I've never been tempted by AppArmor because SELinux is awesome. The learning curve is brutal, but when it works, it's beautiful.
You configure a targeted policy for a daemon, and that policy describes all of the reasonable behaviour profiles for the daemon. Files and directories are assigned contexts referenced by the policies.
If it attempts to write to a directory that isn't part of its normal context, permission denied. Open an abnormal socket? denied. Abnormal IPC? denied.
Comments
I've never been tempted by AppArmor because SELinux is awesome. The learning curve is brutal, but when it works, it's beautiful.
You configure a targeted policy for a daemon, and that policy describes all of the reasonable behaviour profiles for the daemon. Files and directories are assigned contexts referenced by the policies.
If it attempts to write to a directory that isn't part of its normal context, permission denied. Open an abnormal socket? denied. Abnormal IPC? denied.