4 ms·

HEADLINE: enable AppArmor by default DESCRIPTION: AppArmor improves security by limiting the capabilities of programs. Ubuntu has done this years ago [1]. I'd

by rahiel 9y ago

HEADLINE: enable AppArmor by default DESCRIPTION: AppArmor improves security by limiting the capabilities of programs. Ubuntu has done this years ago [1]. I'd like to see profiles for web browsers enabled by default. I think AppArmor is the right choice of default Mandatory Access Control for Debian because Ubuntu and security focused Debian derivatives like Tails [2] and SubgraphOS [3] have already committed to it. [1]: https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/AppArmorProfiles https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/AppArmorP... [2]: https://tails.boum.org/contribute/design/application_isolation/ https://tails.boum.org/contribute/design/application_isolati... [3]: https://subgraph.com/ https://subgraph.com/

finchisko 9y ago
Yes. This is good one. RHEL by default has active SELinux profile for samba and that's why was not affected by SambaCry. I vote for AppArmour.
based2 9y ago
https://github.com/subgraph/subgraph_metaproxy https://github.com/subgraph/subgraph_metaproxy 'Metaproxy is not going to work very well with IPv6'
- kebolio 9y ago
  has nothing to do with apparmor.
aleden 9y ago
AppArmor is like SELinux though: it's annoying so people just turn it off. Most recent example I encountered was on Ubuntu 1604; I wanted to run VMs under QEMU/KVM with libvirt but AppArmor was preventing the VM from using a USB device from the host. Just by chance I took a look at dmesg and saw some audit message about qemu bridge helper.
ptman 9y ago
Why not SELinux?
- rahiel 9y ago
  Because Debian has already done much work on integrating AppArmor [1]. And Debian based distro's like Ubuntu, Tails, and Subgraph also work on AppArmor so choosing AppArmor over SELinux means overall less work for the Debian community. [1]: https://wiki.debian.org/AppArmor/Progress https://wiki.debian.org/AppArmor/Progress
  - ibaldouy 9y ago
    SELinux is more secure, flexible and comprehensive, so Debian should adopt it by default... Anyway if AppArmor gets selected by default, I hope I can switch somewhat easily to SELinux if I want to.

by rahiel 9y ago

finchisko 9y ago

Yes. This is good one. RHEL by default has active SELinux profile for samba and that's why was not affected by SambaCry. I vote for AppArmour.

based2 9y ago

https://github.com/subgraph/subgraph_metaproxy https://github.com/subgraph/subgraph_metaproxy 'Metaproxy is not going to work very well with IPv6'

kebolio 9y ago
has nothing to do with apparmor.

aleden 9y ago

AppArmor is like SELinux though: it's annoying so people just turn it off. Most recent example I encountered was on Ubuntu 1604; I wanted to run VMs under QEMU/KVM with libvirt but AppArmor was preventing the VM from using a USB device from the host. Just by chance I took a look at dmesg and saw some audit message about qemu bridge helper.

ptman 9y ago

Why not SELinux?

rahiel 9y ago
Because Debian has already done much work on integrating AppArmor [1]. And Debian based distro's like Ubuntu, Tails, and Subgraph also work on AppArmor so choosing AppArmor over SELinux means overall less work for the Debian community. [1]: https://wiki.debian.org/AppArmor/Progress https://wiki.debian.org/AppArmor/Progress
- ibaldouy 9y ago
  SELinux is more secure, flexible and comprehensive, so Debian should adopt it by default... Anyway if AppArmor gets selected by default, I hope I can switch somewhat easily to SELinux if I want to.