Ubuntu Linux Bible, 11th Edition

CHAPTER 23Enhancing Linux Security with AppArmor

IN THIS CHAPTER

• Learning about AppArmor benefits
• Learning how AppArmor works
• AppArmor configuration
• Finding AppArmor resources

AppArmor is a name-based mandatory access control (MAC) security model that’s currently supported by Canonical (the company behind Ubuntu). AppArmor has been included in the Linux kernel since version 2.6.36 (released back in 2010), with new features added pretty regularly. AppArmor fills much of the same security needs as Red Hat’s SELinux, but with significantly less complexity.

Understanding AppArmor

AppArmor is a security enhancement module deployed on top of Linux. It provides additional security measures and is installed and active by default. The thing about AppArmor—unlike its Red Hat equivalent SELinux—is that you can often use Ubuntu for years and never realize it’s there. Now consider just how AppArmor works and why you need it.

You’ve already seen a number of traditional Linux features, including discretionary access controls (DACs) like object permissions. Such permissions are called discretionary because an entity (like a user) with legitimate access to a resource has the power to extend that access to other entities. Where you’re concerned that this power might be abused—where, for instance, there’s risk of a hacker executing a privilege escalation attack—you might want to impose mandatory access control. MACs are applied on processes rather than on resources themselves to ensure ...