/g/ - >the best security feature we have to sandbox prog - Technology


08/21/20	New boards added: /vrpg/, /vmg/, /vst/ and /vm/
05/04/17	New trial board added: /bant/ - International/Random
10/04/16	New board for 4chan Pass users: /vip/ - Very Important Posts
[Hide] [Show All]

Anonymous
05/13/26(Wed)15:57:56 No.108816446

File: 1778702198328.jpg (14 KB, 474x237)

Anonymous 05/13/26(Wed)15:57:56 No.108816446

>the best security feature we have to sandbox programs
>takes hours to configure per program
I want to kill myself, apparmor sisters

Anonymous
05/13/26(Wed)15:59:41 No.108816454

Anonymous 05/13/26(Wed)15:59:41 No.108816454

>>108816446
Try vibe configuring it.

Anonymous
05/13/26(Wed)16:24:10 No.108816581

Anonymous 05/13/26(Wed)16:24:10 No.108816581

File: 1662479014568.png (385 KB, 720x720)

385 KB PNG

>>108816446
Use systemd-nspawn instead.

Anonymous
05/13/26(Wed)16:39:54 No.108816675

Anonymous 05/13/26(Wed)16:39:54 No.108816675

File: 1778704781374.png (1.58 MB, 1875x1080)

1.58 MB PNG

>>108816581
looks like it's on my level
tank yew big sis

Anonymous
05/13/26(Wed)16:41:48 No.108816687

Anonymous 05/13/26(Wed)16:41:48 No.108816687

@grok write an apparmor config for this app please

Anonymous
05/13/26(Wed)16:42:04 No.108816690

Anonymous 05/13/26(Wed)16:42:04 No.108816690

>>108816446
SELinux > AppArmor

Anonymous
05/13/26(Wed)16:43:17 No.108816700

Anonymous 05/13/26(Wed)16:43:17 No.108816700

>>108816690
>>108816690
If he can't figure out apparmor he's definitely not going to figure out SELinux.

Anonymous
05/13/26(Wed)16:44:00 No.108816706

Anonymous 05/13/26(Wed)16:44:00 No.108816706

>>108816690
SELinux is the ultimate corporate busywork.
Policies can be so idiotically complex, it's unreal.

Anonymous
05/13/26(Wed)16:46:12 No.108816721

Anonymous 05/13/26(Wed)16:46:12 No.108816721

>>108816690
Literal NSAware

Anonymous
05/13/26(Wed)17:34:12 No.108816993

Anonymous 05/13/26(Wed)17:34:12 No.108816993

>>108816690
nice try NSA

Anonymous
05/13/26(Wed)21:21:31 No.108818192

Anonymous 05/13/26(Wed)21:21:31 No.108818192

>>108816446
>best
not even close. just use namespaces.

Anonymous
05/14/26(Thu)06:36:21 No.108820346

Anonymous 05/14/26(Thu)06:36:21 No.108820346

There are plenty of pre-configured profiles

https://github.com/roddhjav/apparmor.d

Anonymous
05/14/26(Thu)06:47:05 No.108820395

Anonymous 05/14/26(Thu)06:47:05 No.108820395

>>108816446
I always preferred tomoyo for systemwide hardending and firejail for specific/situational suff, i only use apparmor because my distro ships it already enabled.

Anonymous
05/14/26(Thu)06:58:26 No.108820445

Anonymous 05/14/26(Thu)06:58:26 No.108820445

>>108816690
if he already whinges about apparmour config then he's gonna cry rivers about selinux config.

Anonymous
05/14/26(Thu)07:17:42 No.108820528

Anonymous 05/14/26(Thu)07:17:42 No.108820528

>>108816690
SELinux seems to be more complete in the kernel whereas apparmor has missing parts, but from a configuration standpoint, I think apparmor is significantly more granular by default...

Anonymous
05/14/26(Thu)08:35:58 No.108820881

Anonymous 05/14/26(Thu)08:35:58 No.108820881

>>108816581
>systemd-NSApawn

Anonymous
05/14/26(Thu)09:44:09 No.108821334

Anonymous 05/14/26(Thu)09:44:09 No.108821334

>>108816446
You don't need more than seccomp/namespaces/landlock.
seccomp == OpenBSD pledge()
namespaces+landlock == OpenBSD unveil()

The Linux implementations are inferior to OpenBSD obviously, but they serve the same purpose.

Anonymous
05/14/26(Thu)09:45:10 No.108821337

Anonymous 05/14/26(Thu)09:45:10 No.108821337

>>108816690
>NSAlinux

Anonymous
05/14/26(Thu)09:48:13 No.108821360

Anonymous 05/14/26(Thu)09:48:13 No.108821360

Selinux mogs it.

Anonymous
05/14/26(Thu)09:50:20 No.108821370

Anonymous 05/14/26(Thu)09:50:20 No.108821370

File: 1703908961779.png (338 KB, 600x982)

338 KB PNG

>>108821360
>t.

Anonymous
05/14/26(Thu)09:52:06 No.108821382

Anonymous 05/14/26(Thu)09:52:06 No.108821382

>>108821370
Lazy cunt.

Anonymous
05/14/26(Thu)09:54:30 No.108821395

Anonymous 05/14/26(Thu)09:54:30 No.108821395

File: 1705527051256.png (307 KB, 680x420)

307 KB PNG

>>108821382
>Lazy cunt.

Anonymous
05/14/26(Thu)09:55:31 No.108821406

Anonymous 05/14/26(Thu)09:55:31 No.108821406

>>108816446
Just use namespaces... podman for CLI shit and daemons and flatpak for UI shit are perfect and shield you from the usual UNIX retardism of "if an attacker excutes one malicious line of code, your entire computer is fucked".

AppArmor and SELinux are archaic attempts to make the old, non-sandboxed model work.

Anonymous
05/14/26(Thu)12:18:41 No.108822421

Anonymous 05/14/26(Thu)12:18:41 No.108822421

>>108821406
>flatpak for UI shit
The thing is, I want to run an AppImage built with electron. This limits the options I have. I don't think this will work

Anonymous
05/14/26(Thu)14:57:37 No.108823485

Anonymous 05/14/26(Thu)14:57:37 No.108823485

>>108821334
He probably does for GUI applications

Anonymous
05/14/26(Thu)17:54:17 No.108824718

Anonymous 05/14/26(Thu)17:54:17 No.108824718

zump

Name
Options
Comment
Verification	4chan Pass users can bypass this verification. [Learn More] [Login]
File
Please read the Rules and FAQ before posting. You may highlight syntax and preserve whitespace by using [code] tags.