Amazon-ssm-agent: Unable to put AppArmor profile into enforce mode when installing from Snap on Ubuntu

[srkiNZ84]

Hi,

We have a CIS requirement that all AppArmor profiles/processes are in "enforce" mode and none are in "complain" mode.

When installing the agent on Ubuntu 16.04 from snap (actually came pre-installed with AMI) we can see that the profile and process is in "complain" mode:

# apparmor_status
apparmor module is loaded.
24 profiles are loaded.
22 profiles are in enforce mode.
   /sbin/dhclient
...
   snap.core.hook.configure
2 profiles are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent
   snap.amazon-ssm-agent.ssm-cli
3 processes have profiles defined.
2 processes are in enforce mode.
   /sbin/dhclient (1097)
   /usr/sbin/rsyslogd (1262)
1 processes are in complain mode.
   snap.amazon-ssm-agent.amazon-ssm-agent (11647)

This is fine. However, when I try to put it into "enforce" mode, it appears that it is unable to find the AppArmor "profile" or the "binary":

# aa-enforce /snap/amazon-ssm-agent/current/amazon-ssm-agent
Profile for /snap/amazon-ssm-agent/295/amazon-ssm-agent not found, skipping

# aa-enforce snap.amazon-ssm-agent.amazon-ssm-agent
Can't find snap.amazon-ssm-agent.amazon-ssm-agent in the system path list. If the name of the application
is correct, please run 'which snap.amazon-ssm-agent.amazon-ssm-agent' as a user with correct PATH
environment set up in order to find the fully-qualified path and
use the full path as parameter.

# aa-enforce amazon-ssm-agent
Profile for /usr/bin/amazon-ssm-agent not found, skipping

# aa-enforce /snap/amazon-ssm-agent/295/amazon-ssm-agent
Profile for /snap/amazon-ssm-agent/295/amazon-ssm-agent not found, skipping

etc...

To further complicate matters, I can't seem to find the profile under /etc/apparmor.d anywhere:

# ls -al /etc/apparmor.d/
total 116
drwxr-xr-x   9 root root  4096 Jul 26 00:25 .
drwxr-xr-x 109 root root  4096 Jul 25 19:57 ..
drwxr-xr-x   5 root root  4096 Jul 23 02:53 abstractions
drwxr-xr-x   2 root root  4096 Jul 26 00:25 cache
drwxr-xr-x   2 root root  4096 Jul 17 23:05 disable
drwxr-xr-x   2 root root  4096 Apr  5  2016 force-complain
drwxr-xr-x   2 root root  4096 Jul 17 23:07 local
drwxr-xr-x   2 root root  4096 May 22 10:55 lxc
-rw-r--r--   1 root root   198 Jun 14  2017 lxc-containers
-rw-r--r--   1 root root  3394 Jul 17 23:05 sbin.dhclient
-rw-r--r--   1 root root 21845 Jul 26 00:25 snap.core.4917.usr.lib.snapd.snap-confine
drwxr-xr-x   5 root root  4096 May 22 10:55 tunables
-rw-r--r--   1 root root  1029 Jul 11 19:40 usr.bin.freshclam
-rw-r--r--   1 root root   125 Jul 17 23:05 usr.bin.lxc-start
-rw-r--r--   1 root root   281 Jul 17 23:05 usr.lib.lxd.lxd-bridge-proxy
-rw-r--r--   1 root root 21155 Jul 17 23:05 usr.lib.snapd.snap-confine.real
-rw-r--r--   1 root root  1142 Jan 18  2018 usr.sbin.clamd
-rw-r--r--   1 root root  1543 Jul 17 23:05 usr.sbin.rsyslogd
-rw-r--r--   1 root root  1469 Jul 17 23:05 usr.sbin.tcpdump

or in fact in any of the source code from this repository to be able to find the binary path that the profile refers to.

I'm guessing that this is somehow dynamically generated by Snap maybe?

Any help with this would be appreciated and apologies if I've opened this issue in the wrong place (e.g. should go in the Snap or AppArmor issue tracker).

[srkiNZ84]

Ok, have found the profile under /var/lib/snapd/apparmor/profiles/snap.amazon-ssm-agent.amazon-ssm-agent but nothing in the contents of the file seems to suggest the "correct" name to give to the binary:

#include <tunables/global>

@{SNAP_NAME}="amazon-ssm-agent"
@{SNAP_REVISION}="295"
@{PROFILE_DBUS}="snap_2eamazon_2dssm_2dagent_2eamazon_2dssm_2dagent"
@{INSTALL_DIR}="/{,var/lib/snapd/}snap"

profile "snap.amazon-ssm-agent.amazon-ssm-agent" (attach_disconnected,mediate_deleted,complain) {
  # set file rules so that exec() inherits our profile unless there is
  # already a profile for it (eg, snap-confine)
  / rwkl,
  /** rwlkm,
  /** pix,

  capability,
  change_profile,
  dbus,
  network,
  mount,
  remount,
  umount,
  pivot_root,
  ptrace,
  signal,
  unix,


}

[srkiNZ84]

Have also asked on the Snapcraft forums about this: https://forum.snapcraft.io/t/amazon-ssm-agent-apparmor-profile-not-allowing-enforce-mode/6539

[mmendonca3]

Hi srkiNZ84,

Thank you for your interest in Amazon SSM Agent! This would be a question to ask Snapcraft, which you have already done. I will be closing this issue since the issue seems to have been answered there. Please feel free to reopen it if you have any other questions here.