Notes - MCS
Secure Execution Environments
Notes - MCS
Secure Execution Environments
  • Secure Execution Environments
  • Introduction
    • Trusted Computing Base (TCB)
    • TEE (Trusted Execution Environment)
    • Can you trust the operating system?
  • Security in Operating Systems
    • Operating system
    • Virtual machines and hypervisors
    • Computational model
    • Access control
    • Protection with capabilities
    • Unix file protection ACLs
    • Windows NTFS file protection
    • Unix file protection ACLs
    • Privilege elevation
    • Privilege reduction
    • Linux login
  • Virtualization on Intel Processors
    • Modes of Operation
    • Virtual memory
    • How to put assembly instructions inside C code
    • A more elaborate example
    • Useful assembly instructions
  • Intel Software Guard Extensions
    • What is SGX (Software Guard eXtensions)?
    • SGX Enclave Memory
    • Guidelines for designing applications using SGX
    • Performance Overhead
    • SDK compilation modes
    • Writing Enclave Functions
  • ARM TrustZone
    • SoC and IP
    • ARM TrustZone
    • Worlds
    • Architecture
    • TrustZone bootstrap
  • Linux Kernel Namespaces
    • Namespaces
    • Advantages
    • Process Namespace
    • Network namespace
    • Mount namespace
    • UTS namespace
    • User namespace
  • LXC Linux Containers
    • Container
    • LXC containers
  • AppArmor
    • Purpose
    • Enforcement
    • Benefits
    • Attack prevention
    • Enforcement policies
    • Enforcement modes
    • Logging and auditing
    • Profiles
  • TPM (Trusted Platform Module)
    • Trusted Platform Module (TPM)
    • History
    • Cryptographic Concepts
    • Use cases
    • TPM Software Stack (TSS)
    • TPM concepts
    • Entities
    • Key management
    • Restrict signatures
    • Sessions
    • Authorization roles
  • Bootstrap security
    • AEGIS
    • Trusted computing
    • Root of Trust Measurements
    • Trusted Computing Platform Alliance (TCPA)
    • TPM-based attestation
    • Trusted Platform identity credentials
    • UEFI (Unified Extensible Firmware Interface)
    • NSA Boot Security
    • UEFI secure boot & TPM measurements
    • Intel Trusted Execution Technology (TXT)
    • Smartcards
      • Java Cards
      • OpenCard Framework (OCF)
      • Cryptographic services
Powered by GitBook
On this page
  • Access violations can be logged
  • Auditing definitions
  • Profile auditing types
  • Global auditing types
  • Profiles’ loading and enforcement
  1. AppArmor

Logging and auditing

Access violations can be logged

For posterior auditing.

Logged violations can be used to interactively improve profiles with aa-logprof

Auditing definitions

Per profile rule.

Global /sys/module/apparmor/parameters/audit

Profile auditing types

Profiles can specify a global auditing.

  • All matched rules within a profile produce a log entry.

Profile rules can individually specify their audit.

  • Produce a log when matched

Global auditing types

  • normal

    • Profiles’ audit types are respected.

  • quiet_denied

    • No logging of denials.

    • Overrides profile/rule individual auditing.

  • quiet

    • No logging.

    • Overrides profile/rule individual auditing.

  • all

    • All rules of all profiles produce a log when matched.

Profiles’ loading and enforcement

Profiles are loaded in the kernel, and associated to an executable file (defined in the profile).

If a profile exists for the loaded executable file, profiles are associated with processes upon an exec syscall.

Profiles can be modified in run-time. Processes associated with the profile will reflect the modifications.

New profiles loaded for an executable file are not enforced in existing processes using that file without any profile

Last updated 11 months ago