Mandatory Access Control with AppArmor
Roadmap
All active development efforts experience a constant hustle to update and improve. AppArmor strives to add new features – the current version has evolved from its nascent stage, which was bogged down with huge performance overhead to the kernel/CPU, as it was written in plain text. Version 2 added a compile state machine, which guaranteed execution time by restricting the CPU overload.
Version 3, which is currently in development, will add multiple cache support. Enhanced networking support will bring fine-grained access to networking, which will allow you to monitor network-oriented applications and will also grant access to specific port calls. Support for ZFS database operations, Cgroups, and chroot will add additional capabilities for security-minded users.
Conclusion
MACs, if implemented properly, can provide a very well defined security ring that can render any attack useless or make the damage very predictable. AppArmor creates a whitelist that can ward off any major damage and be independent of user and system, and it creates very lean and simple application-specific rules that are easy to discern and implement.
The only gripe with AppArmor is that it offers a limited security solution out of the box. It may work very well in a limited environment, but the need to manually create profiles in a more exhaustive setup can be cumbersome at best. Creating profiles for so many variables can be a daunting task and may ward off interest in using AppArmor in the first place. However, development of new profiles is an ongoing process; more profile features are being added with each passing release.
Does AppArmor guarantee security? Yes and no. Security will always be on an unstable footing, and this article has only scratched the surface towards securing your system. The price of freedom and security is eternal vigilance.
Infos
- AppArmor Wiki: https://gitlab.com/apparmor/apparmor/wikis/Documentation
- Oracle Docs: https://docs.oracle.com/en/
- Red Hat Documentation: https://access.redhat.com/documentation/en-us/
« Previous 1 2 3
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
LibreOffice 7.5 has Arrived and is Loaded with New Features and Improvements
The favorite office suite of the Linux community has a new release that includes some visual refreshing and new features across all modules.
-
The Next Major Release of Elementary OS Has Arrived
It's been over a year since the developers of elementary OS released version 6.1 (Jólnir) but they've finally made their latest release (Horus) available with a renewed focus on the user.
-
KDE Plasma 5.27 Beta Is Ready for Testing
The latest beta iteration of the KDE Plasma desktop is now available and includes some important additions and fixes.
-
Netrunner OS 23 Is Now Available
The latest version of this Linux distribution is now based on Debian Bullseye and is ready for installation and finally hits the KDE 5.20 branch of the desktop.
-
New Linux Distribution Built for Gamers
With a Gnome desktop that offers different layouts and a custom kernel, PikaOS is a great option for gamers of all types.
-
System76 Beefs Up Popular Pangolin Laptop
The darling of open-source-powered laptops and desktops will soon drop a new AMD Ryzen 7-powered version of their popular Pangolin laptop.
-
Nobara Project Is a Modified Version of Fedora with User-Friendly Fixes
If you're looking for a version of Fedora that includes third-party and proprietary packages, look no further than the Nobara Project.
-
Gnome 44 Now Has a Release Date
Gnome 44 will be officially released on March 22, 2023.
-
Nitrux 2.6 Available with Kernel 6.1 and a Major Change
The developers of Nitrux have officially released version 2.6 of their Linux distribution with plenty of new features to excite users.
-
Vanilla OS Initial Release Is Now Available
A stock GNOME experience with on-demand immutability finally sees its first production release.