3 ms·

Show HN: Appamor.d – Full set of AppArmor profiles (~ 1500 profiles)

56 points by CHEF-KOCH 3y ago

deleted 3y ago
[deleted]
dang 3y ago
Is this your own work? Show HN is for sharing something you've personally created. See https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html I ask because I don't see any indication of that on this post or the other one (https://news.ycombinator.com/item?id=39867639 https://news.ycombinator.com/item?id=39867639).
- roddhjav 3y ago
  No, this is my work (see the link in my profile). However, I should thank CHEF-KOCH for the post, as I should have done it months ago... While you are here, have a look at the doc: https://apparmor.pujol.io https://apparmor.pujol.io It is not stable yet, but it is promising.
  - dang 3y ago
    Ok! I'm glad I left Show HN in the title then :) Thanks for clarifying.
supriyo-biswas 3y ago
On the XZ back door thread multiple people are shitting on systemd I, but I think its sandboxing model is easier because you just couple the expected behavior of your application along with the unit. Interested people should look here[1] and [2] in case you need resource limitations, like limiting the amount of CPU a process can use. Of course, there is no way to isolate a backdoored piece of code running in the same address space as yours. [1] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html https://www.freedesktop.org/software/systemd/man/latest/syst... [2] https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html https://www.freedesktop.org/software/systemd/man/latest/syst...
aborsy 3y ago
These have to be distributed in the operating system by default. Ubuntu ships some, but they sandbox limited set of applications. I installed some of these anpparmo profiles in Ubuntu, and had to spend a lot of time profiling and fixing permissions. This was an ever changing process, also required security knowledge. Eventually, I removed them.
- roddhjav 3y ago
  You are right, the plan is to included by default. And given time it will be [0]. If you can report some logs to fix your issue that would be nice. [0] https://gitlab.com/apparmor/apparmor/-/merge_requests/1088 https://gitlab.com/apparmor/apparmor/-/merge_requests/1088

56 points by CHEF-KOCH 3y ago

deleted 3y ago

[deleted]

dang 3y ago

Is this your own work? Show HN is for sharing something you've personally created. See https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html I ask because I don't see any indication of that on this post or the other one (https://news.ycombinator.com/item?id=39867639 https://news.ycombinator.com/item?id=39867639).

roddhjav 3y ago
No, this is my work (see the link in my profile). However, I should thank CHEF-KOCH for the post, as I should have done it months ago... While you are here, have a look at the doc: https://apparmor.pujol.io https://apparmor.pujol.io It is not stable yet, but it is promising.
- dang 3y ago
  Ok! I'm glad I left Show HN in the title then :) Thanks for clarifying.

supriyo-biswas 3y ago

On the XZ back door thread multiple people are shitting on systemd I, but I think its sandboxing model is easier because you just couple the expected behavior of your application along with the unit. Interested people should look here[1] and [2] in case you need resource limitations, like limiting the amount of CPU a process can use. Of course, there is no way to isolate a backdoored piece of code running in the same address space as yours. [1] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html https://www.freedesktop.org/software/systemd/man/latest/syst... [2] https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html https://www.freedesktop.org/software/systemd/man/latest/syst...

aborsy 3y ago

These have to be distributed in the operating system by default. Ubuntu ships some, but they sandbox limited set of applications. I installed some of these anpparmo profiles in Ubuntu, and had to spend a lot of time profiling and fixing permissions. This was an ever changing process, also required security knowledge. Eventually, I removed them.

roddhjav 3y ago
You are right, the plan is to included by default. And given time it will be [0]. If you can report some logs to fix your issue that would be nice. [0] https://gitlab.com/apparmor/apparmor/-/merge_requests/1088 https://gitlab.com/apparmor/apparmor/-/merge_requests/1088