AppArmor Adds IO_uring Mediation & Some Performance Optimizations

[phoronix]

Phoronix: AppArmor Adds IO_uring Mediation & Some Performance Optimizations

The AppArmor Linux security system has picked up a few improvements and new features with the in-development Linux 6.7 kernel...

https://www.phoronix.com/news/Linux-6.7-AppArmor

[timofonic]

Who uses AppArmor other than Canonical? Even NSALinux is used by Android.

[Termy]

Who uses AppArmor other than Canonical?

Me, for example. Although basically only to "sandbox" Firefox while keeping the plasma integration working - haven't found any other better sandboxing solution that can keep that integration intact.

[varikonniemi]

Who uses AppArmor other than Canonical? Even NSALinux is used by Android.

For instance Manjaro. Completely transparent with no user complaints, question is is it actually doing something?

[gssdu]

For instance Manjaro. Completely transparent with no user complaints, question is is it actually doing something?

I've had exactly this thought, running a Manjaro system with, well, no complaints! I have not looked into AppArmor enough to know what might provoke it into action or what that action would be.

[Luke_Wolf]

For instance Manjaro. Completely transparent with no user complaints, question is is it actually doing something?

Admittedly the last time I looked into this was a decade ago, but at the time the answer was no unless you went and started messing with the configs yourself because actually setting up MAC and having a usable system is a pain in the ass, so the only distro with both active and enabled MAC was Fedora/RHEL and even then it took them a long time to switch SELinux to enforcing mode.

[Vorpal]

Who uses AppArmor other than Canonical? Even NSALinux is used by Android.

I use it, it is a quite convenient way to sandbox individual programs and daemons that I consider high risk or high impact (uses network and/or has a lot of privileges). I'm not interested in learning SELinux for that purpose. Nor am I interested in having MAC for the entire system.

AppArmor is very easy, with helper tools such as aa-logprof to help create correct profiles.

And I run Arch, not Ubuntu. Works fine except that the dbus mediation is missing. Would have to rebuild the dbus daemon for that support, but since I run dbus-broker anyway I won't have AppArmor support.

[Estranged1906]

Who uses AppArmor other than Canonical? Even NSALinux is used by Android.

Debian and openSUSE for example. In fact, nobody except for IBM's GNU/Linux distros use SELinux.