News for hackers. Stuff that matters.

A comment on Ask HN: What do you want to see in Debian 10 (“buster”)?.

Re:Ask HN: What do you want to see in Debian 10 (“buster”)? by rahiel on Sunday June 18, 2017 @07:46AM (#14580243)
HEADLINE: enable AppArmor by default

DESCRIPTION: AppArmor improves security by limiting the capabilities of programs. Ubuntu has done this years ago [1]. I'd like to see profiles for web browsers enabled by default.

I think AppArmor is the right choice of default Mandatory Access Control for Debian because Ubuntu and security focused Debian derivatives like Tails [2] and SubgraphOS [3] have already committed to it.

[1]: https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/AppArmorP...

[2]: https://tails.boum.org/contribute/design/application_isolati...

[3]: https://subgraph.com/

[ Parent | on HN ]
Re:Ask HN: What do you want to see in Debian 10 (“buster”)? by aleden on Sunday June 18, 2017 @05:47PM (#14583130)
AppArmor is like SELinux though: it's annoying so people just turn it off. Most recent example I encountered was on Ubuntu 1604; I wanted to run VMs under QEMU/KVM with libvirt but AppArmor was preventing the VM from using a USB device from the host. Just by chance I took a look at dmesg and saw some audit message about qemu bridge helper.
[ Parent | on HN ]
Re:Ask HN: What do you want to see in Debian 10 (“buster”)? by finchisko on Sunday June 18, 2017 @10:45AM (#14580847)
Yes. This is good one. RHEL by default has active SELinux profile for samba and that's why was not affected by SambaCry. I vote for AppArmour.
[ Parent | on HN ]
Re:Ask HN: What do you want to see in Debian 10 (“buster”)? by based2 on Sunday June 18, 2017 @07:53AM (#14580263)
https://github.com/subgraph/subgraph_metaproxy

'Metaproxy is not going to work very well with IPv6'

[ Parent | on HN ]
Re:Ask HN: What do you want to see in Debian 10 (“buster”)? by kebolio on Sunday June 18, 2017 @08:00AM (#14580294)
has nothing to do with apparmor.
[ Parent | on HN ]
Re:Ask HN: What do you want to see in Debian 10 (“buster”)? by ptman on Monday June 19, 2017 @06:26AM (#14585815)
Why not SELinux?
[ Parent | on HN ]
Re:Ask HN: What do you want to see in Debian 10 (“buster”)? by rahiel on Monday June 19, 2017 @10:04AM (#14587026)
Because Debian has already done much work on integrating AppArmor [1].

And Debian based distro's like Ubuntu, Tails, and Subgraph also work on AppArmor so choosing AppArmor over SELinux means overall less work for the Debian community.

[1]: https://wiki.debian.org/AppArmor/Progress

[ Parent | on HN ]
Re:Ask HN: What do you want to see in Debian 10 (“buster”)? by ibaldouy on Saturday July 01, 2017 @03:17PM (#14678495)
SELinux is more secure, flexible and comprehensive, so Debian should adopt it by default... Anyway if AppArmor gets selected by default, I hope I can switch somewhat easily to SELinux if I want to.
[ Parent | on HN ]