AppArmor

AppArmor ("Application Armor") is a Linux kernel security module that allows system administrators to restrict programs' capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the permission to read, write, or execute files on matching paths. AppArmor supplements the traditional Unix discretionary access control (DAC) model by providing mandatory access control (MAC). It has been partially included in the mainline Linux kernel since version 2.6.36. Canonical has supported the development of AppArmor since 2009.

AppArmor ("Application Armor") is a Linux kernel security module that allows system administrators to restrict programs' capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the permission to read, write, or execute files on matching paths. AppArmor supplements the traditional Unix discretionary access control (DAC) model by providing mandatory access control (MAC). It has been partially included in the mainline Linux kernel since version 2.6.36. Canonical has supported the development of AppArmor since 2009. ==Details== In addition to manually creating profiles, AppArmor includes a learning mode, in which profile violations are logged, but not prevented. This log can then be used for generating an AppArmor profile, based on the program's typical behavior. AppArmor is implemented using the Linux Security Modules (LSM) kernel interface. AppArmor is offered in part as an alternative to SELinux, which critics consider difficult for administrators to set up and maintain. Unlike SELinux, which is based on applying labels to files, AppArmor works with file paths. Proponents of AppArmor claim that it is less complex and easier for the average user to learn than SELinux. They also claim that AppArmor requires fewer modifications to work with existing systems. For example, SELinux requires a filesystem that supports "security labels", and thus cannot provide access control for files mounted via NFS. AppArmor is filesystem-agnostic. ==See also== Security-Enhanced Linux Systrace ==References== ==External links== AppArmor Wiki AppArmor - Ubuntu Wiki SDB:AppArmor - openSUSE Wiki AppArmor - ArchWiki COUNTERPOINT - Novell and Red Hat security experts face off on AppArmor and SELinux SLES 15 SP2 | Security and Hardening Guide | Confining Privileges with AppArmor LKML: Tony Jones: [RFC][PATCH 0/11] security: AppArmor - Overview

Text derived from https://en.wikipedia.org/w/index.php?oldid=1358184708 under CC BY-SA 4.0; modifications have been made.