Collaborate Disseminate
I have a Rust-app which uses PyO3 to execute arbitrary Python code. The Python code should only be able to do basic math operations and in now way should be able to access the network (except UnixSockets) or have access to files except a f… Continue reading AppArmor deny all files except specifics
I have a Rust-app which uses PyO3 to execute arbitrary Python code. The Python code should only be able to do basic math operations and in now way should be able to access the network (except UnixSockets) or have access to files except a f… Continue reading AppArmor deny all files except specifics
I am writing an online judge so I need to sandbox execution of untrusted binaries for judging and for that, I am using apparmor. Here’s my current simple profile:
#include <tunables/global>
profile bin_jail {
deny /** rwkx,
}
The… Continue reading Apparmor profile for executing untrusted binaries for online judge
I’m trying to restrict network access on an application that I don’t want to access the network(iirc the deny net requires specification of not just domain but also of domain socket(2)).
Can someone provide me/send me over a decent compre… Continue reading Apparmor what are valid network access policies on apparmor?
On Ubuntu kinetic, I get multiple DENIED operations by apparmor in /var/log/syslog such as:
operation="create" class="net" info="failed type and protocol match" error=-13 profile="/usr/sbin/cupsd" co… Continue reading How to allow an apparmor profile to create a unix socket
I remember reading something along these lines back when AppArmor was first released but now I cannot remember the details.
Assuming a system with a single filesystem, if an attacker can manage to create a hard link from within an accessib… Continue reading Do the path based rules of AppArmor allow an attacker to bypass with a hardlink?
I am on Ubuntu 20.04 server running AppArmor 2.13.3 and I have downloaded two additional apparmor profiles, from the [official apparmor repository][1]:
usr.sbin.apache2
php-fpm
Because I am running such an older version of apparmor (the o… Continue reading AppArmor Not Recognizing Files & Directories That Exist (Syntax Error)
This may be comparing chalk with cheese, but I’m wondering how these tools compare: pros and cons, similarities and differences, and situations where you would use one vs the other.
Continue reading How do AppArmor and systemd access controls compare?
I was recently having a conversation with a friend about his server system (he does a lot of self-hosting) and he mentioned he was in the middle of configuring SELinux. I was curious about the comparison of that over AppArmor for his use c… Continue reading Is AppArmor used in production environments?
Deno (the node.js fork) is designed to be secure by default. Therefore, unless you specifically enable it, a program run with Deno has no file, network, or environment access. Deno has a set of command line flags that allow the process per… Continue reading How can I enforce a security sandbox with any process?