Hacker News new | past | comments | ask | show | jobs | submit login

I think that both AppArmor and SELinux are unusable in practice due to lack of better tools for generating those configurations.

There needs to be better graphical tools for this, like a "profiler" or similar that watches a process for a specific time for errors in the config and that incrementally adds features while the process is running.

In my opinion, systemd sandboxes are where it's at. [1] They are seccomp based sandboxes, but have a lot of isolation and sandboxing features that are very easy to use, and they can also be incrementally enhanced with both SELinux and AppArmor profiles.

[1] "man systemd.exec" or https://manpages.ubuntu.com/manpages/bionic/man5/systemd.exe...




AA at least has what you are describing.

https://man.archlinux.org/man/aa-genprof.8


I'm trying to solve the lack of tools for AppArmor profile composition: https://github.com/nobody43/apparmor-suggest




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: