Unprivileged Access Control in AppArmor
Talkat Linux Security Summit North America 2024 · on Friday, 2024-04-19· at 09:05· Terrace Suite 1+2·
summary
Extends AppArmor so applications can load application-directed profiles from user space: a tiny compiler converts text rules into AppArmor’s verified kernel state machine, profiles can be updated, locked, and stacked with system policy, and current loading uses prctl with a planned LSM syscall. A user-space library parses OpenBSD pledge and unveil strings into AppArmor rules (exec and kill semantics mapped via per-rule flags), but threading, hidden-directory unveil behavior, and linear cost from many stacked profiles remain work in progress; Boolean conditionals are being added to fix the stacking cost.
AI-written summary · about
chapters (20)
- 0:00Unprivileged access control in AppArmor
- 1:02AppArmor for application policy
- 3:57Dynamic policy updates in AppArmor
- 6:09Multi-threaded app confinement
- 8:36Policy tracking and inheritance
- 10:45Confinement in threaded apps
- 12:51Dynamic updates and exec behavior
- 14:43Introspection and policy stacking
- 17:16Pledge and unveil mapping
- 21:53Handling pledge violations
- 24:24Promise reduction and kernel guarantees
- 27:15Unveil to AppArmor file rules
- 30:26Unveil directory semantics challenges
- 34:07Combining pledge and unveil
- 35:58Introspection and stacking order
- 37:47Sandboxing mechanisms comparison
- 39:56AppArmor design goals
- 41:46AppArmor integration and use cases
- 43:54Pledge/unveil semantic drift
- 45:40Future work on pledge/unveil
related talks
38mLessons Learned While Making an AppArmor Play Machine
29mOverview and Recent Developments: AppArmor
17mAppArmor
50mImproving Unmodified Classic Application Confinement
47mRestricting Unprivileged User Namespaces in Ubuntu
33mBuilding the Largest Working Set of Apparmor Profiles
38mBringing Object Delegation To AppArmor
07mSubsystem Update: AppArmor Update 2019