In this lesson, you will learn how to build detection systems that identify unauthorized changes to your AppArmor security policy configurations to ensure your hardening efforts don't quietly erode over time.
Understanding Security Posture Drift
Security posture drift occurs when a system’s live security configuration deviates from its intended, hardened state. In the context of AppArmor, this usually manifests as local modifications to /etc/apparmor.d/ that were not part of your standard CI/CD deployment, or manual adjustments made by administrators that bypass established profile maintenance cycles.
To detect this, you must treat your security policies as "infrastructure as code" and implement a verification layer that compares your live kernel-enforced policy against a trusted "golden source" repository.
Implementing a Detection Mechanism
A simple but effective detection system involves calculating the cryptographic hash of your profile files and comparing them against a manifest of known-good hashes. If the local file changes, or if the active profile in the kernel has been modified (e.g., set to complain mode instead of enforce), your detection script should trigger an alert.
You can verify the active status of your profiles using aa-status:
# Check if the desired profiles are in 'enforce' mode
if ! aa-status --json | grep -q '"enforce": 0'; then
echo "Alert: Security drift detected! Some profiles are not in enforce mode."
fi
To detect configuration file drift, you can automate a checksum verification:
# Compare local files against a known-good manifest
cd /etc/apparmor.d/
sha256sum -c /var/lib/apparmor/profiles.sha256 > /dev/null
if [ $? -ne 0 ]; then
echo "Warning: Security policy files have been tampered with!"
fi
Closing the Loop
Detection is only half the battle. When a drift is identified, your system should ideally respond by automatically re-applying the validated profiles via your management cycle, or by locking the configuration files with immutable attributes (chattr +i) to prevent unauthorized edits. By integrating these checks into your daily audit tasks, you ensure that your security stance remains consistent with your original threat model.
Key Takeaway: Security posture drift detection relies on cryptographically verifying that your live AppArmor policies match your version-controlled source, ensuring that no manual or malicious overrides persist unnoticed.