Jump to contentJump to page navigation: previous page [access key p]/next page [access key n]
openSUSE Leap Documentation › Security Guide › Confining Privileges with AppArmor › Confining Users with pam_apparmor
ContentsContents
Security Guide
  1. About This Guide
  2. 1 Security and Confidentiality
  3. I Authentication
    1. 2 Authentication with PAM
    2. 3 Using NIS
    3. 4 Setting Up Authentication Clients Using YaST
    4. 5 LDAP—A Directory Service
    5. 6 Network Authentication with Kerberos
    6. 7 Active Directory Support
  4. II Local Security
    1. 8 Spectre/Meltdown Checker
    2. 9 Configuring Security Settings with YaST
    3. 10 Authorization with PolKit
    4. 11 Access Control Lists in Linux
    5. 12 Encrypting Partitions and Files
    6. 13 Certificate Store
    7. 14 Intrusion Detection with AIDE
  5. III Network Security
    1. 15 X Window System and X Authentication
    2. 16 SSH: Secure Network Operations
    3. 17 Masquerading and Firewalls
    4. 18 Configuring a VPN Server
  6. IV Confining Privileges with AppArmor
    1. 19 Introducing AppArmor
    2. 20 Getting Started
    3. 21 Immunizing Programs
    4. 22 Profile Components and Syntax
    5. 23 AppArmor Profile Repositories
    6. 24 Building and Managing Profiles with YaST
    7. 25 Building Profiles from the Command Line
    8. 26 Profiling Your Web Applications Using ChangeHat
    9. 27 Confining Users with pam_apparmor
    10. 28 Managing Profiled Applications
    11. 29 Support
    12. 30 AppArmor Glossary
  7. V SELinux
    1. 31 Configuring SELinux
  8. VI The Linux Audit Framework
    1. 32 Understanding Linux Audit
    2. 33 Setting Up the Linux Audit Framework
    3. 34 Introducing an Audit Rule Set
    4. 35 Useful Resources
  9. A GNU Licenses
Navigation←→
openSUSE Leap Documentation › Security Guide › Confining Privileges with AppArmor › Confining Users with pam_apparmor
Top
←→
Applies to openSUSE Leap 15.1

27 Confining Users with pam_apparmor Edit source

An AppArmor profile applies to an executable program; if a portion of the program needs different access permissions than other portions need, the program can change hats via change_hat to a different role, also known as a subprofile. The pam_apparmor PAM module allows applications to confine authenticated users into subprofiles based on group names, user names, or a default profile. To accomplish this, pam_apparmor needs to be registered as a PAM session module.

The package pam_apparmor is not installed by default, you can install it using YaST or zypper. Details about how to set up and configure pam_apparmor can be found in /usr/share/doc/packages/pam_apparmor/README after the package has been installed. For details on PAM, refer to Chapter 2, Authentication with PAM.

→Chapter 28 Managing Profiled Applications←Chapter 26 Profiling Your Web Applications Using ChangeHat
Print this page

© 2020 SUSE