Collaborate Disseminate
Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container.
However I couldn’t find any documentation or guideline on when to use which approach.
There seems to be a significant ov… Continue reading Docker: when to use apparmor vs seccomp vs –cap-drop
I’d like to understand how Apparmor and Firejail compare to each other: advantages, pros and cons, purposes, similarities, etc.
I might be asking to compare apples with oranges, however I’ve noticed several similarities. Firejail has “pro… Continue reading Comparison between Firejail and Apparmor
Can a badly or even maliciously configured AppArmor profile reduce security, or can it only improve it? I read that apparently AppArmor cannot override unix file permissions, so it shouldn’t give a user more read-write-execut… Continue reading Can a badly configured AppArmor profile reduce security?
Can too restrictive MAC profile (e.x. AppArmor profile) decrease application security?
For example: could it be that too restrictive environment for web browser will protect host system very well while disabling some internal browser sec… Continue reading Can too restrictive Linux MAC policy decrease security?
I would like to restrict an access to a directory. For example, on my system there is ~/.thunderbird directory that contains settings, letters, caches, etc of Thunderbird mail client. Obviously, other applications doesn’t nee… Continue reading Allow access to a directory for certain application only
I generated an apparmor profile for the tor binary that comes bundled in Ricochet:
# Last Modified: Sun Apr 2 2017
#include <tunables/global>
/ricochet/*-ricochet/tor {
#include <abstractions/base>
deny /etc/ld.so.prelo… Continue reading Apparmor profile denying read access with r flag
I’m thinking to start making apparmor profiles for my server, but before I start, I want to make sure that I’m doing in a right way.
So, I’m thinking to begin with apache2 profiling. Right now I’m running couple of websites … Continue reading What is the best way to approach and generate apparmor profiles?
I’m thinking to start making apparmor profiles for my server, but before I start, I want to make sure that I’m doing in a right way.
So, I’m thinking to begin with apache2 profiling. Right now I’m running couple of websites … Continue reading What is the best way to approach and generate apparmor profiles?
With SELinux developed by NSA and AppArmor by Novell [*], what alternate solutions exists when trying to lock down a system and running applications, based on ACL and similar concepts like Zones on Solaris.
with application… Continue reading Alternatives to SELinux and AppArmor?
With SELinux developed by NSA and AppArmor by Novell [*], what alternate solutions exists when trying to lock down a system and running applications, based on ACL and similar concepts like Zones on Solaris.
with application… Continue reading Alternatives to SELinux and AppArmor?