30
votes
Docker: when to use apparmor vs seccomp vs --cap-drop
You can use all of them.
Each of these security features have different purposes, and there is actually little overlap. They all function to reduce the damage that a process can cause once it has been ...
- 67.3k
11
votes
Comparison between Firejail and Apparmor
AppArmor could be closer compared to SELinux than FireJail, but here's the differences.
The most important (IMO) is the level at which they run. FireJail runs as a program in userspace while ...
- 5,160
9
votes
Accepted
apparmor: How to enable dbus feature of apparmor ('dbus mediation'), in the linux kernel?
The dbus mediation in apparmor requires cooperation of the apparmor userspace, kernel and dbus daemon. All parts must contain the necessary support or dbus mediation will not be enabled.
From your ...
- 106
8
votes
Comparison Between AppArmor and Selinux
SELinux is surely a more complete and ambitious security tool than AppArmor. SELinux is a wide universe, it permeates everything, it potentially labels every object in the system and conceptually ...
- 81
8
votes
Docker: when to use apparmor vs seccomp vs --cap-drop
Well answered by @forest, but I'd like to add a few suggestions that reflect my view on security frameworks and security design in general.
Enforcing security goes in hand with knowing what you are ...
- 81
6
votes
Accepted
Apparmor - how to 'allow everything' rule, then tighten up?
But is the allow *, a correct syntax for 'allow everything'
Correct syntax for allow everything looks like:
profile DAC /path/to/exec {
# Allow all rules
capability,
network,
mount,
...
- 96
6
votes
Apparmor - how to 'allow everything' rule, then tighten up?
This is not the right approach.
In general, blacklisting is a poor basis for a security policy - it should be based on whitelisting - and the syntax of AppArmor is predicated on this. To that end, ...
- 18.8k
5
votes
Accepted
Is AppArmor used in production environments?
AppArmor is enabled by default on Debian (and I believe Ubuntu), so yes, it is clearly being used in production environments. In addition, it is typically used to constrain containers, such as those ...
- 9,712
5
votes
Can a badly configured AppArmor profile reduce security?
You are asking, whether maliciously or very badly written AppArmor profile can reduce security. Considering this question already states, that you can indeed reduce security using restrictive MAC, ...
- 7,858
4
votes
Accepted
Do AppArmor/SELinux provide any security for workstation?
I did. You need a plan, and you need to master the tools. You need to be able to compromise where you can and where you have to compromise. You need to work to make it reality.
Access control is part ...
- 56
4
votes
Comparison Between AppArmor and Selinux
From my personal experience using SElinux I would say that it didn't add any amount of complexity to GNU+Linux, the only thing that it did and I consider it an advantage is to bring to us the ...
- 41
3
votes
Replace application's AppArmor profile without process restart
I found a function aa_replace_current_profile() that can replace current process profile. But I don't know how to replace the process you want.
- 31
3
votes
Accepted
Can too restrictive Linux MAC policy decrease security?
A MAC policy should be extremely fine-grained, not necessarily extremely restrictive.
It can decrease security under certain conditions. Applications, especially complex ones, often have fallbacks ...
- 67.3k
2
votes
What is the best way to approach and generate apparmor profiles?
apparmor is to protect services... for example if "something" tries to change configuration files of a protected service... Look at this.
To test it you must try to change any service... Not sure ...
- 5,365
2
votes
Restrict privileged users from accessing certain directories on Linux servers with Grsecurity?
From those, I understand that SELinux could accomplish my goal. But we do not have the resources to use SELinux, so I want to know if there is another way -- specifically Grsecurity (or AppArmor).
if ...
- 443
2
votes
Accepted
Is apparmor default deny?
It depends on how it's deployed. Usually you'll have to whitelist specific calls from your application, but at system level you can apply policies that only a subset of the system is confined.
As ...
- 572
2
votes
How to allow an apparmor profile to create a unix socket
Add those lines into the apparmor profile /etc/apparmor.d/local/usr.sbin.cupsd
network unix dgram,
network unix stream,
And then reload apparmor using
systemctl reload apparmor
1
vote
How do AppArmor and systemd access controls compare?
Systemd has a few limited features to control filesystem access. Most of these boil down to using namespaces. AppArmor, on the other hand, is a type of Mandatory Access Control. It is extremely fine-...
- 67.3k
1
vote
Accepted
Linux whitelist-based Mandatory Access Control instead of a blacklist-based model
I seem to have found what I was looking for - using AppArmor global profiles and profile stacking which can be used to implement a whitelist-like model:
https://gitlab.com/apparmor/apparmor/-/wikis/...
- 131
1
vote
Opt-in a security profile at runtime, without tedious setup
Not really what you want, but more closer variant is:
normal@user:$ aa-exec -p restricted_books booyah
In this scenrio you still need:
Enabling AppArmor
Writing a profile
Registering profile
But ...
- 96
1
vote
Comparison between Firejail and Apparmor
AFAIK Firejail uses only file system and network name spaces.
Filesystem: Firejail uses the definitions in the profile to construct a file system tree for the process. The tree may – for instance – ...
- 11
1
vote
Comparison Between AppArmor and Selinux
There is no point in comparing SELinux to AppArmor if you can't make SELinux as usable for a typical user as AppArmor.
Making security easy/easier matters. Look at your typical social media app on a ...
1
vote
Restrict network access for a single process with SELinux or AppArmor
AppArmor profile for this case is:
profile nonetwork /path/to/exec {
# Allow all rules...
capability,
network,
mount,
remount,
umount,
pivot_root,
ptrace,
signal,
dbus,
unix,
...
- 96
1
vote
Allow access to a directory for certain application only
What you think obvious is not for me:
Obviously, other applications don't need the content of this folder. And other applications should not access the folder not because of security but just ...
- 26.9k
1
vote
Allow access to a directory for certain application only
For this have you considered using a containerization solution like Docker to have an isolated version of Thunderbird?
There's some existing examples like this one.
Docker solves the problem of ...
- 62.6k
1
vote
Apparmor profile denying read access with r flag
Did you both reload AppArmor and restart the application? Simply reloading AppArmor does not mean changes to the policy will take effect immediately. If that does not work, you can whitelist the ...
- 67.3k
1
vote
What is the best way to approach and generate apparmor profiles?
The biggest problem (after understanding how your os, webserver and apparmour work) is being able to thouroughly regression test your server. Cataloging all the places where it interacts with files on ...
- 18.8k
Only top scored, non community-wiki answers of a minimum length are eligible