Debian Handbook/14_security — Spanish @ Hosted Weblate: <computeroutput># </computeroutput><userinput>aa-unconfined </userinput><computeroutput>451 /usr/bin/containerd not confined 467 /usr/sbin/sshd (sshd: /usr/sbin/sshd …

	English	Spanish	Actions
	<computeroutput># </computeroutput><userinput>aa-enforce /usr/bin/pidgin</userinput> <computeroutput>Setting /usr/bin/pidgin to enforce mode.</computeroutput> <computeroutput># </computeroutput><userinput>aa-complain /usr/sbin/dnsmasq</userinput> <computeroutput>Setting /usr/sbin/dnsmasq to complain mode.</computeroutput>	<computeroutput># </computeroutput><userinput>aa-enforce /usr/bin/pidgin</userinput> <computeroutput>Setting /usr/bin/pidgin to enforce mode.</computeroutput> <computeroutput># </computeroutput><userinput>aa-complain /usr/sbin/dnsmasq</userinput> <computeroutput>Setting /usr/sbin/dnsmasq to complain mode.</computeroutput>
	Creating a new profile	Creación de un nuevo perfil
	Even though creating an AppArmor profile is rather easy, most programs do not have one. This section will show you how to create a new profile from scratch just by using the target program and letting AppArmor monitor the system call it makes and the resources it accesses.	A pesar de que crear un perfil AppArmor es bastante sencillo, la mayoría de los programas no disponen de uno. Esta sección muestra cómo crear un nuevo perfil desde cero, símplemente utilizando el programa deseado y dejando que AppArmor monitorice las llamadas al sistema que realiza y los recursos a los que accede.
	<primary><command>aa-unconfined</command></primary>	<primary><command>ping</command></primary>
	The most important programs that need to be confined are the network facing programs as those are the most likely targets of remote attackers. That is why AppArmor conveniently provides an <command>aa-unconfined</command> command to list the programs which have no associated profile and which expose an open network socket. With the <literal>--paranoid</literal> option you get all unconfined processes that have at least one active network connection.	Los programas que deben ser confinados de forma prioritaria son aquellos expuestos a la red, puesto que estos serán los blancos más probables para atacantes remotos. Precisamente por eso AppArmor proporciona la orden <command>aa-unconfined</command>, que lista los programas que exponen al menos un zócalo de red (NT: ¿mejor puerto de red?) sin tener ningún perfil asociado. Con la opción <literal>--paranoid</literal> se obtienen todos los procesos que tienen activa al menos una conexión de red y no están confinados.
	<computeroutput># </computeroutput><userinput>aa-unconfined </userinput><computeroutput>451 /usr/bin/containerd not confined 467 /usr/sbin/sshd (sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups) not confined 892 /usr/sbin/exim4 not confined </computeroutput>	<computeroutput>$ </computeroutput><userinput>id -Z</userinput> <computeroutput>unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023</computeroutput>
	In the following example, we will thus try to create a profile for <command>/sbin/dhclient</command> (there already is a profile shipped by <emphasis role="pkg">apparmor-profiles</emphasis>, so you can compare your results to the official one). For this we will use <command>aa-genprof dhclient</command>. It will invite you to use the application in another window and when done to come back to <command>aa-genprof</command> to scan for AppArmor events in the system logs and convert those logs into access rules. For each logged event, it will make one or more rule suggestions that you can either approve or further edit in multiple ways:	El el ejemplo siguiente vamos a intentar crear un perfil para <command>/sbin/dhclient</command>. Para ello utilzamos la orden <command>aa-genprof dhclient</command>. En Debian <emphasis role="distribution">Buster</emphasis> hay un error conocido<footnote><para><ulink url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928160" /></para></footnote> que hace que la orden anterior falle con el siguiente error: <computeroutput>ERROR: Include file /etc/apparmor.d/local/usr.lib.dovecot.deliver not found</computeroutput>. Para arraglarlo cree los archivos que falten con <command>touch <replaceable>file</replaceable></command>. Nos invitará a utilizar la aplicación (en otra ventana) y a volver a <command>aa-genprof</command> una vez que hayamos terminado, para escrutar los registros en busca de eventos AppArmor y convertir estos registros en reglas de control de acceso. Para cada evento registrado se proponen una o varias sugerencias de reglas y será posible aprobarlas o modificarlas de distintas formas:
	<computeroutput># </computeroutput><userinput>aa-genprof dhclient </userinput><computeroutput>Writing updated profile for /usr/sbin/dhclient. Setting /usr/sbin/dhclient to complain mode. Before you begin, you may wish to check if a profile already exists for the application you wish to confine. See the following wiki page for more information: https://gitlab.com/apparmor/apparmor/wikis/Profiles Profiling: /usr/sbin/dhclient Please start the application to be profiled in another window and exercise its functionality now. Once completed, select the "Scan" option below in order to scan the system logs for AppArmor events. For each AppArmor event, you will be given the opportunity to choose whether the access should be allowed or denied. [(S)can system log for AppArmor events] / (F)inish <userinput>S</userinput> Reading log entries from /var/log/syslog. Profile: /usr/sbin/dhclient <co id="aa-genprof-execute"></co> Execute: /usr/sbin/dhclient-script Severity: unknown (I)nherit / (C)hild / (P)rofile / (N)amed / (U)nconfined / (X) ix On / (D)eny / Abo(r)t / (F)inish <userinput>P</userinput> Should AppArmor sanitise the environment when switching profiles? Sanitising environment is more secure, but some applications depend on the presence of LD_PRELOAD or LD_LIBRARY_PATH. [(Y)es] / (N)o <userinput>Y</userinput> Writing updated profile for /usr/sbin/dhclient-script. Complain-mode changes: Profile: /usr/sbin/dhclient <co id="aa-genprof-capability"></co> Capability: net_raw Severity: 8 [1 - capability net_raw,] (A)llow / [(D)eny] / (I)gnore / Audi(t) / Abo(r)t / (F)inish <userinput>A</userinput> Adding capability net_raw, to profile. Profile: /usr/sbin/dhclient Capability: net_bind_service Severity: 8 [1 - #include <abstractions/nis>] 2 - capability net_bind_service, (A)llow / [(D)eny] / (I)gnore / Audi(t) / Abo(r)t / (F)inish <userinput>A</userinput> Adding #include <abstractions/nis> to profile. Profile: /usr/sbin/dhclient <co id="aa-genprof-read"></co> Path: /etc/ssl/openssl.cnf New Mode: owner r Severity: 2 [1 - #include <abstractions/lightdm>] 2 - #include <abstractions/openssl> 3 - #include <abstractions/ssl_keys> 4 - owner /etc/ssl/openssl.cnf r, (A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish <userinput>2</userinput> Profile: /usr/sbin/dhclient Path: /etc/ssl/openssl.cnf New Mode: owner r Severity: 2 1 - #include <abstractions/lightdm> [2 - #include <abstractions/openssl>] 3 - #include <abstractions/ssl_keys> 4 - owner /etc/ssl/openssl.cnf r, [(A)llow] / (D)eny / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Abo(r)t / (F)inish / (M)ore <userinput>A</userinput> [...] Profile: /usr/sbin/dhclient-script <co id="aa-genprof-other-profile"></co> Path: /usr/bin/dash New Mode: owner r Severity: unknown 1 - #include <abstractions/gvfs-open> [2 - #include <abstractions/lightdm>] 3 - #include <abstractions/ubuntu-browsers.d/plugins-common> 4 - #include <abstractions/xdg-open> 5 - owner /usr/bin/dash r, (A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish <userinput>A</userinput> Adding #include <abstractions/lightdm> to profile. Deleted 2 previous matching profile entries. = Changed Local Profiles = The following local profiles were changed. Would you like to save them? [1 - /usr/sbin/dhclient] 2 - /usr/sbin/dhclient-script (S)ave Changes / Save Selec(t)ed Profile / [(V)iew Changes] / View Changes b/w (C)lean profiles / Abo(r)t <userinput>S</userinput> Writing updated profile for /usr/sbin/dhclient. Writing updated profile for /usr/sbin/dhclient-script. Profiling: /usr/sbin/dhclient Please start the application to be profiled in another window and exercise its functionality now. Once completed, select the "Scan" option below in order to scan the system logs for AppArmor events. For each AppArmor event, you will be given the opportunity to choose whether the access should be allowed or denied. [(S)can system log for AppArmor events] / (F)inish <userinput>F</userinput> Setting /usr/sbin/dhclient to enforce mode. Setting /usr/sbin/dhclient-script to enforce mode. Reloaded AppArmor profiles in enforce mode. Please consider contributing your new profile! See the following wiki page for more information: https://gitlab.com/apparmor/apparmor/wikis/Profiles Finished generating profile for /usr/sbin/dhclient.</computeroutput>	<computeroutput># </computeroutput><userinput>aa-genprof dhclient</userinput> <computeroutput>Writing updated profile for /usr/sbin/dhclient. Setting /usr/sbin/dhclient to complain mode. Before you begin, you may wish to check if a profile already exists for the application you wish to confine. See the following wiki page for more information: https://gitlab.com/apparmor/apparmor/wikis/Profiles Profiling: /usr/sbin/dhclient Please start the application to be profiled in another window and exercise its functionality now. Once completed, select the "Scan" option below in order to scan the system logs for AppArmor events. For each AppArmor event, you will be given the opportunity to choose whether the access should be allowed or denied. [(S)can system log for AppArmor events] / (F)inish Reading log entries from /var/log/syslog. Updating AppArmor profiles in /etc/apparmor.d. Profile: /usr/sbin/dhclient <co id="aa-genprof-execute"></co> Execute: /usr/sbin/dhclient-script Severity: unknown (I)nherit / (C)hild / (P)rofile / (N)amed / (U)nconfined / (X) ix On / (D)eny / Abo(r)t / (F)inish <userinput>P</userinput> Should AppArmor sanitise the environment when switching profiles? Sanitising environment is more secure, but some applications depend on the presence of LD_PRELOAD or LD_LIBRARY_PATH. (Y)es / [(N)o] <userinput>Y</userinput> Writing updated profile for /usr/sbin/dhclient-script. Complain-mode changes: Profile: /usr/sbin/dhclient <co id="aa-genprof-capability"></co> Capability: net_raw Severity: 8 [1 - capability net_raw,] [(A)llow] / (D)eny / (I)gnore / Audi(t) / Abo(r)t / (F)inish <userinput>A</userinput> Adding capability net_raw to profile. Profile: /sbin/dhclient Capability: net_bind_service Severity: 8 [1 - #include <abstractions/nis> ] 2 - capability net_bind_service, (A)llow / [(D)eny] / (I)gnore / Audi(t) / Abo(r)t / (F)inish <userinput>A</userinput> Adding #include <abstractions/nis> to profile. Profile: /usr/sbin/dhclient <co id="aa-genprof-read"></co> Path: /etc/ssl/openssl.cnf New Mode: owner r Severity: 2 [1 - #include <abstractions/lightdm>] 2 - #include <abstractions/openssl> 3 - #include <abstractions/ssl_keys> 4 - owner /etc/ssl/openssl.cnf r, (A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish <userinput>2</userinput> Profile: /usr/sbin/dhclient Path: /etc/ssl/openssl.cnf New Mode: owner r Severity: 2 1 - #include <abstractions/lightdm> [2 - #include <abstractions/openssl>] 3 - #include <abstractions/ssl_keys> 4 - owner /etc/ssl/openssl.cnf r, [(A)llow] / (D)eny / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Abo(r)t / (F)inish / (M)ore <userinput>A</userinput> [...] Profile: /usr/sbin/dhclient-script <co id="aa-genprof-other-profile"></co> Path: /usr/bin/dash New Mode: owner r Severity: unknown [1 - #include <abstractions/lightdm>] 2 - #include <abstractions/ubuntu-browsers.d/plugins-common> 3 - owner /usr/bin/dash r, (A)llow / [(D)eny] / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Audi(t) / (O)wner permissions off / Abo(r)t / (F)inish <userinput>A</userinput> Adding #include <abstractions/lightdm> to profile. Deleted 2 previous matching profile entries. = Changed Local Profiles = The following local profiles were changed. Would you like to save them? [1 - /usr/sbin/dhclient] 2 - /usr/sbin/dhclient-script (S)ave Changes / Save Selec(t)ed Profile / [(V)iew Changes] / View Changes b/w (C)lean profiles / Abo(r)t <userinput>S</userinput> Writing updated profile for /usr/sbin/dhclient. Writing updated profile for /usr/sbin/dhclient-script. Profiling: /usr/sbin/dhclient Please start the application to be profiled in another window and exercise its functionality now. Once completed, select the "Scan" option below in order to scan the system logs for AppArmor events. For each AppArmor event, you will be given the opportunity to choose whether the access should be allowed or denied. [(S)can system log for AppArmor events] / (F)inish <userinput>F</userinput> Reloaded AppArmor profiles in enforce mode. Please consider contributing your new profile! See the following wiki page for more information: https://gitlab.com/apparmor/apparmor/wikis/Profiles Finished generating profile for /usr/sbin/dhclient.</computeroutput>
	Note that the program does not display back the control characters that you type but for the clarity of the explanation we have included them in the previous transcript.	Tenga en cuenta que el programa no muestra los caracteres de control que Vd. teclea; los hemos incluido en la transcripción anterior para aclarar las elecciones realizadas en cada paso.
	The first event detected is the execution of another program. In that case, you have multiple choices: you can run the program with the profile of the parent process (the “Inherit” choice), you can run it with its own dedicated profile (the “Profile” and the “Named” choices, differing only by the possibility to use an arbitrary profile name), you can run it with a sub-profile of the parent process (the “Child” choice), you can run it without any profile (the “Unconfined” choice) or you can decide to not run it at all (the “Deny” choice).	El primer evento detectado es la ejecución de otro programa. En este caso se ofrecen varias opciones: puede lanzar el programa con el perfil del programa padre (“Inherit”), con un perfil dedicado (“Profile” o “Name”, que sólo se diferencian por la posibilidad de elegir un nombre de perfil arbitrario), con un sub-perfil del proceso padre (“Child”), o bien puede lanzar sin nigún perfil (“Unconfined”). También puede impedir que el programa se ejecute (“Deny”).
	Note that when you opt to run it under a dedicated profile that doesn't exist yet, the tool will create the missing profile for you and will make rule suggestions for that profile in the same run.	Cuando se elije lanzar el proceso hijo con un perfil de dedicado que no exista aún, la herramienta creará el perfil que falta y propondrá sugerencias de reglas en la misma sesión de trabajo.

English

Spanish

Actions