Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [apparmor]

A filesystem-independent Linux kernel security module enabling Mandatory Access Control (MAC).

3
votes
0answers
39 views

Opt-in a security profile at runtime, without tedious setup

I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish. I would like to be able to ...
0
votes
1answer
378 views

apparmor: How to enable dbus feature of apparmor ('dbus mediation'), in the linux kernel?

Would very much like to use apparmor to restrict specific dbus communications within my system. However the following line appears in my syslog: Dec 28 09:36:21 apex snapd[1127]: AppArmor status: ...
2
votes
1answer
222 views

Apparmor - how to 'allow everything' rule, then tighten up?

Being very new to apparmor, would just like to start by placing some simple 1 line restriction on a program. And leave everything else as-is. Also, for other reasons it's not possible for me to easily ...
1
vote
1answer
58 views

Replace application's AppArmor profile without process restart

I'm using AppArmor in complain mode for a process in our production environment and I see some false positive profile violations in my logs. I'd like to roll out an updated profile but I cannot ...
3
votes
2answers
1k views

Docker: when to use apparmor vs seccomp vs --cap-drop

Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container. However I couldn't find any documentation or guideline on when to use which ...
1
vote
1answer
838 views

Comparison between Firejail and Apparmor

I'd like to understand how Apparmor and Firejail compare to each other: advantages, pros and cons, purposes, similarities, etc. I might be asking to compare apples with oranges, however I've noticed ...
1
vote
1answer
78 views

Can a badly configured AppArmor profile reduce security?

Can a badly or even maliciously configured AppArmor profile reduce security, or can it only improve it? I read that apparently AppArmor cannot override unix file permissions, so it shouldn't give a ...
2
votes
1answer
158 views

Can too restrictive Linux MAC policy decrease security?

Can too restrictive MAC profile (e.x. AppArmor profile) decrease application security? For example: could it be that too restrictive environment for web browser will protect host system very well ...
2
votes
3answers
209 views

Allow access to a directory for certain application only

I would like to restrict an access to a directory. For example, on my system there is ~/.thunderbird directory that contains settings, letters, caches, etc of Thunderbird mail client. Obviously, other ...
2
votes
1answer
449 views

Apparmor profile denying read access with r flag

I generated an apparmor profile for the tor binary that comes bundled in Ricochet: # Last Modified: Sun Apr 2 2017 #include <tunables/global> /ricochet/*-ricochet/tor { #include <...
1
vote
0answers
360 views

Sandboxing applications and files in Debian & GrSecurity [closed]

I'm about to switch from Linux Mint to Debian. But before doing that I'm still looking into a few things to secure Debian. 1) The first thing I want is a kind of 'sandboxing' technology. This to ...
3
votes
2answers
275 views

What is the best way to approach and generate apparmor profiles?

I'm thinking to start making apparmor profiles for my server, but before I start, I want to make sure that I'm doing in a right way. So, I'm thinking to begin with apache2 profiling. Right now I'm ...
3
votes
1answer
702 views

Do AppArmor/SELinux provide any security for workstation?

I decided to harden security on my primary workstation a bit. Before I used to use firejail for certain less trusted apps (all apps with internet access) but it's kind of toy. Didn't work really well ...
0
votes
0answers
32 views

Determining which files a process modifies / creates with strace?

For purposes of setting up AppArmor or SE Linux, I'm looking to audit what files a program could possibly need access to. My understanding is that the end of AppArmor or SE Linux, is to constrain ...
-1
votes
1answer
255 views

Starting a server without SElinux or Apparmor [duplicate]

The Debian kernel that compiled for Beaglebone Black, doesn't support SElinux and Apparmor, AFAIK. I just want to know, is it safe to put a server on the internet without SElinux or Apparmor? However ...
1
vote
1answer
274 views

Virtual Environments vs SELinux/AppArmor : Which is better for running unreliable applications?

By virtual environments, I mean Linux containers like Docker and Vagrant and not full blown VirtualBox. So, the issue is that I often have to install packages from untrusted sources in my Ubuntu. ...
5
votes
6answers
6k views

Alternatives to SELinux and AppArmor? [closed]

With SELinux developed by NSA and AppArmor by Novell [*], what alternate solutions exists when trying to lock down a system and running applications, based on ACL and similar concepts like Zones on ...
3
votes
3answers
2k views

Apparmor system-wide security — white-listing

I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those ...
5
votes
1answer
1k views

Can attacker break out of apparmor jail with the following profile?

Below is an example profile I've created for web apps, in which I've limited files / commands it can access. It includes profiles to nginx, php-fpm and mysql, no commands is allowed, only few ...
8
votes
3answers
3k views

Restrict access to a specific directory on Linux

I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
1
vote
1answer
173 views

Is it secure to use ChangeHats for Web Application?

I was reading an article on "Profiling Your Web Applications Using ChangeHat" where change hats mean to use different security context for different portion of application. Following are lines taken ...
64
votes
7answers
43k views

Comparison Between AppArmor and Selinux

I was reviewing several different comparisons of AppArmor and SELinux which include: Why I Like AppArmor More Than SELinux SELinux and AppArmor: An Introductory Comparison From these articles I ...
10
votes
3answers
3k views

Security tradeoffs of pathname-based MAC (e.g., TOMOYO, grsecurity, AppArmor, …)

I have been learning about MAC (Mandatory Access Control) systems in Linux. Often, but not always, these are tied to Linux Security Modules. Some systems I've looked at: SELinux, Tomoyo, AppArmor, ...
6
votes
2answers
4k views

Restrict network access for a single process with SELinux or AppArmor

I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with ...
15
votes
2answers
2k views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...