<commit_before>Generating AppArmor profiles for Tor and Apache
===============================================

.. code:: sh

    vagrant up /staging$/
    vagrant ssh app-staging
    sudo su
    cd /var/www/securedrop

Run tests, use the application web interface, restart services,
reboot the VMs via ``vagrant reload /staging/``. The goal is to
create as much interaction with the system as possible, in order
to establish an expected baseline of behavior. Then run:

.. code::

    aa-logprof

Follow the prompts on screen and save the new configuration.
Then set the profile to complain mode:

.. code::

    aa-complain /etc/apparmor.d/<PROFILE_NAME>

Rinse and repeat, again running ``aa-logprof`` to update the profile.
The AppArmor profiles are saved in ``/etc/apparmor.d/``. There are two
profiles:

    -  ``/etc/apparmor.d/usr.sbin.tor``
    -  ``/etc/apparmor.d/usr.sbin.apache2``

After running ``aa-logprof`` you will need to copy the modified profile back to
your host machine to include them in the ``securedrop-app-code`` package.

.. code:: sh

   ansible -i .vagrant/provisioners/ansible/inventory/vagrant_ansible_inventory app-prod -m fetch -a 'flat=yes dest=install_files/ansible-base/ src=/etc/apparmor.d/usr.sbin.apache2'
   ansible -i .vagrant/provisioners/ansible/inventory/vagrant_ansible_inventory app-prod -m fetch -a 'flat=yes dest=install_files/ansible-base/ src=/etc/apparmor.d/usr.sbin.tor'

.. todo:: Explain the different behavior of the virtual environments (staging
          vs. prod) with regards to the AppArmor profiles.

The AppArmor profiles are packaged with the ``securedrop-app-code``.
The ``securedrop-app-code`` ``postinst`` puts the AppArmor profiles in enforce mode
on production hosts. In the staging environment, the ``app-test`` Ansible role
puts the AppArmor profiles in complain mode, to facilitate the development workflow
with ``aa-logprof`` outlined above.<commit_msg>Developer docs: AppArmor rules are in enforce mode on staging<commit_after>Generating AppArmor profiles for Tor and Apache
===============================================

.. code:: sh

    vagrant up /staging$/
    vagrant ssh app-staging
    sudo su
    cd /var/www/securedrop

Run tests, use the application web interface, restart services,
reboot the VMs via ``vagrant reload /staging/``. The goal is to
create as much interaction with the system as possible, in order
to establish an expected baseline of behavior. Then run:

.. code::

    aa-logprof

Follow the prompts on screen and save the new configuration.
Then set the profile to complain mode:

.. code::

    aa-complain /etc/apparmor.d/<PROFILE_NAME>

Rinse and repeat, again running ``aa-logprof`` to update the profile.
The AppArmor profiles are saved in ``/etc/apparmor.d/``. There are two
profiles:

    -  ``/etc/apparmor.d/usr.sbin.tor``
    -  ``/etc/apparmor.d/usr.sbin.apache2``

After running ``aa-logprof`` you will need to copy the modified profile back to
your host machine to include them in the ``securedrop-app-code`` package.

.. code:: sh

   ansible -i .vagrant/provisioners/ansible/inventory/vagrant_ansible_inventory app-prod -m fetch -a 'flat=yes dest=install_files/ansible-base/ src=/etc/apparmor.d/usr.sbin.apache2'
   ansible -i .vagrant/provisioners/ansible/inventory/vagrant_ansible_inventory app-prod -m fetch -a 'flat=yes dest=install_files/ansible-base/ src=/etc/apparmor.d/usr.sbin.tor'

The AppArmor profiles are packaged with the ``securedrop-app-code``.
The ``securedrop-app-code`` ``postinst`` puts the AppArmor profiles in enforce mode
on production and staging hosts.
{'fraction_non_alphanumeric': 0.12347052280311457, 'fraction_numerical': 0.0011123470522803114, 'mean_word_length': 4.01673640167364, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2350345', 'n_tokens_mistral': 1148, 'n_tokens_neox': 1099, 'n_words': 392}