{
    "info": {
        "author": "UNKNOWN",
        "author_email": "UNKNOWN",
        "bugtrack_url": null,
        "classifiers": [
            "Development Status :: 3 - Alpha",
            "Intended Audience :: Developers",
            "Intended Audience :: System Administrators",
            "License :: OSI Approved :: Apache Software License",
            "Natural Language :: English",
            "Programming Language :: Python",
            "Programming Language :: Python :: 2.7",
            "Programming Language :: Python :: 3",
            "Programming Language :: Python :: 3.3",
            "Programming Language :: Python :: 3.4"
        ],
        "description": "apparmor_monkeys\n================\n\n.. image:: https://codecov.io/github/Jc2k/apparmor_monkeys/coverage.svg?branch=master\n   :target: https://codecov.io/github/Jc2k/apparmor_monkeys?branch=master\n\n\nMonkeypatches to minimize the permissions required to run python under AppArmor.\n\n\nWhat does this do?\n------------------\n\nImagine you've written a simple Django application. Maybe you just followed the\nDjango tutorial. All your code does is a bit of database querying. Then you\ndeploy it under AppArmor and::\n\n    type=AVC msg=audit(1443087838.797:1078): apparmor=\"DENIED\" operation=\"exec\" profile=\"helloworld-application\" name=\"/bin/dash\" pid=8202 comm=\"python\" requested_mask=\"x\" denied_mask=\"x\" fsuid=999 ouid=0\n\nSuddenly your audit log is full of messages complaining that your application\nis trying to run a shell. You certainly didn't write code to do that. Whats\ngoing on? Did you get hacked?\n\nYou (probably ;)) didn't get hacked.\n\nTurns out python shells out when doing some fairly mundane stuff. Up until now\nyou could:\n\n * Ignore it. Let your audit log have ``DENIED`` entries that you have to\n   ignore. Now it's hard to spot suspicious behaviour in your monitoring.\n   Thinks might be broken, thinks might not be broken.\n   Hope you don't have to go through that log with a security professional.\n\n * Allow it. Now your profile is broader than it needs to be. You are throwing\n   away the security you gain in the first place. Hope you don't have to go\n   through that profile with a security professional.\n\nThis package patches several stdlib API's to avoid ``subprocess`` usage,\nletting you keep your simple profiles and clean audit logs.\n\n\nctypes vs ldconfig\n~~~~~~~~~~~~~~~~~~\n\nOne of the first things I caught by application doing was trying to run\n``gcc``. This turned out to be a fallback for when an earlier attempt to run\n``ldconfig`` had failed.\n\nThis turned out to be how ``ctypes.util.find_library`` works. This can be used\nin a few places:\n\n * Gunicorn uses it for its sendfile implementation.\n * Python's ``uuid`` module uses for ``uuid4``. Just importing the ``uuid``\n   module triggers this, even if you aren't using ``uuid4``.\n\n\nplatform.uname vs os.uname\n~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n``platform.uname`` is mostly the same as ``os.uname``, but there is an extra\nfield. The field is sourced by shelling out and running ``uname -p``::\n\n    sh -c \"uname %s 2>%s\"\n\nThis is used in several places:\n\n * A command trick for getting your own version number is\n   ``pkg_resources.require('myapp')[0].version``, which triggers it.\n * Gunicorn triggers it via a ``platform.system()`` in\n   ``gunicorn.workers.workertmp`` before it even loads your code.\n\n\nActivating the monkey patches\n-----------------------------\n\nManually\n~~~~~~~~\n\nAs early in your code as possible do::\n\n    from apparmor_monkeys import patch_modules\n    patch_modules()\n\n\nAutomatically via ``.pth`` hooks\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nAnd ``site-packages`` directory is scanned for ``.pth`` files. These are processed in order and are generally just a list of paths to add to ``sys.path``. However any ``import`` lines will be honoured.\n\nCreate an ``apparmor-monkeys.pth`` in your virtualenvs ``site-packages`` directory containing::\n\n    import apparmor_monkeys; apparmor_monkeys.patch_modules()\n\nIt must be on a single line for this trick to work.\n\n\nSwitching profiles\n------------------\n\nYou can harden your AppArmor profiles further using ``change_profile`` to switch into a different profile after initialising your app.\n\nIf using multiprocess gunicorn (i.e. synchronous gunicorn) then you can wrap\nyour workers in their own specific profile. In your gunicorn config you can add\na hook to do this::\n\n    from apparmor_monkeys import change_profile\n\n    def post_fork(server, worker):\n        change_profile(\"myapplication//worker\")\n\n\nYou can do this for celery too::\n\n    from apparmor_monkeys import change_profile\n    from celery import signals\n\n    @signals.worker_process_init.connect\n    def switch_apparmor_profile(sender=None, signal=None):\n        change_profile(\"tenselfservice-worker//worker\")\n",
        "description_content_type": null,
        "docs_url": null,
        "download_url": "UNKNOWN",
        "downloads": {
            "last_day": -1,
            "last_month": -1,
            "last_week": -1
        },
        "home_page": "UNKNOWN",
        "keywords": null,
        "license": "UNKNOWN",
        "maintainer": null,
        "maintainer_email": null,
        "name": "apparmor_monkeys",
        "package_url": "https://pypi.org/project/apparmor_monkeys/",
        "platform": "UNKNOWN",
        "project_url": "https://pypi.org/project/apparmor_monkeys/",
        "project_urls": {
            "Download": "UNKNOWN",
            "Homepage": "UNKNOWN"
        },
        "release_url": "https://pypi.org/project/apparmor_monkeys/0.0.1/",
        "requires_dist": null,
        "requires_python": null,
        "summary": "Monkeypatches to minimize the permissions required to run python under AppArmor",
        "version": "0.0.1"
    },
    "last_serial": 2327066,
    "releases": {
        "0.0.1": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "f0502aafcba486f89712f44f22023e6c",
                    "sha256": "39ef57a98397c7714e056e3c240986544f96410f0772a66c7fada6590deac9e4"
                },
                "downloads": -1,
                "filename": "apparmor_monkeys-0.0.1.zip",
                "has_sig": false,
                "md5_digest": "f0502aafcba486f89712f44f22023e6c",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": null,
                "size": 8068,
                "upload_time": "2015-09-25T12:06:14",
                "url": "https://files.pythonhosted.org/packages/2d/1f/287a51d78ef4db623594467881c6dda002c39fbf0021f953731af04f57bc/apparmor_monkeys-0.0.1.zip"
            }
        ]
    },
    "urls": [
        {
            "comment_text": "",
            "digests": {
                "md5": "f0502aafcba486f89712f44f22023e6c",
                "sha256": "39ef57a98397c7714e056e3c240986544f96410f0772a66c7fada6590deac9e4"
            },
            "downloads": -1,
            "filename": "apparmor_monkeys-0.0.1.zip",
            "has_sig": false,
            "md5_digest": "f0502aafcba486f89712f44f22023e6c",
            "packagetype": "sdist",
            "python_version": "source",
            "requires_python": null,
            "size": 8068,
            "upload_time": "2015-09-25T12:06:14",
            "url": "https://files.pythonhosted.org/packages/2d/1f/287a51d78ef4db623594467881c6dda002c39fbf0021f953731af04f57bc/apparmor_monkeys-0.0.1.zip"
        }
    ]
}