The apparmor tag has no wiki summary.
2
votes
1answer
44 views
Can attacker break out of apparmor jail with the following profile?
Below is an example profile I've created for web apps, in which I've limited files / commands it can access. It includes profiles to nginx, php-fpm and mysql, no commands is allowed, only few ...
1
vote
3answers
212 views
Restrict access to a specific directory on Linux
I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
1
vote
1answer
141 views
Is it secure to use ChangeHats for Web Application?
I was reading an article on "Profiling Your Web Applications Using ChangeHat" where change hats mean to use different security context for different portion of application. Following are lines taken ...
6
votes
2answers
339 views
Comparsion Between AppArmor and Selinux
I was reviewing several different comparison of AppArmor and Selinux which include
Why I Like AppArmor More Than SELinux
SELinux and AppArmor: An Introductory Comparison
From these articles I ...
7
votes
3answers
276 views
Security tradeoffs of pathname-based MAC (e.g., TOMOYO, grsecurity, AppArmor, …)
I have been learning about MAC (Mandatory Access Control) systems in Linux. Often, but not always, these are tied to Linux Security Modules. Some systems I've looked at: SELinux, Tomoyo, AppArmor, ...
2
votes
2answers
433 views
Restrict network access for a single process with SELinux or AppArmor
I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with ...
11
votes
2answers
325 views
Network policies under AppArmor/SELinux
I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor.
I see that both SELinux and AppArmor allow the selected granting of socket level access ...
