# User Armor: An Extension for AppArmor
## 3 User Armor  
The tag system uses a comment-based syntax, described below. Rules (and blocks) are associated with aliases (i.e., identifying strings). * Base rules. Untagged rules are considered essential and are automatically inherited by all subprofiles. * Selectable rules. Rules starting with a tagare not inherited automatically (and are not part of the main profile), but they can be included in the subprofiles via their alias. * Selectable blocks. A syntax similar to the previous one can be applied to rule blocks as follows: #@selectable(ALIAS) # _Rulles_ #@end
* Removable rules. Rules ending with a tag #@removable{ALIAS} are inherited in subprofiles unless explicitly removed by their alias. Removable rules enable the possibility to have a more relaxed base policy (which can ease the gradual integration of UserArmor, but this is discouraged on a stable environment). Note that there is no notion of a removable block. * Subprofile inheritance. Subprofiles can select rules and blocks using the following tag: #@select: ALIASES where ALIASES is a space-separated list of aliases. Selected rules and blocks are added to the basic rules. Untagged rules are added at the beginning of each subprofile, unless their alias is listed in the following tag: #@remove: ALIASES The tag system is applied to profile files within a directory associated with the confined application. The directory contains a profile file for each involved user and a mappinga file that includes all the other files in the directory. The mappings file can then be included in the profile file in /etc/apparmor.d. In this way, AppArmor loads subprofiles into the kernel with name confined_app/user_name, and UserArmor can easily apply the correct profile by identifying the user who is running the application. **Example 3** (Continuing Example 2). : _The scenario depicted in the introduction can be modeled by the following profile file /etc/apparmor.d/usr.bin.my.confined.app: #include <tunables/global> /usr/bin/my.confined.app { #include <abstractions/base> #include <abstractions/bash> /usr/bin/my.confined.app _r, /etc/my.confined.app.conf _r, /usr/bin/cat iz, #@selectable(adm)capabilitysys_admin, #@selectable(net)networkinet, include ifexists <.usr.bin.my.confined.app/mappings> } Additional files are stored in the directory /etc/apparmor.d/.usr.bin.my.confined.app, as follows: * user1, associated with the first user, with the following content: profile user1 #select: admnet /var/log/my.confined.app/user1.log _rw, } user2, associated with the second user, with the following content: profile user2 {  
#select: net /var/log/my_confined_app/user2.logrw, } mappings, including the above files with the expansion of the selected permissions, as follows: profileuser1 { #select: admnet capability sys_admin, networkinet, /var/log/my_confined_app/user1.logrw, } profileuser2 { #select: adm networkinet, /var/log/my_confined_app/user2.logrw, } UserArmor simplifies the creation of the above files by automatically adding the include if exists <.usr.bin.my.confined_app/mappings> directive in the profile of the confined application and generating the content of the file /etc/apparmor.d/.usr.bin.my.confined_app/mappings. UserArmor comprises the following three command-line utilities: ua-generate, ua-enforce, and ua-exec. These tools simplify the process of defining and enforcing user-specific security policies, ensuring that applications run with the appropriate restrictions based on the user executing them. The ua-generate command is the starting point for setting up UserArmor. Given the absolute path of an executable and a comma-separated list of users, it automatically creates the necessary directory structure and generates a subprofile file for each specified user. If a subprofile already exists, it remains unchanged, preventing unintended overwrites. Since this command modifies AppArmor profiles, it must be executed with superuser privileges. Once the user-specific profiles are in place, ua-enforce takes over to integrate them into the main AppArmor profile of the executable.