3 ms·
"it can prevent exploited server software from accessing data it does not own and executing arbitrary code" Isn't AppArmor overly broad for something like that
by zzzcpan 9y ago
"it can prevent exploited server software from accessing data it does not own and executing arbitrary code"
Isn't AppArmor overly broad for something like that to be true? Exploited server software would happily provide access to the data of all users, since usually they all are withing the same trust boundaries anyway.
I think it's not a good idea to enable "security features" simply because it feels like they help, without even a threat model.
- pwman 9y agoThat's not how AppArmor works provided you lock down your server software properly -- say the server running is NTP -- that NTP server is only able to read /etc/ntp/* and /usr/sbin/ntpd only able to write /var/log/ntp* only able to execute /usr/sbin/ntpd Now you've radically limited what an exploit of this particular server can mean.
- zzzcpan 9y agoNot a good example, chmod, chown and chroot accomplish pretty much the same thing.
- boramalper 9y agoHow? AFAIK, the only way to do it is to create a different user for each app, like Android, which seems absurd to me.