Hardening systems with AppArmor

GOLDEN CAGE

Article from Issue 66/2006

Author(s): RALF SPENNEBERG

After penetrating a remote system, intruders might think they are home and dry, but AppArmor spoils the fun, locking the miscreants in a virtual cage.

Nobody’s perfect – and this is particularly true of software. Any non-trivial application will have its fair share of programming errors. Intruders exploit these errors, taking control of the software, and making the program do things the developer never envisaged. The situation starts to become critical if the application has privileges that are different from the privileges of the attacker. For example, the ping command requires root privileges in order to send the special packet formats that it needs. But it is theoretically possible for the process to misuse its root privileges to cause all kinds of trouble. Although ping is a well-behaved program, an attacker capable of hijacking the tool would have unrestricted access to the rest of the system.

Buy this article as PDF

Express-Checkout as PDF

Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES

SUBSCRIPTIONS

Print Subs

Digisubs

TABLET & SMARTPHONE APPS

US / Canada

UK / Australia

Related content

AppArmor

When an attacker succeeds in infecting a victim’s system, the attacker inherits the victim’s privileges. App Armor beats the attack by reducing the potential victim’s privileges to a minimum.

more »
AppArmor vs. SELinux

Security Enhanced Linux or App Armor? Linux Magazine invited two well-known personalities from Red Hat and Novell to debate the merits of their security systems.

more »
Novell Dismisses AppArmor Developer

Two years after acquiring the company that developed AppArmor Novell has dismissed the developer behind the security technology.

more »
Rootkits and Linux Security

Your Linux system may not be so airtight after all. To understand the threats, you need to think like an intruder. We'll show you what the intruders are thinking now about the Linux 2.6 kernel.

more »
LINUX MAGAZINE DVD

more »

comments powered by Disqus

Visit Our Shop

Trial Subscription

Digital Subscription

Subscribe

Direct Download

Read full article as PDF:

Hardening_Systems_with_Apparmor.pdf (359.41 kB)

News

Trojan Turns Raspberry Pi into a Cryptocurrency Mining Device

Two trojans in the wild are targeting Linux machines.
Fedora 26 Beta Comes with New Features

The workstation comes with the latest Gnome desktop environment and support for many application build systems.
Raspberry Pi Foundation Merges with CoderDojo Foundation

The two foundations join forces to expand their efforts to reach young people.
Samba Security Hole Patched but Risk is Bigger

Millions of devices that use Samba Server are vulnerable to attacks.
Red Hat Announces OpenShift.io

Red Hat takes its IDE online.
Microsoft Bakes Linux into Windows Server

Microsoft is slowly becoming a Linux vendor.
Fearless Coyote, Linux Kernel 4.11 is Out

The new kernel makes swap implementation more scalable, which will help cloud providers.
Docker Appoints Steve Singh CEO

The new CEO comes from a very strong SaaS background.
Docker Announces Linux Kit and Moby Project

Both projects help organizations build their own containerized systems.
Ubuntu Returns to Gnome as Its Mobile Plans Shatter

Mark Shuttleworth has resumed the position of CEO of Canonical.