Do you use AppArmor and what do you think about it?

[CaffeineAddict]

AppArmor is very likely already installed by default on your distro (it is here on Debian).
It is a sort of replacement of SELinux but much easier to use and manage.

What is AppArmor?

AppArmor

Quick introduction AppArmor is an effective and easy-to-use Linux application security system. AppArmor proactively protects the operating system and applications from external or internal threats, even zero-day attacks, by enforcing good behavior and preventing both known and unknown...

apparmor.net

AppArmor/HowToUse - Debian Wiki

wiki.debian.org

AppArmor already has some built-in rules which from my understanding come together with a package when it's installed,
however it might miss rules for some of them, this is where you can install an additional package called apparmor-utils link which let's you create custom rules automatically or edit existing ones as well as few other utility programs.

Overall what do you think about it and do you create custom rules yourself? or do you at least watch log files if there are violations?

I personally find AppArmor together with aide and debsums a good collection of software for security.
If you know of any similar software to the above 3 (excluding anti-viruses) please share.

 

[dos2unix]

Copilot

Sent by Copilot:​

AppArmor and SELinux are both Mandatory Access Control (MAC) systems that enhance security on Linux systems by controlling access to resources. Here’s a comparison of the two:
AppArmor:

• Access Control: Uses security profiles based on paths1.
• Availability: Commonly used on SUSE and Ubuntu distributions1.
• Ease of Use: Generally easier to set up and administer with a shorter learning curve1.
• System Performance: No impact on performance, though start-up time may be longer1.
• Policy Rules: Less flexible compared to SELinux1.
• Level of Control: Medium1.

SELinux:

• Access Control: Uses security policies based on file labels1.
• Availability: Primarily used on RHEL/Fedora systems1.
• Ease of Use: More complex and less intuitive, requiring more configuration1.
• System Performance: No impact on performance1.
• Policy Rules: More flexible, allowing for a high level of control1.
• Multi-Level Security (MLS)/Multi-Category Security (MCS): Supports MLS/MCS, which AppArmor does not1.

In summary, AppArmor is known for its ease of use and is often preferred for systems where simplicity and ease of management are priorities. SELinux, on the other hand, offers a higher level of control and flexibility, making it suitable for environments that require strict security measures. The choice between AppArmor and SELinux may depend on the specific needs of the system and the expertise of the administrator.

 

[The Duck]

Copilot

Sent by Copilot:​

AppArmor and SELinux are both Mandatory Access Control (MAC) systems that enhance security on Linux systems by controlling access to resources. Here’s a comparison of the two:
AppArmor:

• Access Control: Uses security profiles based on paths1.
• Availability: Commonly used on SUSE and Ubuntu distributions1.
• Ease of Use: Generally easier to set up and administer with a shorter learning curve1.
• System Performance: No impact on performance, though start-up time may be longer1.
• Policy Rules: Less flexible compared to SELinux1.
• Level of Control: Medium1.

SELinux:

• Access Control: Uses security policies based on file labels1.
• Availability: Primarily used on RHEL/Fedora systems1.
• Ease of Use: More complex and less intuitive, requiring more configuration1.
• System Performance: No impact on performance1.
• Policy Rules: More flexible, allowing for a high level of control1.
• Multi-Level Security (MLS)/Multi-Category Security (MCS): Supports MLS/MCS, which AppArmor does not1.

In summary, AppArmor is known for its ease of use and is often preferred for systems where simplicity and ease of management are priorities. SELinux, on the other hand, offers a higher level of control and flexibility, making it suitable for environments that require strict security measures. The choice between AppArmor and SELinux may depend on the specific needs of the system and the expertise of the administrator.

Pretty much sums it up.

 

[KGIII]

I'm an AppArmor user, though I don't tend to interact with it directly. It's one of those things that just runs and does what it does - as it's installed and enabled by default. I've also played with SELinux.