Confining Users With Pam_Apparmor - Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual

26
Confining Users with
pam_apparmor
An AppArmor profile applies to an executable program; if a portion of the program
needs different access permissions than other portions, the program can change hats
via change_hat to a different role, also known as a subprofile. The pam_apparmor PAM
module allows applications to confine authenticated users into subprofiles based on
group names, user names, or a default profile. To accomplish this, pam_apparmor needs
to be registered as a PAM session module.
The package pam_apparmor may not installed by default, you may need to install it
using YaST or zypper. Details about how to set up and configure pam_apparmor can
be found in /usr/share/doc/packages/pam_apparmor/README after the
package has been installed. For details on PAM, refer to Chapter 2, Authentication with
PAM (page 17).
pam_apparmor allows to set up role-based access control (RBAC). In conjunction with
the set capabilities rules (see Section 21.11, "Setting Capabilities per Profile" (page 219)
for more information), it allows to map restricted admin profiles to users. A detailed
http://developer
HOWTO on setting up RBAC with AppArmor is available at
.novell.com/wiki/index.php/Apparmor_RBAC_in_version_2.3.

Confining Users with pam_apparmor

287