AppArmor
AppArmor is an access control system that lets you specify per
program which files the program may read, write, and execute. AppArmor
secures applications by enforcing good application behavior without
relying on attack signatures, so it can prevent attacks even if they
are exploiting previously unknown vulnerabilities.
AppArmor is a Linux Security Module implementation of
name-based access controls. AppArmor confines individual programs to a
set of listed files and posix 1003.1e draft capabilities.
AppArmor protects your infrastructure from attackers who find
and exploit application flaws by helping you rapidly develop and
enforce security policies. These policies could, for example, define
the scope of an application's access to system resources or enforce
beneficial application behavior. AppArmor gives you the tools to
protect your critical infrastructure without huge investments in time,
resources or training.
AppArmor protects systems from insecure or untrusted processes
by running
them in confinement, still allowing them to share files with other
parts of the system, exercising privilege, and communicating with other
processes,
but with some restrictions. These restrictions are mandatory; they are
not bound
to identity, group membership, or object ownership. In particular, the
restrictions also apply to processes running with superuser privileges.
AppArmor achieves
this by plugging into the Linux Security Module (LSM) framework. The
protections
provided are in addition to the kernel’s regular access control
mechanisms.
Features include:
- Easy to use
- Full integration
- Easy deployment - it includes a full integrated
suite of tools to help you develop, deploy and maintain
application security policies
- Auditable policies
- Protects the operating system, custom and third-party
applications from both external and internal threats by enforcing
appropriate application behavior
- Reporting and alerting. Built-in features allow users to
schedule detailed event reports and configure alerts based on
user-defined events
- Sub-process confinement
Return
to MAC/RBAC Tools Home Page
Last Updated Tuesday, April 24 2012 @ 02:39 PM EDT
| 
