apparmor.d

Full set of AppArmor profiles

[!WARNING] This project is still in its early development. Help is very welcome; see the documentation website including its development section.

Description

AppArmor.d is a set of over 1500 AppArmor profiles whose aim is to confine most Linux based applications and processes.

Purpose

Confine all root processes such as all systemd tools, bluetooth, dbus, polkit, NetworkManager, OpenVPN, GDM, rtkit, colord
Confine all Desktop environments
Confine all user services such as Pipewire, Gvfsd, dbus, xdg, xwayland
Confine some "special" user applications: web browsers, file managers, etc.
Should not break a normal usage of the confined software

Goals

Target both desktops and servers
Support all distributions that support AppArmor:
Support for all major desktop environments:
- Gnome (GDM)
- KDE (SDDM)
- XFCE (Lightdm) (work in progress)
Fully tested

Demo

If you want to try this project, or are curious about the advanced usage and security it can provide without installing it on your machine, you can try it online on my AppArmor play machine at https://play.pujol.io/

This project is originally based on the work from Morfikov and aims to extend it to more Linux distributions and desktop environments.

Concepts

There are over 50000 Linux packages and even more applications. It is simply not possible to write an AppArmor profile for all of them. Therefore, a question arises:

What to confine and why?

We take inspiration from the Android/ChromeOS Security Model, and we apply it to the Linux world. Modern Linux security distributions usually consider an immutable core base image with a carefully selected set of applications. Everything else should be sandboxed. Therefore, this project tries to confine all the core applications you will usually find in a Linux system: all systemd services, Xwayland, network, Bluetooth, your desktop environment... Non-core user applications are out of scope as they should be sandboxed using a dedicated tool (minijail, bubblewrap, toolbox...).

This is fundamentally different from how AppArmor is usually used on Linux servers as it is common to only confine the applications that face the internet and/or the users.

Presentations

Building the largest set of AppArmor profiles: