View previous topic :: View next topic |
Author |
Message |
gengreen Apprentice
Joined: 23 Dec 2017 Posts: 150
|
Posted: Sat Apr 21, 2018 11:55 am Post subject: [musl done] Apparmor |
|
|
I'm sharing today a testing ebuild of apparmor for musl profile. This work ins't ready for a general use. Any help regarding the cleanup / rewrite of those ebuild or anything that can help to improve apparmor on musl is welcome.
Thanks to alpine linux which made 99% of the work
https://git.alpinelinux.org/cgit/aports/tree/testing/apparmor
Ebuild available at : https://github.com/g3ngr33n/apparmor-musl-gentoo
--------------------------
Update :
- Ebuild and patch cleaned
- Add sys-libs/libapparmor, sys-app/apparmor-utils
- Fix init file of sys-app/appamor
- Patch for firejail with the useflag apparmor enabled
- Ebuild for dev-libs/libintl
Update (2) :
- Dynamic linking is now working
- Patch cleaned
- Manual mode should work without problem (not fully tested)
Todo :
- Test the ebuild on systemd / dbus system
- Make a hardened profile for firejail, firefox...
- Fix the need of dev-libs/libintl (as musl have intl integrated....)
Note
All good
Last edited by gengreen on Thu Apr 26, 2018 1:23 am; edited 15 times in total |
|
Back to top |
|
|
gengreen Apprentice
Joined: 23 Dec 2017 Posts: 150
|
Posted: Wed Apr 25, 2018 11:28 am Post subject: |
|
|
Repo updated.
Ebuild should be alright, I still need tests / feedbacks to improve this work
Thanks ! |
|
Back to top |
|
|
steveL Watchman
Joined: 13 Sep 2006 Posts: 5153 Location: The Peanut Gallery
|
Posted: Wed Apr 25, 2018 1:14 pm Post subject: |
|
|
Good work, gengreen!
I was amazed (and impressed) to see you attacking the base first.
Still not got a musl install, but I should get some time to play around in the next couple of months.
Keep it up. :-) |
|
Back to top |
|
|
gengreen Apprentice
Joined: 23 Dec 2017 Posts: 150
|
Posted: Wed Apr 25, 2018 2:17 pm Post subject: |
|
|
Thanks for this feeback, I will keep it up until it's good enough to be pull on the official musl Gentoo |
|
Back to top |
|
|
_j n00b
Joined: 05 Jan 2018 Posts: 9
|
Posted: Thu Apr 26, 2018 8:05 pm Post subject: |
|
|
gengreen wrote: | Thanks for this feeback, I will keep it up until it's good enough to be pull on the official musl Gentoo |
Hi there,
Thank you for doing this! Between grsec being gone and not liking selinux (cough 3-letter agency cough; even if it is fine I wouldn't touch it with a 10-foot pole) another MAC implementation is quite needed!
I have one qualm for which I wasn't sure to bring up here or on the github tracker - it seems that dev-util/libintl collides with the one that musl provides.
Quite a few things didn't build until I one-shotted musl again (cryptsetup, alsa-utils, and I'm sure others)... What does libintl do in relation to apparmor anyways? |
|
Back to top |
|
|
_j n00b
Joined: 05 Jan 2018 Posts: 9
|
Posted: Sun Apr 29, 2018 9:56 pm Post subject: |
|
|
Cheers for sorting it! |
|
Back to top |
|
|
gengreen Apprentice
Joined: 23 Dec 2017 Posts: 150
|
Posted: Tue May 01, 2018 10:08 pm Post subject: |
|
|
Hey j !
You are welcome, I wanted too apparmor to harden my system since the lost of Grsec and do not feel nsaseLinux... :p
I'm sharing today the apparmor profile for firejail that I actually use :
https://github.com/g3ngr33n/apparmor-musl-gentoo/blob/master/apparmor.d/firejail-default
And some profiles of Firejail :
https://github.com/g3ngr33n/apparmor-musl-gentoo/tree/master/firejail-profile
I would like to have feedback about it :
I only use a single apparmor profile. I'm trying to restrict as much as possible the firejail-default (apparmor) allowing the minimum needed for each of my app to run with firejail.
Each app have their "own" firejail profile (much more harden than the default one). Only fluxbox and urxvt aren't using firejail.
Is that a good strategy of security ? Or should I write an apparmor profile for each of those app ? |
|
Back to top |
|
|
gengreen Apprentice
Joined: 23 Dec 2017 Posts: 150
|
Posted: Sun Jun 03, 2018 12:29 pm Post subject: |
|
|
Hello,
Just an update about apparmor 2.13, to be release soon
musl should be supported as they already merged the proposed patch of Patrick S. I tested today the build available at https://gitlab.com/pks-t/apparmor/tree/pks/musl-2.13.0, it worked nicely.
Waiting now for the official release ! |
|
Back to top |
|
|
gengreen Apprentice
Joined: 23 Dec 2017 Posts: 150
|
|
Back to top |
|
|
|