apparmor aa-unconfined: unconfined systemd korrektes Profil?

Steinlaus · 2 Jan. 2013

Liebe Mods: Das würde theoretisch unter "Sicherheit und Backup" passen, ist aber kein Server. Also denke ich es gehört hier hin? (Oder kann man unter Sicherheit auch posten wenn man keine Server hat? (Habe z.B. auch eine frage über einen rkhunter output (userrights) und wäre dankbar zu wissen wo es richtig wäre zu posten. Danke)

Zweck: Systemschutz

System:
Laptop, (oft auf unbeschützten Wlan, mit ovpn, tor, ecc). Habe schon mehrere Angriffe erlebt.

O.S. openSUSE 12.2 "standart+packman" 64 bit.

Kernel:
3.4.11-2.16-desktop #1 SMP PREEMPT Wed Sep 26 17:05:00 UTC 2012 (259fc87) x86_64 x86_64 x86_64 GNU/Linux

Apparmor (status):

Code:

aa-status
apparmor module is loaded.
68 profiles are loaded.
31 profiles are in enforce mode.
   /sbin/klogd
   /sbin/syslog-ng
   /sbin/syslogd
   /usr/lib/apache2/mpm-prefork/apache2
   /usr/lib/apache2/mpm-prefork/apache2//DEFAULT_URI
   /usr/lib/apache2/mpm-prefork/apache2//HANDLING_UNTRUSTED_INPUT
   /usr/lib/apache2/mpm-prefork/apache2//phpsysinfo
   /usr/lib/dovecot/deliver
   /usr/lib/dovecot/dovecot-auth
   /usr/lib/dovecot/imap
   /usr/lib/dovecot/imap-login
   /usr/lib/dovecot/managesieve-login
   /usr/lib/dovecot/pop3
   /usr/lib/dovecot/pop3-login
   /usr/lib64/libvirt/virt-aa-helper
   /usr/sbin/avahi-daemon
   /usr/sbin/cupsd
   /usr/sbin/dnsmasq
   /usr/sbin/dovecot
   /usr/sbin/identd
   /usr/sbin/libvirtd
   /usr/sbin/mdnsd
   /usr/sbin/nmbd
   /usr/sbin/nscd
   /usr/sbin/ntpd
   /usr/sbin/smbd
   /usr/sbin/smbldap-useradd
   /usr/sbin/smbldap-useradd///etc/init.d/nscd
   /usr/sbin/winbindd
   /usr/{sbin/traceroute,bin/traceroute.db}
   /{usr/,}bin/ping
37 profiles are in complain mode.
   /lib/systemd/systemd
   /sbin/dhclient
   /sbin/dhclient//null-2a
   /sbin/dhclient//null-2b
   /usr/bin/ktorrent
   /usr/bin/opera
   /usr/bin/tor
   /usr/lib/postfix/master
   /usr/lib64/chromium/chromium-kde
   /usr/lib64/firefox/firefox.sh
   /usr/lib64/firefox/firefox.sh//null-2c
   /usr/lib64/firefox/firefox.sh//null-2d
   /usr/lib64/firefox/firefox.sh//null-2e
   /usr/lib64/firefox/firefox.sh//null-2f
   /usr/lib64/firefox/firefox.sh//null-2f//null-30
   /usr/lib64/firefox/firefox.sh//null-2f//null-31
   /usr/lib64/firefox/firefox.sh//null-2f//null-32
   /usr/lib64/firefox/firefox.sh//null-2f//null-33
   /usr/lib64/firefox/firefox.sh//null-2f//null-34
   /usr/lib64/firefox/firefox.sh//null-2f//null-35
   /usr/lib64/firefox/firefox.sh//null-2f//null-35//null-36
   /usr/lib64/firefox/firefox.sh//null-2f//null-35//null-37
   /usr/lib64/firefox/firefox.sh//null-2f//null-35//null-38
   /usr/lib64/firefox/firefox.sh//null-2f//null-35//null-39
   /usr/lib64/firefox/firefox.sh//null-2f//null-35//null-39//null-3a
   /usr/lib64/firefox/firefox.sh//null-2f//null-35//null-39//null-3b
   /usr/lib64/firefox/firefox.sh//null-3c
   /usr/lib64/firefox/firefox.sh//null-3d
   /usr/lib64/firefox/firefox.sh//null-3e
   /usr/lib64/firefox/firefox.sh//null-3f
   /usr/lib64/firefox/firefox.sh//null-40
   /usr/lib64/firefox/firefox.sh//null-41
   /usr/lib64/firefox/firefox.sh//null-42
   /usr/lib64/firefox/firefox.sh//null-43
   /usr/lib64/firefox/firefox.sh//null-44
   /usr/lib64/firefox/firefox.sh//null-45
   /usr/sbin/privoxy
12 processes have profiles defined.
2 processes are in enforce mode.
   /usr/sbin/avahi-daemon (1397) 
   /usr/sbin/cupsd (3048) 
9 processes are in complain mode.
   /sbin/dhclient (3197) 
   /usr/bin/tor (1806) 
   /usr/lib/postfix/master (2383) 
   /usr/lib/postfix/master (2403) 
   /usr/lib/postfix/master (2404) 
   /usr/lib64/firefox/firefox.sh//null-2f//null-35 (8137) 
   /usr/lib64/firefox/firefox.sh//null-2f//null-35//null-38 (8419) 
   /usr/lib64/firefox/firefox.sh//null-2f//null-35//null-39 (8422) 
   /usr/sbin/privoxy (3502) 
1 processes are unconfined but have a profile defined.
   /lib/systemd/systemd (1)

Frage: warum ist /lib/systemd/systemd "unconfined" auch wenn ich ein Profil mit "complain" eingerichtet habe. Ist dies eine sichere (unvermeidbare) Einstellung?

apparmor aa-unconfined: unconfined systemd korrektes Profil?

Steinlaus

Newbie