Tag Info

Hot answers tagged

11

Disclaimer: I'm far from expert on SELinux or AppArmor, so you'll need to check everything I say for yourself. I think there's a way to make SELinux and IPTables work together. SELinux can label packets with a tag that indicates the SELinux context/origin/provenance that applies to the packet. You can then write IPTables rules that inspect this tag to ...


8

These security systems provide tools to isolate applications from each other... and in turn isolate an attacker from the rest of the system when an application is compromised. SELinux rule sets are incredibly complex but with this complexity you have more control over how processes are isolated. Generating these policies can be automated. A strike ...


6

Grsecurity is not a pure pathname-based MAC system like TOMOYO or AppArmor. Policy is described using pathnames (same as every other system, including SELinux), but these are converted to inode/dev pairs at enable time and used thereafter. Pathnames are only used when matching regular expressions from policy or to provide "policy-recreation" -- given the ...


6

the insanitybit link is to my website. I'd just like to justify my opinion on here :) If you look at SELinux and Apparmor, they are both strong and weak in the same ways. SELinux is "stronger" in that it can get even more finely grained access to files, but what does that gain an attacker over being in an apparmor profile? You're already significantly ...


4

From the linked article I'd say that the answer to your first question needs to be considered in relative terms. Relative to not using AppArmor at all no it doesn't as at least you have some better isolation than would be allowed by default and from what they're saying, if an attacker can bypass the ChangeHat protection they just get as far as being ...


3

The upside -- yes, you can do this with SELinux. The downside -- you have to know SELinux. :) You can execute these processes in different SELinux domains. E.g. let's call two processes "privapp" and "unprivapp" -- privapp is able to access /var/lib/app/log and unprivapp cannot access /var/lib/app/log, despite running as the same user. So, you create two ...


2

AppArmor has the ability to block network connections from applications. I've never done it myself, but you should look at the AppArmor community page and the network rules page for details on how to do it. From the looks of it, the deny network directive should allow you to block all network access for an application.


2

I think, pathname based access control in general is not flawed conceptually at all, it may even have advantages, but current implementations are not convenient. Advantage is that you can have cleaner and more understandable policy specified in the single place, and you don't have complications of xattrs spreading over whole filesystem. Thinkability, I say, ...


2

If you look at an AppArmor rule-set or do any research into AppArmor you can see that they are designed to lock down a specific process. AppArmor is in no way shape or form a solution to "white-list" processes, nor will it ever be.


2

The whole point of mandatory access control is to allow fine grained configuration. Simplicity is completely irrelevant unless the two are equal on all other counts. Sometimes complexity is what it takes to get the job done. As it happens, SELinux has much better granularity, is more mature, more widely deployed and in my subjective opinion, better ...


2

In general, you cannot say that appArmor is better than SELinux. This is because a lot depends on what it is you are securing and what you are securing against and on the individual skills and preferences of the person/people responsible for maintaining the system. SELinux has greater fine grained control. In some situations, this would make it more ...


1

There is also tomoyo, which provides the means to implement mandatory access control. You will have to trust NTT DATA Corporation to not be evil, though. Also, arguably, chroot could not be even considered a security feature.


1

Of course. Your profile (And NO apparmor profile) does nothing to limit kernel attack surface. An attacker can exploit the kernel, unhook apparmor, and be out. only few directories / files for read / write / flock access, and network socket. Notice that ? That's adding hundreds more files to your profile. While your profile may look quite tight, it ...


1

Grsecurity could be an alternative to selinux and apparmor on a linux machine. A comparison of the three tools is given over here.


1

A Linux system contains a lot of "applications" -- do a ls /usr/bin to see it. Many of these must be launched regularly for proper system operation, not only at boot but also afterwards. Also, a lot of applications rely on the ability to launch these other applications, without necessarily making it apparent to the human user. Anything which looks like a ...


1

I would recommend to look into remote syslog. This way you can be sure that logs cannot be deleted or tampered with.


1

I don't think you are going to be able to accomplish that with only a single user. The closest thing to what you are talking about that I can think of is the way Android does it, and that is simply that each process runs under it's own user, thus it can only access it's own files and files of those processes that allow it access. Processes themselves ...


1

If you have SELinux enabled, I was under the impression that the default action was to deny access so what you want to do is to allow network access at times, right? I suspect that you going to have to do something like this answer on serverfault, which contains SE Linux configuration for a single process httpd and then combines that configuration with ...


1

To add a personal experience note to the above -- using selinux in conjunction with iptables makes both the policy and your iptables look extremely complicated and convoluted. It's one of those cases where the complexity trade-off must really be worth the trouble -- unless you are securing a military installation where correct packet labelling means life or ...



Only top voted, non community-wiki answers of a minimum length are eligible