AppArmor Unix Socket Rules Need Both Sides
Unix domain sockets are a common control channel for local services. They often bypass network inspection, rely on filesystem permissions, or use abstract names that do not appear as files. AppArmor can mediate these connections with fine-grained Unix socket rules, but a profile that allows one side of a conversation is not a complete policy.
The AppArmor apparmor.d(5) documentation describes mediation of filesystem-based, abstract, and anonymous Unix domain sockets. The rules can distinguish the socket address, the peer label, and the operation. On systems with fine-grained mediation, the older coarse network rule maps into the equivalent socket rule. This is useful for local service isolation, provided the policy is tested against the actual peer identities.
Addresses and labels are different controls
A filesystem socket has a path. An abstract socket has an address in the abstract namespace and does not have a persistent directory entry. A profile can match an address pattern, but the address alone does not prove that the peer is trusted. The peer's AppArmor label is a separate signal. A policy should consider both when the platform supports it.
The documentation notes that pattern matching follows file-path rules in ways that can surprise authors. A wildcard that seems to match one directory level may not match a slash inside the address. Abstract names also have their own representation. Do not copy a filesystem-path pattern into an abstract-socket rule and assume that the meaning is unchanged.
When a service listens on a socket, protect the listen path and the connect path. A client may be allowed to connect while the server is also allowed to accept from any peer. A compromised client could then talk to a more privileged service that the profile did not intend to reach. The profile also needs to cover helpers and short-lived processes that inherit the same label.
Fail closed, but verify the failure
The AppArmor documentation notes that mediation can fail closed when memory allocation fails. That is the right default, but it can produce an ambiguous operational failure. A service may see ENOMEM or a connection denial during a resource spike. Logs should identify the profile and the rule that denied the operation without dumping message contents or credentials.
Test with a real peer label. Creating a socket as root and connecting as the same user does not exercise the intended policy if both processes share the same profile. Run the client under its own profile, attempt the connection, and capture the audit result. Then review the server's accept path and the client's connect path independently.
A practical profile review
Start with an inventory of local control channels:
- socket path or abstract name;
- listener process and profile;
- expected client processes and labels;
- operations each client needs;
- credentials carried over the socket;
- filesystem permissions and mount views.
Then remove broad rules that allow any peer to reach a privileged operation. If a service supports multiple clients, separate the privileged endpoint from the management endpoint or use an application-level authorization check. AppArmor can constrain the peer, but the server still needs to validate the request.
Use runtime policy tests as part of the deployment. A profile that was loaded successfully is not necessarily the profile that is enforcing the intended rule. Check the loaded profile, the kernel feature set, and the audit log. Record the test result with the service version and the host image.
Where the profile ends
Unix socket mediation does not protect data after a trusted process receives it. A permitted client can send a malicious payload; a permitted server can expose a file through its own business logic. The profile also does not replace filesystem permissions, service authentication, or least-privilege process identities.
The useful goal is to make the local conversation explicit: this client label may connect to this address, this server may accept from this label, and no unrelated process may inherit the path. That is a small boundary, but it is often the one that separates an exposed management plane from the rest of the host.
Top comments (0)