linux-kernel April 2007 archive
Main Archive Page > Month Archives  > linux-kernel archives
linux-kernel: Re: [AppArmor 00/41] AppArmor security module over

Re: [AppArmor 00/41] AppArmor security module overview

From: Pavel Machek <pavel_at_nospam>
Date: Thu Apr 12 2007 - 13:50:29 GMT


> AppArmor's Overall Design
> =========================
> AppArmor protects systems from vulnerable software by confining
> processes, giving them "least privilege" access to the system's
> resources: with least privilege, processes are allowed exactly what they
> need, nothing more, and nothing less. Systems are thus protected from
> bugs in applications that would lead to privilege escalation, such as
> remote system access because of a buffer overflow in a web server, etc.
> AppArmor does this by defining application profiles which list allowed
> accesses, and assigning those profiles to processes. AppArmor does *not*

You can do the same with ptrace. If that's not fast enough... improve ptrace?

> The corollary to this is that attacks against AppArmor that start with
> "assume some unconfined process does ..." are outside the AppArmor
> threat model. Any process that might do something malicious to an

IOW AppArmor is broken by design. (One reason is: operations by unconfined processes that did not use to be security sensitive before -- ln shadow random_name -- are security sensitive now.)

                                                        Pavel -- (english) (cesky, pictures) - To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to More majordomo info at