apparmor.d
Restrict software capabilities with per programme profiles
AppArmor is a security feature built into Linux that restricts what each program on a computer is allowed to do, so that a compromised or misbehaving application cannot reach the user's files, passwords or the rest of the system. It is powerful, but writing the rules is difficult, and in practice very few programs are protected by it. apparmor.d is a collection of about 2000 ready-to-use AppArmor profiles that confine the entire system, from the core services that start the computer to desktop environments, web browsers and everyday applications. This project aims to make it reliable enough to be switched on by default: automated tests, clearly documented security and threat model, tools that let users choose a security level and adapt profiles to their own setup, and modular packages that distributions can adopt piece by piece.
- The project's own website: https://apparmor.pujol.io
This project was funded through the NGI0 Commons Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101135429. Additional funding is made available by the Swiss State Secretariat for Education, Research and Innovation (SERI).
