like folder access, network access, and permission(or not) to read, write, or execute files.

One of the beauties of AppArmor is that it allows a Learning Mode which logs profile violations without preventing them proactively. The Learning Mode Log eventually helps administrators to create a security profile which forms a much hardened security armor based on an application's process execution. Default Security policies when clubbed with Learning Mode Logs, help forming security policies for even very complex applications in quick turnaround.

AppArmor proactively protects the operating system and applications from external or internal threats and even zero-day attacks by enforcing a specific rule set on a per-application basis. Security policies completely define what system resources individual applications can access, and with what privileges. Access is denied by default if no profile says otherwise.

Installing and Enabling AppArmor

Though AppArmor comes inbuilt with all Linux Kernels, it is not by default the security profile loaded with every boot. Apparmor can be set as the default security profile on every boot by setting the following parameter on kernel :

apparmor=1 security=apparmor
CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1 CONFIG_DEFAULT_SECURITY_APPARMOR=y

To load all AppArmor security profiles on boot, enable 

apparmor.service

Display AppArmor loaded profiles

The system default AppArmor comes with a number of security profiles, on top of which an administrator can add his own security profiles based on the Learning Mode. To check the list of AppArmor security profiles correctly loaded :

$ aa-enabled
------------
Yes

To display the current loaded status use 

apparmor_status

# apparmor_statusapparmor module is loaded. 
29 profiles are loaded. 
29 profiles are in enforce mode.  
 ... 
0 profiles are in complain mode. 
0 processes have profiles defined. 
0 processes are in enforce mode. 
0 processes are in complain mode. 
0 processes are unconfined but have a profile defined.

Above you can see the loaded profiles and processes with their respective statuses.

Parsing AppArmor profiles

AppArmor allows a number of options using 

apparmor_parser

apparmor_parser

-a

-C

-r

-R

-V

-h

Understanding AppArmor profiles

AppArmor profiles are text files found under 

/etc/apparmor.d/

/etc/apparmor.d/usr.bin.test

#include <tunables/global>  
profile test /usr/lib/test/test_binary 
{
	#include <abstractions/base>      
    # Main libraries and plugins     
    /usr/share/TEST/** r,
    /usr/lib/TEST/** rm,
    # Configuration files and logs     
    @{HOME}/.config/ r,     
    @{HOME}/.config/TEST/** rw, 
}

Strings following the 

@

/etc/apparmor.d/abstractions/

/etc/apparmor.d/tunables/

#include

Commonly used command options on profile files :

r

w

x

m

Creating a new AppArmor profile

Creating an AppArmor profile can be done through a Systemic or Stand-Alone method.

1) Stand-Alone Profile Creation

(

aa-genprof

aa-genprof

aa-autodep

aa-genprof [ -d 

/path/to/profiles

 ]  

PROGRAM

2) Systemic Profile Creation

(

aa-autodep

Steps to create Systemic profile for a program :

1. Run an initial 

   aa-autodep

    to create an approximate profile for a program - this lets AppArmor consider the program for monitoring.
2. Activate learning or complain mode for all profiled programs by entering 

   aa-complain /etc/apparmor.d/*

3. Run the application. Ensure that the running program gets to access each file representing its access needs. As a result, the execution might run for several days through multiple system reboots.
4. Analyze the log with 

   aa-logprof

   .
5. Repeat Step 3 and Step 4 to generate an optimal Systemic profile. Subsequent iterations generate fewer messages and run faster.
6. Edit the profiles in 

   /etc/apparmor.d/

    as required.
7. Return to enforce mode using 

   aa-enfore /etc/apparmor.d/*

    which eventually enforces the rules of the profiles.
8. Rescan all kernel profiles to ensure no conflict.

Modifying an existing AppArmor profile

• Monitor the system for AppArmor denials
• dmesg, /var/log/kern.log, /var/log/messages, etc

• aa-notify

• Run 

  aa-logprof

   to update the policy

Disabling AppArmor

In case you would like to disable AppArmor for the current session, you can do so by clearing out all AppArmor profiles for the current session by 

# aa-teardown.

Additionally, to prevent the kernel from loading AppArmor profiles at the next boot disable 

apparmor.service

apparmor=1 security=apparmor

AppArmor when implemented properly, provides an enhanced level of security to the deployed containers at a program level. There are endless possibilities of creating varied profiles through Learning Mode, and hence makes it stand apart from the system generated 

docker-default