6 ms·

Never heard of anyone suggesting to disable AppArmor. As for the efficacy of the two, I'm less interested in the feature sets of the two. I think what'd be mor

Never heard of anyone suggesting to disable AppArmor. As for the efficacy of the two, I'm less interested in the feature sets of the two. I think what'd be more interesting is replicate exploitation scenarios with their default policies and see which subsystem succeeds in mitigating the exploit and which fail.

mrweasel 2y ago
Can't say that I haven't disabled AppArmor on a server or two to make things work short term. Fixing the AppArmor is a bit easier than fixing SELinux policies though.
silverwind 2y ago
Had to disable AppArmor to be able to dump packets with tools like tcpdump.
ruthmarx 2y ago
> I'm less interested in the feature sets of the two. I think what'd be more interesting is replicate exploitation scenarios with their default policies and see which subsystem succeeds in mitigating the exploit and which fail. The feature set is exactly what dictates which systems are more likely to prevent exploitation, though. App Armor simply isn't as granular, and simpler to bypass (e.g. by making a hardlink to a file to override AppArmor policy). AppArmor may be good enough in many situations, but SELinux gives you much more control, so you can be much closer to perfect to protect against unknown situations.
- commandersaki 2y ago
  Still don't care about the feature set, show me a useful benchmark. If SELinux prevents a hypothetical that's great, but security is a tradeoff and I'd opt for convenience and simplicity to sacrifice potentially negligible risk. For example, I'm seeing that SELinux didn't mitigate ShellShock where AppArmor did (despite being an attack vector that isn't really common). But these are the things I want to know.
  - ruthmarx 2y ago
    > Still don't care about the feature set, show me a useful benchmark. "I don't care to understand the differences in security thees systems provide" That's what you're saying here. Which means you're not going to be evaluating these systems in any way that matters. > If SELinux prevents a hypothetical that's great, but security is a tradeoff and I'd opt for convenience and simplicity to sacrifice potentially negligible risk. You're asking for benchmarks, but already here your willing to dismiss the results because you don't really care about them, you care about "convenience and simplicity" and security being good enough, right? In that case, sure AppArmor is good enough for most people. But so is a flimsy chain look. If you want to actually secure something and not just deter, you'd want a deadbolt and sturdy door, right? The point is, the feature sets matter, precisely because so many attacks are hypothetical. You have to see and speculate what attackers might do and have things in place to prevent that. SELinux facilitates that a lot more than AppArmor does. That's the fundamental point here, and not something you will likely find a nice graph to support. If you ask an AI to generate one for you it might be able to though. If you really still think you need it. > For example, I'm seeing that SELinux didn't mitigate ShellShock where AppArmor did (despite being an attack vector that isn't really common). Well that's nonsense. SELinux can protect against anything AppArmor can since AppArmor provides only a subset of features. I sense you might not be interested in this since you've said you just want benchmarks, but here's a page from RedHat not only explaining how SELinux prevents Shellshock from being able to do damage, but even walks you through exploiting it on an SELinux enabled system so you can test it yourself[1]. There's also a blog post from Dan Walsh explaining how SELinux constrains shell shock [2]. I'm also less confident AppArmor is as effective against container escape exploits like these [3] [4] > But these are the things I want to know. Mmm. Well, there's no benchmarks. But if you do research you will find the examples you want. SELinux will have substantially more examples because it's employed in wider use due to RedHat and Android. If you really want to compare, look at the Debian and RedHat security advisories, and look how many RedHat has saying that SELinux provides protection if enabled, and how many Debian and Ubuntu have being unable to say the same for AppArmor. But really, again, you should bother to understand the feature sets and actual technology. This approach you want looking for benchmarks, it's not going to necessary be accurate or representative, and I say that confident that your methodology would still show SELinux as the better option (in terms of security, not usability/convenience). The key is that you should strive to understand systems you want to use, not just look for a blog article that can provide justification for an intuition or desire. [1] https://github.com/RedHatDemos/SecurityDemos/blob/master/2019Labs/RHELSecurityLab/documentation/lab2_SELinux.adoc#2-1-2-shellshock-vulnerability-and-selinux https://github.com/RedHatDemos/SecurityDemos/blob/master/201... [2] https://danwalsh.livejournal.com/71122.html https://danwalsh.livejournal.com/71122.html [3] https://www.redhat.com/en/blog/latest-container-exploit-runc-can-be-blocked-selinux https://www.redhat.com/en/blog/latest-container-exploit-runc... [4] https://www.redhat.com/en/blog/selinux-mitigates-container-vulnerability https://www.redhat.com/en/blog/selinux-mitigates-container-v...

mrweasel 2y ago

Can't say that I haven't disabled AppArmor on a server or two to make things work short term. Fixing the AppArmor is a bit easier than fixing SELinux policies though.

silverwind 2y ago

Had to disable AppArmor to be able to dump packets with tools like tcpdump.

ruthmarx 2y ago

> I'm less interested in the feature sets of the two. I think what'd be more interesting is replicate exploitation scenarios with their default policies and see which subsystem succeeds in mitigating the exploit and which fail. The feature set is exactly what dictates which systems are more likely to prevent exploitation, though. App Armor simply isn't as granular, and simpler to bypass (e.g. by making a hardlink to a file to override AppArmor policy). AppArmor may be good enough in many situations, but SELinux gives you much more control, so you can be much closer to perfect to protect against unknown situations.

commandersaki 2y ago
Still don't care about the feature set, show me a useful benchmark. If SELinux prevents a hypothetical that's great, but security is a tradeoff and I'd opt for convenience and simplicity to sacrifice potentially negligible risk. For example, I'm seeing that SELinux didn't mitigate ShellShock where AppArmor did (despite being an attack vector that isn't really common). But these are the things I want to know.
- ruthmarx 2y ago
  > Still don't care about the feature set, show me a useful benchmark. "I don't care to understand the differences in security thees systems provide" That's what you're saying here. Which means you're not going to be evaluating these systems in any way that matters. > If SELinux prevents a hypothetical that's great, but security is a tradeoff and I'd opt for convenience and simplicity to sacrifice potentially negligible risk. You're asking for benchmarks, but already here your willing to dismiss the results because you don't really care about them, you care about "convenience and simplicity" and security being good enough, right? In that case, sure AppArmor is good enough for most people. But so is a flimsy chain look. If you want to actually secure something and not just deter, you'd want a deadbolt and sturdy door, right? The point is, the feature sets matter, precisely because so many attacks are hypothetical. You have to see and speculate what attackers might do and have things in place to prevent that. SELinux facilitates that a lot more than AppArmor does. That's the fundamental point here, and not something you will likely find a nice graph to support. If you ask an AI to generate one for you it might be able to though. If you really still think you need it. > For example, I'm seeing that SELinux didn't mitigate ShellShock where AppArmor did (despite being an attack vector that isn't really common). Well that's nonsense. SELinux can protect against anything AppArmor can since AppArmor provides only a subset of features. I sense you might not be interested in this since you've said you just want benchmarks, but here's a page from RedHat not only explaining how SELinux prevents Shellshock from being able to do damage, but even walks you through exploiting it on an SELinux enabled system so you can test it yourself[1]. There's also a blog post from Dan Walsh explaining how SELinux constrains shell shock [2]. I'm also less confident AppArmor is as effective against container escape exploits like these [3] [4] > But these are the things I want to know. Mmm. Well, there's no benchmarks. But if you do research you will find the examples you want. SELinux will have substantially more examples because it's employed in wider use due to RedHat and Android. If you really want to compare, look at the Debian and RedHat security advisories, and look how many RedHat has saying that SELinux provides protection if enabled, and how many Debian and Ubuntu have being unable to say the same for AppArmor. But really, again, you should bother to understand the feature sets and actual technology. This approach you want looking for benchmarks, it's not going to necessary be accurate or representative, and I say that confident that your methodology would still show SELinux as the better option (in terms of security, not usability/convenience). The key is that you should strive to understand systems you want to use, not just look for a blog article that can provide justification for an intuition or desire. [1] https://github.com/RedHatDemos/SecurityDemos/blob/master/2019Labs/RHELSecurityLab/documentation/lab2_SELinux.adoc#2-1-2-shellshock-vulnerability-and-selinux https://github.com/RedHatDemos/SecurityDemos/blob/master/201... [2] https://danwalsh.livejournal.com/71122.html https://danwalsh.livejournal.com/71122.html [3] https://www.redhat.com/en/blog/latest-container-exploit-runc-can-be-blocked-selinux https://www.redhat.com/en/blog/latest-container-exploit-runc... [4] https://www.redhat.com/en/blog/selinux-mitigates-container-vulnerability https://www.redhat.com/en/blog/selinux-mitigates-container-v...