Linux Security Summit North America 2024

While mandatory access control provides an operating system level of security; its policy need to encompass the whole behavior of an Application. Applications however often have different phases of execution and can even use privilege separation between different components. To achieve this privilege separation or sandboxing applications often use a different set of technologies from the MAC system, however this isn't necessary. In this presentation we will explore the work to extend AppArmor to support applications using it as a backend for performing unprivileged access control. We examine the challenges, pitfalls and changes that were needed to provide both a flexible native API and the ability to emulate OpenBSD's pledge and unveil APIs so that applications that have been already modified can be supported.