5 ms·
In practice I would argue that AppArmor is worth nothing, because everyone uses it to allow every file access by default. Heck, glibc by default still allows L
by cookiengineer 3y ago
In practice I would argue that AppArmor is worth nothing, because everyone uses it to allow every file access by default.
Heck, glibc by default still allows LD_PRELOAD pretty much everywhere, and most distros have available SUID binaries you can hijack, so it's useless sandboxing anyways.
Setting aside the absurd amount of self invented config file formats for it (which have so many pitfalls for endusers) I think that firejail is the only viable alternative as a seccomp sandbox.
Flatpak's sandbox approach is as useless as AppArmor's approach, nobody can use it because the people that design it seemingly never use it in production apart from their www user test cases. If you try to sandbox a complicated program like Firefox with its hundreds of rendering processes, well, good luck...we'll talk two days later on how much progress you made just creating the config files.
I got so pissed by all of it that I started to learn eBPF to build a better sandbox, which I am trying to combine with a smart firewalling approach. But honestly, it's a ton of work, and the lack of profiles for everything makes it really hard to get to production.
You literally need to implement something like a "learning mode" that test runs a program, just to figure out what you want to allow or deny. This approach kinda worked for me, but I am now literally writing a DNS filter because resolv.conf as a concept is pretty much useless as well.
Once you start building something like this you see yourself 2 years later implementing all kinds of network services which in themselves are attack surfaces already...so you start to question whether it is really all worth it. Even hooking something as "simple" as DNS resolver API calls becomes a task that is a shitload of work until completed.
- PrimeMcFly 3y agoSomething like RSBAC/SELinux is a good fit. Not sandboxing in the traditional sense, but pretty bulletproof if setup correctly. The problem is the time it takes to do that.
- mid-kid 3y ago> Heck, glibc by default still allows LD_PRELOAD pretty much everywhere, and most distros have available SUID binaries you can hijack, so it's useless sandboxing anyways. Common misconception, but no, glibc doesn't allow LD_PRELOAD on suid binaries. Root is the one thing that's well-protected on linux, you cannot get root without the aid of a user giving it to you. Similarly, separation between users is also rather secure, but no desktop user is going to run each application under their own user.
- cookiengineer 3y ago> glibc doesn't allow LD_PRELOAD on suid binaries. I'll just leave this here then. [1] [1] https://gtfobins.github.io/ https://gtfobins.github.io/
- theamk 3y agothe first sentence of this says: > bypass local security restrictions in misconfigured systems. "misconfigured" is a key here. Sure, people do occasionally make mistakes or bad decisions and introduce security vulnerabilities.. but that happens less often than you think. gtfobins is pretty useless in regular server/desktop installs, at least for user permissions elevations. If user-to-root escalation is discovered with common config settings, it gets assigned a CVE and fixed, not listed at random websites.
- vntok 3y ago> Sure, people do occasionally make mistakes or bad decisions and introduce security vulnerabilities.. but that happens less often than you think. It's not exactly expected that a local GIMP desktop install would provide reverse shell capability, yet here we are (https://gtfobins.github.io/gtfobins/gimp/ https://gtfobins.github.io/gtfobins/gimp/)
- mid-kid 3y agoWe get it, code execution leads to code execution. https://devblogs.microsoft.com/oldnewthing/20230103-00/?p=107635 https://devblogs.microsoft.com/oldnewthing/20230103-00/?p=10...
- theamk 3y agoGIMP desktop install provides python scripting. The reverse shell capability comes from reverse shell specified on command line. gimp is no more dangerous that any other scriptable app, like emacs, vs code, web browser, etc..
- cookiengineer 3y ago