Improving Unmodified Classic Application Confinement
summary
Canonical uses AppArmor plus snap sandboxing and DBus endpoint labeling to tighten confinement for unmodified apps, and pulls an upstream AppArmor patch into Ubuntu's kernel. Experiments show unprivileged user namespaces appear in four of five 2022 exploit chains, so access is restricted for confined apps. Work includes dynamic file/application tagging, kernel- or loader-based environment-variable filtering, LD_PRELOAD/code-injection prototypes, syscall-interception and seccomp prototypes; prototypes reduce exposure but many techniques are ugly and only partially complete.
AI-written summary · about
chapters (9)
- 0:00Start
- 5:28Confinement Sandboxing
- 15:47Extracting User Intent
- 20:03Environment Variables
- 24:58Application Arguments
- 27:31Forced Launcher
- 28:58Code Injection
- 30:44Address Matching
- 43:40Syscall Interception
related talks
47mRestricting Unprivileged User Namespaces in Ubuntu
55mWhat Use Is a Confined User Shell?
29mOverview and Recent Developments: AppArmor
39mAppArmor Update
07mSubsystem Update: AppArmor Update 2019
17mAppArmor
43mAre you Sure your System Applications are Secure? Reduce Exploit...
45mMaking Containers Safer