How AppArmor can benefit a systems administrator

AppArmor is the Mandatory Access Control system that comes installed with the SUSE and the Ubuntu families of Linux. Although it's designed to do pretty much the same job as SELinux, its mode of operation is substantially different:

  • SELinux labels all system processes and all objects such as files, directories, or network ports. For files and directories, SELinux stores the labels in their respective inodes as extended attributes. (An inode is the basic filesystem component that contains all information about a file, except for the file name.)
  • AppArmor uses pathname enforcement, which means that you specify the path to the executable file that you want for AppArmor to control. This way, there's no need to insert labels into the extended attributes of files or directories.
  • With SELinux, you have system-wide protection out of the box.
  • With AppArmor, you have a profile for each individual application.
  • With either SELinux or AppArmor, you might occasionally find yourself having to create custom policy modules from scratch, especially if you're dealing with either third-party applications or home-grown software. With AppArmor, this is easier, because the syntax for writing AppArmor profiles is much easier than the syntax for writing SELinux policies. And, AppArmor comes with utilities that can help you automate the process.
  • Just as SELinux can, AppArmor can help prevent malicious actors from ruining your day and can help protect user data. 

So, you see that there are advantages and disadvantages to both SELinux and AppArmor, and a lot of Linux administrators have strong feelings about which one they prefer. (To avoid being subjected to a flame-war, I'll refrain from stating my own preference.) Also, note that even though we're working with an Ubuntu virtual machine, the information I present here, other than the Ubuntu-specific package installation commands, also works with the SUSE Linux distos.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.221.222.47