AppArmor

In this video I go over how to set up and configure AppArmor so you can create profiles for any custom scripts or programs you may be using.

AppArmor is a Debian-based alternative to SELinux.

SELinux is prevalent in Red Hat, CentOS, and Fedora systems.

So AppArmor basically allows you the ability to restrict access to certain applications, scripts, or programs to only do certain things or only allowed parts of the system access to that program.

So this is a really great thing.

On the default Ubuntu, I'm running 18.04 and it already comes pre-installed and enabled.

So if you're having a problem with a script, not being able to access a certain thing, there's a good chance AppArmor is actually blocking you and you need to configure it.

So in this video, I go over three basic commands you have to know to maintain AppArmor and add scripts or custom programs to it.

Getting a good low score down in the 1 or 2 range requires manual, iterative tuning.

You apply a restriction, restart the app, check the logs, see if it crashed, and adjust, which brings us to the final and most notorious layer of containment, mandatory access control, or MAC, systems like SELinux or AppArmor.

SELinux is the bane of many junior sysadmins.

It really is.

The best practice is very clear.

Never disable it.

If SE Linux is breaking your application, put it into permissive mode or complain mode for AppArmor.

In this mode, the security guard puts away the handcuffs and just takes notes.

So a kernel upgrade can change how your machine feels without touching a single other package.

It deliberately lacks AppArmor, the NVIDIA driver integration, and ZFS because those are the pieces that need to be redone for every kernel, and you don't wanna do that work on something that's going to be rebased out from under you.

So Linux unstable is the canary.

Linux unstable is the canary.