Virtual Environments vs SELinux/AppArmor : Which is better for running unreliable applications?

Question

By virtual environments, I mean Linux containers like Docker and Vagrant and not full blown VirtualBox.

So, the issue is that I often have to install packages from untrusted sources in my Ubuntu. However, lately I've become paranoid about these applications, and have been thinking about limiting their access or running them in SandBox.

Here is one scenario which I have been considering:

If I install an untrusted package on my machine and use SELinux/AppArmor for securing it, and this package needs to connect to the network, how can I be sure using SELinux that the package is not sending my key-logs or any other such information over the Internet? In this case, it seems like if I run the app in a separate Docker environment, it would be safer because then it would not have access to my keystrokes or any other such information.

There are many other scenarios too. But my question is this : in general, which provides better security of these two options? What exactly are the security layers/measures provided by these two methods?

Answer 1

Docker attempts some tricks to contain processes, but the creators themselves acknowledge they aren't effective containers of applications out of the box. Since you are concerned about security, but aren't interested in a heavyweight VM environment, I would recommend running SELinux and Docker together. SELinux can automatically apply an MCS label to each Docker container launched which helps protect you against container breakout. This makes it really easy to get the strength of SELinux and the ease of use of Docker.

To further expand on this, Docker doesn't effectively contain applications launched within it. Docker communicates directly to the kernel as there is no hypervisor between it and the host system. This means an attacker inside a container capable of using local privilege exploit attacks which are fairly common and generally easy to pull off.

SELinux would be much more capable of containing the application, since you could effectively prevent it from communicating from any system component it didn't absolutely need to. It can be difficult to build profiles, but this is far and away a better option to contain an application.