AppArmor
lastmod 2020-12-03created 2020-06-273 edits
AppArmor ("Application Armor") is a Linux kernel security module that allows the system administrator to restrict programs' capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the permission to read, write, or execute files. AppArmor supports the traditional Unix discretionary access control (DAC) model by providing mandatory access control (MAC). It has been included since Linux version 2.6.36, and its development has been supported by Canonical since 2009.
Details
Instead of writing profiles directly, AppArmor includes a learning mode, in which profile violations are logged but not prevented. This log can be used to generate an AppArmor profile based on the program's typical behavior.
AppArmor is implemented using the Linux Security Modules (LSM) kernel interface.
AppArmor is offered in part as an alternative to SELinux, which critics consider difficult for administrators to set up and maintain. Unlike SELinux, which is based on applying labels to files, AppArmor works with file paths. Proponents of AppArmor claim that it is much easier for average users to learn than SELinux. They also claim that AppArmor requires fewer modifications to work with existing systems: for example, SELinux requires a file system that supports "security labels", and thus cannot provide access control for files mounted via NFS. AppArmor is file-system agnostic.