5 ms·

RHEL systems run SELinux in enforcing mode by default. Most applications run in a domain called "unconfined_t", which is about as secure as it sounds. [0] Ubun

RHEL systems run SELinux in enforcing mode by default. Most applications run in a domain called "unconfined_t", which is about as secure as it sounds. [0] Ubuntu runs AppArmor in its version of enforcing mode. I've only ever run into issues with it once though, so I presume it is a similarly lax policy. [0] The policy is called "targeted", to reflect the fact that you are supposed to write targeted policy modules for specific applications you are concerned about.

bayindirh 3y ago
Debian’s AppArmor policy is pretty strict, yet well refined. As long as you use standard folders and paths, it’s pretty invisible. Last time while I was migrating a DNS server, our zone folders were not in a standard path, and Bind was unable to find them. 10 minutes later I remembered about AppArmor, and moved the files. The only problematic hardening was Thunderbird, which broke attachments. They disabled the Thunderbird’s profile after failing to fix it. Currently I’m on mobile, so I can’t give you a list of active profiles, yet the list is not short and the policy is not lax. I worked with both of them back in the day and developed profiles for them. Update: Stats are as follows: 78 packages ship AppArmor profiles in Debian 12. Notable are: - mariadb-server - redshift (f.lux alternative) - bind - ioquake3 (yes, the game) - squid - tcpdump among others. Also there are "apparmor-profiles" and "apparmor-profiles-extra" packages which provides profiles for vsftpd, dovecot, dhcpd amongst others (141 in profiles and 10 in extras). So, AppArmor ecosystem is neither lax, nor unmaintained.