1

Can a badly or even maliciously configured AppArmor profile reduce security, or can it only improve it? I read that apparently AppArmor cannot override unix file permissions, so it shouldn't give a user more read-write-execute permissions than those they already have, but I'm not completely sure of this. I'm also not sure what a profile can do with all other options, including maybe less known options. So I wonder if an AppArmor profile can only add restrictions and therefore always increase security of an application (maybe even at the expense of usability), or if it can also make the application less secure than it would be by default, maybe giving it more privileges than it should have. The answer to this question might help me to understand if I can trust profiles written by others, or trust myself while I'm learning to write profiles.

Note: I found this related question ( Can too restrictive Linux MAC policy decrease security? ) that partly answers my question, although I wouldn't consider it an exact duplicate because what I'm asking seems a bit more general.

4

You are asking, whether maliciously or very badly written AppArmor profile can reduce security. Considering this question already states, that you can indeed reduce security using restrictive MAC, using restrictive AppArmor can obviously also decrease security in all the same ways, possible in some additional new ways as well. So YES, it indeed can decrease security.

As for giving processes additional permissions, I am reasonably certain it can't. Unix permissions (DAC) are checked separately before MAC, so it should be impossible to override them.

  • 2
    You are correct. All AppArmor can do is restrict, or not restrict. It won't allow an access that wouldn't have been permitted otherwise. – forest Apr 25 '18 at 0:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.