「AppArmorのサービスのコントロール」の版間の差分
提供: セキュリティ
(ページの作成：「AppArmor のサービスのコントロールは、 /etc/init.d/apparmor を使用します。 '''読み方''' ;[[{{PAGENAME}}]]: __TOC__ == 概要 == [[{{PAGENA...」) |
|||
| 行18: | 行18: | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
sudo /etc/init.d/apparmor start | sudo /etc/init.d/apparmor start | ||
| + | </syntaxhighlight> | ||
| + | |||
| + | <syntaxhighlight lang="bash"> | ||
| + | user@ubuntu2:~$ sudo /etc/init.d/apparmor start | ||
| + | * Starting AppArmor profiles | ||
| + | Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd | ||
| + | ...done. | ||
</syntaxhighlight> | </syntaxhighlight> | ||
| 行28: | 行35: | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
sudo /etc/init.d/apparmor stop | sudo /etc/init.d/apparmor stop | ||
| + | </syntaxhighlight> | ||
| + | |||
| + | <syntaxhighlight lang="bash"> | ||
| + | user@ubuntu2:~$ sudo /etc/init.d/apparmor stop | ||
| + | * Clearing AppArmor profiles cache | ||
| + | ...done. | ||
| + | All profile caches have been cleared, but no profiles have been unloaded. | ||
| + | Unloading profiles will leave already running processes permanently | ||
| + | unconfined, which can lead to unexpected situations. | ||
| + | |||
| + | To set a process to complain mode, use the command line tool | ||
| + | 'aa-complain'. To really tear down all profiles, run the init script | ||
| + | with the 'teardown' option." | ||
| + | </syntaxhighlight> | ||
| + | |||
| + | == 完全に止める == | ||
| + | |||
| + | <syntaxhighlight lang="bash"> | ||
| + | sudo /etc/init.d/apparmor teardown | ||
| + | </syntaxhighlight> | ||
| + | |||
| + | 停止した場合のステータスは、以下のようになります。 | ||
| + | <syntaxhighlight lang="bash"> | ||
| + | user@ubuntu2:~$ sudo /etc/init.d/apparmor teardown | ||
| + | * Unloading AppArmor profiles | ||
| + | ...done. | ||
| + | user@ubuntu2:~$ sudo /etc/init.d/apparmor status | ||
| + | apparmor module is loaded. | ||
| + | 0 profiles are loaded. | ||
| + | 0 profiles are in enforce mode. | ||
| + | 0 profiles are in complain mode. | ||
| + | 0 processes have profiles defined. | ||
| + | 0 processes are in enforce mode. | ||
| + | 0 processes are in complain mode. | ||
| + | 0 processes are unconfined but have a profile defined. | ||
</syntaxhighlight> | </syntaxhighlight> | ||
| 行83: | 行125: | ||
* [[AppArmor]] | * [[AppArmor]] | ||
* [[AppArmorのステータスを確認する]] | * [[AppArmorのステータスを確認する]] | ||
| + | * [[AppArmorのコマンド]] | ||
| + | * [[AppArmorの設定]] | ||
* [[セキュアOS]] | * [[セキュアOS]] | ||
<!-- | <!-- | ||
vim: filetype=mediawiki | vim: filetype=mediawiki | ||
--> | --> | ||
2013年9月23日 (月) 19:02時点における最新版
AppArmor のサービスのコントロールは、 /etc/init.d/apparmor を使用します。
読み方
- AppArmorのサービスのコントロール
概要
AppArmorのサービスのコントロール
AppArmor のサービスのコントロールは、 /etc/init.d/apparmor を使用します。
$ /etc/init.d/apparmor Usage: /etc/init.d/apparmor {start|stop|restart|reload|force-reload|status|recache}
スタート
sudo /etc/init.d/apparmor start
user@ubuntu2:~$ sudo /etc/init.d/apparmor start * Starting AppArmor profiles Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd ...done.
再起動
sudo /etc/init.d/apparmor restart
停止
sudo /etc/init.d/apparmor stop
user@ubuntu2:~$ sudo /etc/init.d/apparmor stop * Clearing AppArmor profiles cache ...done. All profile caches have been cleared, but no profiles have been unloaded. Unloading profiles will leave already running processes permanently unconfined, which can lead to unexpected situations. To set a process to complain mode, use the command line tool 'aa-complain'. To really tear down all profiles, run the init script with the 'teardown' option."
完全に止める
sudo /etc/init.d/apparmor teardown
停止した場合のステータスは、以下のようになります。
user@ubuntu2:~$ sudo /etc/init.d/apparmor teardown * Unloading AppArmor profiles ...done. user@ubuntu2:~$ sudo /etc/init.d/apparmor status apparmor module is loaded. 0 profiles are loaded. 0 profiles are in enforce mode. 0 profiles are in complain mode. 0 processes have profiles defined. 0 processes are in enforce mode. 0 processes are in complain mode. 0 processes are unconfined but have a profile defined.
設定の反映
sudo /etc/init.d/apparmor reload
ステータスの確認
AppArmorのステータスを確認するには、/etc/init.d/apparmor status のほかに、 aa-status でも確認できます。 AppArmorのステータスを確認する を参照してください。
$ sudo /etc/init.d/apparmor status apparmor module is loaded. 30 profiles are loaded. 7 profiles are in enforce mode. /sbin/dhclient /usr/lib/NetworkManager/nm-dhcp-client.action /usr/lib/chromium-browser/chromium-browser//browser_java /usr/lib/chromium-browser/chromium-browser//browser_openjdk /usr/lib/chromium-browser/chromium-browser//sanitized_helper /usr/lib/connman/scripts/dhclient-script /usr/sbin/tcpdump 23 profiles are in complain mode. /bin/ping /sbin/klogd /sbin/syslog-ng /sbin/syslogd /usr/lib/chromium-browser/chromium-browser /usr/lib/chromium-browser/chromium-browser//chromium_browser_sandbox /usr/lib/chromium-browser/chromium-browser//xdgsettings /usr/lib/dovecot/deliver /usr/lib/dovecot/dovecot-auth /usr/lib/dovecot/imap /usr/lib/dovecot/imap-login /usr/lib/dovecot/managesieve-login /usr/lib/dovecot/pop3 /usr/lib/dovecot/pop3-login /usr/sbin/avahi-daemon /usr/sbin/dnsmasq /usr/sbin/dovecot /usr/sbin/identd /usr/sbin/mdnsd /usr/sbin/nmbd /usr/sbin/nscd /usr/sbin/smbd /usr/{sbin/traceroute,bin/traceroute.db} 0 processes have profiles defined. 0 processes are in enforce mode. 0 processes are in complain mode. 0 processes are unconfined but have a profile defined.