Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
1answer
859 views

apparmor: How to enable dbus feature of apparmor ('dbus mediation'), in the linux kernel?

Would very much like to use apparmor to restrict specific dbus communications within my system. However the following line appears in my syslog: Dec 28 09:36:21 apex snapd[1127]: AppArmor status: ...
5
votes
2answers
455 views

Apparmor - how to 'allow everything' rule, then tighten up?

Being very new to apparmor, would just like to start by placing some simple 1 line restriction on a program. And leave everything else as-is. Also, for other reasons it's not possible for me to easily ...
5
votes
2answers
2k views

Docker: when to use apparmor vs seccomp vs --cap-drop

Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container. However I couldn't find any documentation or guideline on when to use which ...
2
votes
1answer
167 views

Can too restrictive Linux MAC policy decrease security?

Can too restrictive MAC profile (e.x. AppArmor profile) decrease application security? For example: could it be that too restrictive environment for web browser will protect host system very well ...
2
votes
3answers
253 views

Allow access to a directory for certain application only

I would like to restrict an access to a directory. For example, on my system there is ~/.thunderbird directory that contains settings, letters, caches, etc of Thunderbird mail client. Obviously, other ...
2
votes
1answer
499 views

Apparmor profile denying read access with r flag

I generated an apparmor profile for the tor binary that comes bundled in Ricochet: # Last Modified: Sun Apr 2 2017 #include <tunables/global> /ricochet/*-ricochet/tor { #include <...
1
vote
0answers
383 views

Sandboxing applications and files in Debian & GrSecurity [closed]

I'm about to switch from Linux Mint to Debian. But before doing that I'm still looking into a few things to secure Debian. 1) The first thing I want is a kind of 'sandboxing' technology. This to ...
5
votes
6answers
7k views

Alternatives to SELinux and AppArmor? [closed]

With SELinux developed by NSA and AppArmor by Novell [*], what alternate solutions exists when trying to lock down a system and running applications, based on ACL and similar concepts like Zones on ...
3
votes
3answers
2k views

Apparmor system-wide security — white-listing

I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those ...
8
votes
3answers
3k views

Restrict access to a specific directory on Linux

I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
10
votes
3answers
4k views

Security tradeoffs of pathname-based MAC (e.g., TOMOYO, grsecurity, AppArmor, …)

I have been learning about MAC (Mandatory Access Control) systems in Linux. Often, but not always, these are tied to Linux Security Modules. Some systems I've looked at: SELinux, Tomoyo, AppArmor, ...
15
votes
2answers
2k views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...