I decided to harden security on my primary workstation a bit. Before I used to use
firejail for certain less trusted apps (all apps with internet access) but it's kind of toy. Didn't work really well for me. So I tried to read about real tools which is SELinux and AppArmor.
Whereas lets say I get how it might be beneficial for server - it runs just few, well known apps with well known profiles, you need to enable profile and it works. Cool. But I completely don't see how it's supposed to work for workstation or desktop. I'm not sure if it's truth or I'm missing something but If I understood well both AppArmor and SELinux require profiles to secure apps. And those profiles need to be pre-prepared. By someone. For every app.
Okay, so I'm using OpenSUSE on my workstation. It runs a lot of apps so I chose to install full DVD. It's around 16gb of software out of box. As I'm using it also for web development I additionally installed dozen of web browsers etc, flashplayer so on, so on.
lapsio@linux-6o92 ~> ll /usr/bin/ | grep -vc "^l" 4225 lapsio@linux-6o92 ~> ls /etc/apparmor.d/ | wc -l 46
Of course not every app in
The point is - it's pretty much impossible to create profile for every single app in OS. Blacklist approach is pretty much always bad when we talk about security. So is there any whitelist solution? I'm not saying that Android is super secure but on the other hand - it seems to really separate all apps from each other.
Ideal solution would be to allow every app by default to access only own files (determined by package manager) and no internet access. Then to give explicit permission to any other path or internet access just to certain apps. While second goal can be easily achieved by appropriate iptables rules first one sounds like something that should be achieved by SELinux or AppArmor. But I don't see how.