Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those applications to run in confinement, and everything else is black-listed .. Can I do that in Apparmor, or I'm talking about the wrong tools.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

If you look at an AppArmor rule-set or do any research into AppArmor you can see that they are designed to lock down a specific process. AppArmor is in no way shape or form a solution to "white-list" processes, nor will it ever be.

share|improve this answer

A Linux system contains a lot of "applications" -- do a ls /usr/bin to see it. Many of these must be launched regularly for proper system operation, not only at boot but also afterwards. Also, a lot of applications rely on the ability to launch these other applications, without necessarily making it apparent to the human user. Anything which looks like a shell script, for instance, will use dozens of them.

So if you succeeded at making a restrictive white-list, the predictable effect would be a computer which boots up no more than a brick. Secure indeed.

Analogy: imagine a surgeon, or maybe a student who wants to become a surgeon; he has a patient to take care of. His strategy his simple: he will use his scalpel to open up the patient and remove any organ whose function he does not know, or that does not seem really necessary. Now estimate the life expectancy of the patient.

share|improve this answer
    
I don't really agree with you regarding that making a restrictive white-list is impractical .. because SElinux does this by tagging each process in the system, and those tagged processes follow a determined policy .. otherwise the process is not allowed to run. Actually, it is a tradeoff between security and usability, and to what extent you want to secure your system based on how sensitive data it holds! –  securecurve Sep 18 '13 at 6:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.