Is it secure to use ChangeHats for Web Application?

Question

I was reading an article on "Profiling Your Web Applications Using ChangeHat" where change hats mean to use different security context for different portion of application. Following are lines taken from above mentioned articles that are confusing me.

"Note that the security of hats is considerably weaker than that of full profiles. That is to say, if attackers can find just the right kind of bug in a program, they may be able to escape from a hat into the containing profile. This is because the security of hats is determined by a secret key handled by the containing process, and the code running in the hat must not have access to the key."

1. Is it a security risk to use ChangeHat?
2. What is the context of security hats with the security key?

Answer 1

From the linked article I'd say that the answer to your first question needs to be considered in relative terms.

Relative to not using AppArmor at all no it doesn't as at least you have some better isolation than would be allowed by default and from what they're saying, if an attacker can bypass the ChangeHat protection they just get as far as being constrained by the containing profile.

Relative to using individual profiles for each piece of code the security is weaker, but I don't think that would always be a practical proposition.

Again from reading the doc. it seems to me that they key is essentially the mechanism by which a piece of code claims the level of rights for that hat.

So if an application has 3 hats defined the problem is that if there's a bug in a piece that uses hat1 the exploited code may be able to read the keys for hat2 and hat3 thereby negating the protection that they provide.