AppArmor Unix Socket Rules Need Both Sides

AppArmor Unix Socket Rules Need Both Sides Unix domain sockets are a common control channel for local services. They often bypass network inspection, rely on filesystem permissions, or…

AppArmor Unix Socket Rules Need Both Sides Unix domain sockets are a common control channel for local services. They often bypass network inspection, rely on filesystem permissions, or use abstract names that do not appear as files. AppArmor can mediate these connections with fine-grained Unix socket rules, but a profile that allows one side of a conversation is not a complete policy. The AppArmor apparmor.d(5) documentation describes mediation of filesystem-based, abstract, and anonymous Unix domain sockets.

The rules can distinguish the socket address, the peer label, and the operation. On systems with fine-grained mediation, the older coarse network rule maps into the equivalent socket rule. This is useful for local service isolation, provided the policy is tested against the actual peer identities. Addresses and labels are different controls A filesystem socket has a path. An abstract socket has an address in the abstract namespace and does not have a persistent directory entry.

A profile can match an address pattern, but the address alone does not prove that the peer is trusted. The peer's AppArmor label is a separate signal. A policy should consider both when the platform supports it. The documentation notes that pattern matching follows file-path rules in ways that can surprise authors. A wildcard that seems to match one directory level may not match a slash inside the address. Abstract names also have their own representation.

Do not copy a filesystem-path pattern into an abstract-socket rule and assume that the meaning is unchanged. When a service listens on a socket, protect the listen path and the connect path. A client may be allowed to connect while the server is also allowed to accept from any peer. A compromised client could then talk to a more privileged service that the profile did not intend to reach. The profile also needs to cover helpers and short-lived processes that inherit the same label.

Fail closed, but verify the failure The AppArmor documentation notes that mediation can fail closed when memory allocation fails. That is the right default, but it can produce an ambiguous operational failure. A service may see ENOMEM or a connection denial during a resource spike. Logs should identify the profile and the rule that denied the operation without dumping message contents or credentials. Test with a real peer label.