bk99.de entertain the web since 1997

bk99.de
CCC · Linux securityCurated

AppArmor and SELinux compared

Summary

Ralf Spenneberg compares AppArmor and SELinux as mandatory access control systems and shows differences in model, configuration and administration. A less powerful model can be more secure in practice if operators actually maintain it. Additional control only helps if policies match the real behaviour of applications.

Ideas

  • Mandatory access control restricts processes in addition to classic Unix file permissions.
  • AppArmor describes access mainly by file paths.
  • SELinux labels objects and subjects with security contexts.
  • Both systems reduce damage after an application has been compromised.

Recommendations

  • Get to know denials in logging mode first.
  • Extend policies in a targeted way and avoid blanket permissions.

References

Watch the talk

Search the Web Archive

CCC · 2022

Linux security monitoring with audit events

Hilko Bengen shows how Linux auditd delivers fine-grained host events and how the unwieldy format can be made usable for attack detection with reasonable effort. Network monitoring only detects many attacks together with context from the affected host. More telemetry only helps if events are reliably correlated and prioritised.

CCC · 2023

Operation Triangulation: Five vulnerabilities to iPhone surveillance

oct0xor, kucher1n and bzvr_ reconstruct a multi-stage iOS zero-click chain that combined four zero-days and an undocumented hardware feature. The chain used five vulnerabilities, four of them zero-days. The analysis led to fixes for four previously unknown vulnerabilities.

CCC · 2021

Two-factor authentication for your own SSH server

Florian Winkler shows how SSH can be extended with a second factor via PAM and which configuration steps effectively secure your own Linux server. More factors only increase security if recovery and bypasses are designed just as carefully. A factor stored separately makes the theft of a single file less valuable.