Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

With SELinux developed by NSA and AppArmor by Novell [*], what alternate solutions exists when trying to lock down a system and running applications, based on ACL and similar concepts like Zones on Solaris.

with applications i mean: services that are available and public accessible via network, namely all kinds of web/applicationservers, but also db-servers.

chroot is not an option, because its PITA to setup and maintain in the long run (experiences).

What i want to achieve: limit access of netbased services to its config- and datafiles only (docroot for webservers, dbs for db-server etc); outgoing connections are managed via firewall and service-proxies. if some attacker is able to access the system, he7she shall be limited on what to see and what to do, e.g. dont run programs, dont read other files.

[*] because of gag-orders and such, no trust anymore.

share|improve this question
    
Why is chroot "not an option" ? That seems to be a good map to your question. If your context has some special conditions which forbid the use of chroot then you should detail them, because such conditions are likely to apply to other solutions as well. –  Thomas Pornin Sep 18 '13 at 12:33
    
@ThomasPornin: i hope i made it clearer. –  that guy from over there Sep 18 '13 at 13:36
    
LIDS used to do it, but that project appears to be defunct - web site not updated since 2010, forum link broken. And I have to say, if the solution you find in this space isn't a PITA to set up and maintain, it's probably not a solution :) –  gowenfawr Sep 18 '13 at 14:50
    
i'm investigation lxc and will report later. it maybe possible to have one "master" - container with all needed dependencies and then just mount separate /data - partitions from the host into each container. would be yummy! –  that guy from over there Sep 18 '13 at 19:17
add comment

2 Answers

Grsecurity could be an alternative to selinux and apparmor on a linux machine. A comparison of the three tools is given over here.

share|improve this answer
    
FWIW, Grsecurity is not entirely an alternative, as it can be used together with SELinux –  dawud Feb 21 at 18:34
add comment

There is also tomoyo, which provides the means to implement mandatory access control. You will have to trust NTT DATA Corporation to not be evil, though.

Also, arguably, chroot could not be even considered a security feature.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.