Application Whitelisting in Linux environment
summary
Fapolicyd uses the kernel fanotify exec hook to pause exec syscalls and query a policy daemon, relying on an RPM DB backend to mark packaged files as trusted. Policy rules match subject, object and permission and use allow/deny/audit actions; examples show enabling a home-directory binary by adding an object rule, marking files in the trust file, or permitting a directory (less secure). Demo shows how to run fapolicyd from systemd, inspect denied events, and iterate rules until the program executes.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:45Importance of Application Whitelisting
- 1:34What is Hippo CD Framework
- 5:35Optional backends
- 6:22Subject of limitation
- 7:37Installation
- 7:58Enable Custom Software
- 8:11Example
- 9:05Investigate Output
- 12:27Running Application
- 12:38Running Application again
- 13:18Running Python Script
- 13:37Running Python Interpreter
- 14:18Enable whole directory
- 14:37Mark as trusted
- 15:04Enable FFPocky
related talks
47mApplication Whitelisting
33mBinary Policy with IMA and AppArmor
38mLessons Learned While Making an AppArmor Play Machine
37mUsing RHEL built in Security Technologies daily
38mBringing Object Delegation To AppArmor
29mOverview and Recent Developments: AppArmor
39mAppArmor Update
45mFinally, a Smack Reference Policy