What vulnerabilities and/or threats can SELinux and AppArmor mitigate in

AppArmor lets you define permissions for each program and denies that program access to anything you haven't allowed it to do. I write my own AppArmor profiles so that I can run some required proprietary software without having to worry about it doing weird things to my OS. Thanks to AppArmor it can only do what I let it do. It can write to ~/Downloads, but not to ~/Documents. It can't read info about my hardware. Even if I were careless enough to start it as root, it still wouldn't have any root privileges except the ones I defined in the profile.

0

08.10.2021

Ludovic 'Archivist' Lagouardette

Kiavash Yk
According to your example.

Have you ever run a command that pipes curl to bash or an installer that depends on such a command?

0

08.10.2021

Kiavash Yk Автор вопроса

Ludovic 'Archivist' Lagouardette
Have you ever run a command that pipes curl to bas...

The first one is a no, the second one could be a popular, well-known AUR.

0

08.10.2021

Flolor

Ender
AppArmor lets you define permissions for each prog...

That is really important Allowing any program to read your ssh and gpg keys, documents, photos, etc is terrible

0

08.10.2021

Ender

Kiavash Yk
So, they seems useless and just protect the system...

They protect you from programs that do more than they need to. They also allow you to follow the principle of least privilege. Say you run tcpdump. It need to be root. But it doesn't need all the power that root has. With AppArmor you can run it as root, but it will only have a few special permission, not the full set of root capabilities.

0

08.10.2021

Ender

Flolor
That is really important Allowing any program to r...

Exactly!

0

08.10.2021

Kiavash Yk Автор вопроса

Ender
AppArmor lets you define permissions for each prog...

Is writing its profiles difficult? Would you please share a sample?

0

08.10.2021

Kiavash Yk Автор вопроса

Ender
They protect you from programs that do more than t...

Great!

0

08.10.2021

Ender

Kiavash Yk
Is writing its profiles difficult? Would you pleas...

See my profile for skypeforlinux at https://gitlab.com/alexconst.sh/apparmor-profiles/-/blob/dev/usr.bin.skypeforlinux for example.

0

08.10.2021

Ender

Kiavash Yk
Is writing its profiles difficult? Would you pleas...

If you're on Debian or Ubuntu, install the apparmor-profiles package and look around in /etc/apparmor.d

0

08.10.2021

Kiavash Yk Автор вопроса

Ender
See my profile for skypeforlinux at https://gitlab...

Thank you

0

08.10.2021

Ludovic 'Archivist' Lagouardette

Ender
See my profile for skypeforlinux at https://gitlab...

This is pretty good, allow me to steal that 😉

0

08.10.2021

Ender

Ludovic 'Archivist' Lagouardette
This is pretty good, allow me to steal that 😉

Sure, it's GPLv2 / GPLv3 :)

0

08.10.2021

Kiavash Yk Автор вопроса

Ender
If you're on Debian or Ubuntu, install the apparmo...

I'm on fedora 34 right now, was wondering about switch to an arch-based distro [endeavourOS exactly], and concerned about keeping it as secure as fedora.

0

08.10.2021

Ender

Ludovic 'Archivist' Lagouardette
This is pretty good, allow me to steal that 😉

Make sure to read comments at the top of the file. Also see the end of README.md, there's a suggestion to further mitigate Xorg vulnerabilities.

0

08.10.2021

Ender

Kiavash Yk
I'm on fedora 34 right now, was wondering about sw...

Oh, Fedora must be using SELinux.

0

08.10.2021

Kiavash Yk Автор вопроса

Ender
Oh, Fedora must be using SELinux.

Yeah, pretty complicated.

0

08.10.2021

Ender

Kiavash Yk
Thank you

btw I mainly restrict filesystem access. AppArmor can do much more. You can restrict mounting filesystems to specific mount points or fs types. You can restrict dbus access. Or make the program use TCP only. Or deny network access entirely. It's very flexible.

0

08.10.2021

Kiavash Yk Автор вопроса

Ender
btw I mainly restrict filesystem access. AppArmor ...

+

0

08.10.2021

Martin Rys

Kiavash Yk
I'm on fedora 34 right now, was wondering about sw...

Why not Arch?

0

08.10.2021

Kiavash Yk Автор вопроса

Martin Rys
Why not Arch?

I expect you say so:)

0

08.10.2021

Mihai

Martin Rys
Why not Arch?

Why not Ubuntu?

0

08.10.2021

harꭑony5 (⊙ ◡ ⦿︎) ↺

Mihai
Why not Ubuntu?

Why not Windows... Oh wait

0

08.10.2021

Martin Rys

Mihai
Why not Ubuntu?

*breathes in heavily*

0

08.10.2021

Ludovic 'Archivist' Lagouardette

Martin Rys
*breathes in heavily*

Imagine going to south africa to sell your soul to Amazon

0

08.10.2021

Ludovic 'Archivist' Lagouardette · Accepted Answer

Ludovic 'Archivist' Lagouardette

In layman's terms, they are mitigating a lot of Chair-Keyboard interface issues, like inserting that USB drive you found on the parking lot and opening the pdf that was inside for example

0

08.10.2021

Похожие чаты

What vulnerabilities and/or threats can SELinux and AppArmor mitigate in

29 ответов

Похожие вопросы