What is AppArmor?
AppArmor is the most effective and easy-to-use Linux application security system available on the market today. AppArmor is a security framework that proactively protects the operating system and applications from external or internal threats, even zero-day attacks, by enforcing good program behavior and preventing even unknown software flaws from being exploited. AppArmor security profiles completely define what system resources individual programs can access, and with what privileges. A number of default policies are included with AppArmor, and using a combination of advanced static analysis and learning-based tools, AppArmor policies for even very complex applications can be deployed successfully in a matter of hours.
Why do I need AppArmor?
Software flaws in complex applications provide attackers with an avenue to compromise systems that host critical data in the enterprise. Firewalls and other forms of perimeter security only solve part of the problem because businesses are having to open their network to access by customers, partners and mobile employees. So, the perimeter essentially shrinks down to the machine that hosts the critical data. IT organizations struggle to keep these machines patched to protect against the latest exploits, but this reactive security strategy still leaves businesses exposed.
With experience, hackers are becoming faster at exploiting a vulnerability and sometimes a hacker may be the first to discover the vulnerability. A zero-day exploit is one that takes advantage of a security vulnerability on the same day that the vulnerability becomes generally known leaving businesses little or no time to fetch, QA and apply patches to their systems. AppArmor provides a way to lock down those systems so that software flaws, whether they are known or unknown, can’t be exploited to compromise the system. And, AppArmor solves the problem of zero-day exploits by providing a proactive security model that enforces good application behavior regardless of the latest attack.
How does AppArmor work?
Most operating systems have a built-in security mechanism known as access control. Linux employs Discretionary Access Control (DAC) which means that a program runs with the permissions of the user executing it. Since we have seen that attackers often exploit flaws in programs that allow them to compromise systems, giving a program all the privileges of the user running the program is highly risky.
AppArmor supplements the discretionary access control mechanism of Linux with Mandatory Access Control (MAC). Under mandatory access control, each program runs with a very strict set of permissions that are specified by the system, not the user. AppArmor enforces the idea of least privilege for programs, that is, granting programs only the privileges they need to do their job and nothing else.
Check out
Apparmor FAQ - Developer Community for the full FAQ
