Fosstodon

AskUbuntuWhy am I getting apparmor="DENIED" for python3 when I update my system with apt update? <a href="https://ubuntu.social/tags/apt" class="mention hashtag" rel="nofollow noopener" target="_blank">#apt</a> <a href="https://ubuntu.social/tags/python3" class="mention hashtag" rel="nofollow noopener" target="_blank">#python3</a> <a href="https://ubuntu.social/tags/apparmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#apparmor</a><a href="https://askubuntu.com/q/1553525/612" rel="nofollow noopener" translate="no" target="_blank">https://askubuntu.com/q/1553525/612</a>

AskUbuntuHanding non-standard home when packaging a snap <a href="https://ubuntu.social/tags/permissions" class="mention hashtag" rel="nofollow noopener" target="_blank">#permissions</a> <a href="https://ubuntu.social/tags/snap" class="mention hashtag" rel="nofollow noopener" target="_blank">#snap</a> <a href="https://ubuntu.social/tags/homedirectory" class="mention hashtag" rel="nofollow noopener" target="_blank">#homedirectory</a> <a href="https://ubuntu.social/tags/packaging" class="mention hashtag" rel="nofollow noopener" target="_blank">#packaging</a> <a href="https://ubuntu.social/tags/apparmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#apparmor</a><a href="https://askubuntu.com/q/1553450/612" rel="nofollow noopener" translate="no" target="_blank">https://askubuntu.com/q/1553450/612</a>

🚀 Несерьёзный Выдумщик 👨‍🔬Хорошая и <a href="https://habr.com/ru/articles/541190/" rel="nofollow noopener" target="_blank">годная статья</a> про безопасность <a href="https://shitpost.poridge.club/tags/Android" rel="nofollow noopener" target="_blank">#Android</a> устройств с разблокированным загрузчиком. Детально и подробно, с разных сторон разобран процесс загрузки Android-систем нескольких версий, включая <a href="https://shitpost.poridge.club/tags/LineageOS" rel="nofollow noopener" target="_blank">#LineageOS</a> и виды сборок прошивок. Рассмотрен подход к работе <a href="https://shitpost.poridge.club/tags/Magisk" rel="nofollow noopener" target="_blank">#Magisk</a> и варианты получения root'а разными средствами с учётом контекстов <a href="https://shitpost.poridge.club/tags/SELinux" rel="nofollow noopener" target="_blank">#SELinux</a>, а так же работа через <a href="https://shitpost.poridge.club/tags/adb" rel="nofollow noopener" target="_blank">#adb</a> (в каких случаях имеет root'привелегии). Статья большая, но полезная с точки зрения «получить представление» без упрощений, а с техническими деталями. TL;DR Глупо выключать устройство, когда остаётся без присмотра, а описываемый сценарий не касается уже работающего (загруженного полностью, включённого) девайса. Если же устройство неожиданно оказалось выключенным, то нельзя включать и вводить пин\пароль. Сперва надо проверить содержимое разделов (на тот или иной вариант «нагрузки»). Т.е. включать через <code>fastboot</code>, прошивать заново рекавери (<a href="https://shitpost.poridge.club/tags/TWRP" rel="nofollow noopener" target="_blank">#TWRP</a> или <a href="https://shitpost.poridge.club/tags/OrangeFox" rel="nofollow noopener" target="_blank">#OrangeFox</a>) и прошерстить\восстановить разделы. Очень наглядно видно зачем в ОС нужны такие вещи как mandatory access control (MAC): • <a href="https://shitpost.poridge.club/tags/SELinux" rel="nofollow noopener" target="_blank">#SELinux</a> (авторство АНБ США), • <a href="https://shitpost.poridge.club/tags/AppArmor" rel="nofollow noopener" target="_blank">#AppArmor</a> (via Novell & Immunix), • российский аналог в AstraLinux. На статью навёл <a href="https://social.openhood.ru/@sun_rise" class="u-url mention" rel="nofollow noopener" target="_blank">@sun_rise@social.openhood.ru</a> <a href="https://shitpost.poridge.club/tags/AndroidSecurity" rel="nofollow noopener" target="_blank">#AndroidSecurity</a> <a href="https://shitpost.poridge.club/tags/MAC" rel="nofollow noopener" target="_blank">#MAC</a> <a href="https://shitpost.poridge.club/tags/security" rel="nofollow noopener" target="_blank">#security</a> <a href="https://shitpost.poridge.club/tags/privacy" rel="nofollow noopener" target="_blank">#privacy</a> <a href="https://mastodon.social/@russian_mastodon" class="u-url mention" rel="nofollow noopener" target="_blank">@russian_mastodon@mastodon.social</a> <a href="https://3zi.ru/@Russia" class="u-url mention" rel="nofollow noopener" target="_blank">@Russia@3zi.ru</a> <a href="https://social.sley.nl/@rur" class="u-url mention" rel="nofollow noopener" target="_blank">@rur@social.sley.nl</a>

openSUSE LinuxFind out what happened in this <a href="https://fosstodon.org/tags/oSC25" class="mention hashtag" rel="tag">#oSC25</a> talk about the switch of <a href="https://fosstodon.org/tags/SELinux" class="mention hashtag" rel="tag">#SELinux</a> as the default MAC system in <a href="https://fosstodon.org/tags/openSUSE" class="mention hashtag" rel="tag">#openSUSE</a> Tumbleweed, This talk will explore the shift from <a href="https://fosstodon.org/tags/AppArmor" class="mention hashtag" rel="tag">#AppArmor</a> and the lessons learned. A must-watch for those following system security! 🐧 <a href="https://fosstodon.org/tags/Linux" class="mention hashtag" rel="tag">#Linux</a> <a href="https://fosstodon.org/tags/openSUSE" class="mention hashtag" rel="tag">#openSUSE</a> <a href="https://youtu.be/8wBLbhSjDwE?si=1fOBIHkq1KkU5ynV" target="_blank" rel="nofollow noopener" translate="no">https://youtu.be/8wBLbhSjDwE?si=1fOBIHkq1KkU5ynV</a>

GripNews🌘 繞過 Ubuntu 非特權命名空間限制的旅程 ➤ Ubuntu 安全強化措施的突破與反思 ✤ <a href="https://u1f383.github.io/linux/2025/06/26/the-journey-of-bypassing-ubuntus-unprivileged-namespace-restriction.html" rel="nofollow noopener" translate="no" target="_blank">https://u1f383.github.io/linux/2025/06/26/the-journey-of-bypassing-ubuntus-unprivileged-namespace-restriction.html</a> 這篇文章詳細描述了研究人員如何發現並繞過 Ubuntu 最新導入的非特權命名空間限制。Ubuntu 旨在透過 AppArmor 強化安全性，限制應用程式建立非特權命名空間的能力，以此降低權限提升攻擊的風險。然而，研究人員透過深入分析核心層級的實作，發現了繞過此限制的方法，並分享了研究過程中的經驗和挑戰。儘管最終發現的繞過方法與其他研究人員發現的相似，但其起點源於核心層面的分析，使其具有獨特的價值。 + 真是令人驚訝！Ubuntu 宣稱的安全性竟然有漏洞，這也提醒我們，任何安全措施都不是萬無一失的。 + 這篇文章的詳細分析很有幫助，對於對 Linux 安全感興趣的人來說，是個很好的學習資源。 <a href="https://mastodon.social/tags/%E5%AE%89%E5%85%A8%E7%A0%94%E7%A9%B6" class="mention hashtag" rel="nofollow noopener" target="_blank">#安全研究</a> <a href="https://mastodon.social/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> <a href="https://mastodon.social/tags/AppArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppArmor</a> <a href="https://mastodon.social/tags/%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8" class="mention hashtag" rel="nofollow noopener" target="_blank">#漏洞利用</a>

Richard ChamberlainTried integrating ROS2 on Oracle Linux with SELinux—no go. Switched to AppArmor on Ubuntu—easier, yes. Effective? Not quite.colcon and AppArmor don’t play well together. Turns out, AppArmor’s simplicity can limit it in complex dev environments.Here’s my story, what didn’t work, and where I’m heading next: 🔗 <a href="https://richard-sebos.github.io/sebostechnology/posts/AppArmor-ROS2/" rel="nofollow noopener" translate="no" target="_blank">https://richard-sebos.github.io/sebostechnology/posts/AppArmor-ROS2/</a>Boosts appreciated if you think secure ROS2 needs better tooling. 🧵<a href="https://mastodon.social/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> <a href="https://mastodon.social/tags/FOSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#FOSS</a> <a href="https://mastodon.social/tags/ROS2" class="mention hashtag" rel="nofollow noopener" target="_blank">#ROS2</a> <a href="https://mastodon.social/tags/AppArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppArmor</a> <a href="https://mastodon.social/tags/SELinux" class="mention hashtag" rel="nofollow noopener" target="_blank">#SELinux</a> <a href="https://mastodon.social/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#DevSecOps</a> <a href="https://mastodon.social/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://mastodon.social/tags/Robotics" class="mention hashtag" rel="nofollow noopener" target="_blank">#Robotics</a>

aaron ~# :blinkingcursor:Today was very productive. I've finished driver installation for <a href="https://infosec.exchange/tags/nvidia" class="mention hashtag" rel="nofollow noopener" target="_blank">#nvidia</a>, <a href="https://infosec.exchange/tags/printers" class="mention hashtag" rel="nofollow noopener" target="_blank">#printers</a> and <a href="https://infosec.exchange/tags/bluetooth" class="mention hashtag" rel="nofollow noopener" target="_blank">#bluetooth</a>. I've also done a lot more stuff like <a href="https://infosec.exchange/tags/AppArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppArmor</a> and also installed void on my main pc using the <a href="https://infosec.exchange/tags/playbook" class="mention hashtag" rel="nofollow noopener" target="_blank">#playbook</a>. So far a great experience. Got it <a href="https://infosec.exchange/tags/gaming" class="mention hashtag" rel="nofollow noopener" target="_blank">#gaming</a> ready already. <a href="https://infosec.exchange/tags/ansible" class="mention hashtag" rel="nofollow noopener" target="_blank">#ansible</a> <a href="https://infosec.exchange/tags/automation" class="mention hashtag" rel="nofollow noopener" target="_blank">#automation</a> <a href="https://infosec.exchange/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#linux</a> <a href="https://infosec.exchange/tags/unix" class="mention hashtag" rel="nofollow noopener" target="_blank">#unix</a> <a href="https://infosec.exchange/tags/voidlinux" class="mention hashtag" rel="nofollow noopener" target="_blank">#voidlinux</a> <a href="https://infosec.exchange/tags/void" class="mention hashtag" rel="nofollow noopener" target="_blank">#void</a>

DeadSwitch @ T0m's 1T C4feSmall business? $0 budget? No excuse. Secure your entire stack with nothing but code, grit, and open source fire. <a href="https://mastodon.social/tags/DeadSwitch" class="mention hashtag" rel="nofollow noopener" target="_blank">#DeadSwitch</a> <a href="https://mastodon.social/tags/FOSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#FOSS</a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://mastodon.social/tags/pfSense" class="mention hashtag" rel="nofollow noopener" target="_blank">#pfSense</a> <a href="https://mastodon.social/tags/WireGuard" class="mention hashtag" rel="nofollow noopener" target="_blank">#WireGuard</a> <a href="https://mastodon.social/tags/Mailcow" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mailcow</a> <a href="https://mastodon.social/tags/LinuxSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#LinuxSecurity</a> <a href="https://mastodon.social/tags/VeraCrypt" class="mention hashtag" rel="nofollow noopener" target="_blank">#VeraCrypt</a> <a href="https://mastodon.social/tags/LibreOffice" class="mention hashtag" rel="nofollow noopener" target="_blank">#LibreOffice</a> <a href="https://mastodon.social/tags/AppArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppArmor</a><a href="http://tomsitcafe.com/2025/05/26/deadswitch-dispatch-secure-the-perimeter-for-0/" rel="nofollow noopener" translate="no" target="_blank">http://tomsitcafe.com/2025/05/26/deadswitch-dispatch-secure-the-perimeter-for-0/</a>

aaron ~# :blinkingcursor:Just finished some testing on <a href="https://infosec.exchange/tags/VoidLinux" class="mention hashtag" rel="nofollow noopener" target="_blank">#VoidLinux</a> and i'm pretty impressed. It feels like using <a href="https://infosec.exchange/tags/ArchLinux" class="mention hashtag" rel="nofollow noopener" target="_blank">#ArchLinux</a>, still it's different. The documentation is really good and i've successfully tested everything i needed, like <a href="https://infosec.exchange/tags/printerdriver" class="mention hashtag" rel="nofollow noopener" target="_blank">#printerdriver</a>, <a href="https://infosec.exchange/tags/apparmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#apparmor</a> and <a href="https://infosec.exchange/tags/nvidia" class="mention hashtag" rel="nofollow noopener" target="_blank">#nvidia</a> drivers. <a href="https://infosec.exchange/tags/XBPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#XBPS</a> is really fast and intuitive. This might really well be my next distro.<a href="https://infosec.exchange/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#linux</a> <a href="https://infosec.exchange/tags/unix" class="mention hashtag" rel="nofollow noopener" target="_blank">#unix</a> <a href="https://infosec.exchange/tags/void" class="mention hashtag" rel="nofollow noopener" target="_blank">#void</a> <a href="https://infosec.exchange/tags/arch" class="mention hashtag" rel="nofollow noopener" target="_blank">#arch</a>

Eduardo Medina 🇪🇸<a href="https://mastodon.social/tags/Nobara" class="mention hashtag" rel="nofollow noopener" target="_blank">#Nobara</a> sustituye <a href="https://mastodon.social/tags/SELinux" class="mention hashtag" rel="nofollow noopener" target="_blank">#SELinux</a> por <a href="https://mastodon.social/tags/AppArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppArmor</a>, rebajando así los estándares de seguridad para mejorar la compatibilidad con los juegos, y ahora sustituye <a href="https://mastodon.social/tags/Firefox" class="mention hashtag" rel="nofollow noopener" target="_blank">#Firefox</a> por el invento del criptobro de Brendan Eich.Mira que agradezco muchísimo las contribuciones de <a href="https://mastodon.social/tags/GloriousEggroll" class="mention hashtag" rel="nofollow noopener" target="_blank">#GloriousEggroll</a> al <a href="https://mastodon.social/tags/LinuxGaming" class="mention hashtag" rel="nofollow noopener" target="_blank">#LinuxGaming</a>, pero la distribución que desarrolla prefiero tenerla bien lejos. <a href="https://linuxiac.com/fedora-based-nobara-linux-goes-rolling/" rel="nofollow noopener" translate="no" target="_blank">https://linuxiac.com/fedora-based-nobara-linux-goes-rolling/</a><a href="https://mastodon.social/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a>

SolusHeya, folks! We have an update on <a href="https://floss.social/tags/Snap" class="mention hashtag" rel="nofollow noopener" target="_blank">#Snap</a> and <a href="https://floss.social/tags/AppArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppArmor</a> support in <a href="https://floss.social/tags/Solus" class="mention hashtag" rel="nofollow noopener" target="_blank">#Solus</a>. We are holding off on our planned Snap support removal for now, as there has been recent progress in upstreaming the AppArmor patch set to the <a href="https://floss.social/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> kernel. We still recommend <a href="https://floss.social/tags/Flatpak" class="mention hashtag" rel="nofollow noopener" target="_blank">#Flatpak</a>, which has integration in GNOME Software and KDE Discover.Read more about it on our blog: <a href="https://getsol.us/2025/05/05/snapd-update/" rel="nofollow noopener" translate="no" target="_blank">https://getsol.us/2025/05/05/snapd-update/</a>- Evan

TZLAnyone currently have a take on the <a href="https://mstdn.social/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> concerns of <a href="https://mstdn.social/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#linux</a> <a href="https://mstdn.social/tags/kernel" class="mention hashtag" rel="nofollow noopener" target="_blank">#kernel</a> user <a href="https://mstdn.social/tags/namespaces" class="mention hashtag" rel="nofollow noopener" target="_blank">#namespaces</a> <a href="https://mstdn.social/tags/usernamespaces" class="mention hashtag" rel="nofollow noopener" target="_blank">#usernamespaces</a>? I have been rereading into it wondering whether enabling or disabling is the best approach. They seem rather insignificant with considerable surface area for attack, from my understanding. However, more applications check for/need them nowadays.I think kernel <a href="https://mstdn.social/tags/hardening" class="mention hashtag" rel="nofollow noopener" target="_blank">#hardening</a> advice is still to disable. Makes me wonder if should e.g. be considered only if <a href="https://mstdn.social/tags/AppArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppArmor</a> / <a href="https://mstdn.social/tags/SELinux" class="mention hashtag" rel="nofollow noopener" target="_blank">#SELinux</a> is active.

Linux G. Fossman<a href="https://framapiaf.org/@debacle" class="u-url mention" rel="nofollow noopener" target="_blank">@debacle</a> <a href="https://mastodon.social/@alatiera" class="u-url mention" rel="nofollow noopener" target="_blank">@alatiera</a> That's great - I love <a href="https://social.vivaldi.net/tags/Debian" class="mention hashtag" rel="nofollow noopener" target="_blank">#Debian</a> : ) I do wish, however, that <a href="https://social.vivaldi.net/tags/sandboxing" class="mention hashtag" rel="nofollow noopener" target="_blank">#sandboxing</a> native apps on Debian using <a href="https://social.vivaldi.net/tags/AppArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppArmor</a> was as <a href="https://social.vivaldi.net/tags/noobeasy" class="mention hashtag" rel="nofollow noopener" target="_blank">#noobeasy</a>* as using <a href="https://social.vivaldi.net/tags/flatpak" class="mention hashtag" rel="nofollow noopener" target="_blank">#flatpak</a> apps with <a href="https://social.vivaldi.net/tags/Flatseal" class="mention hashtag" rel="nofollow noopener" target="_blank">#Flatseal</a>. <a href="https://social.vivaldi.net/tags/noobeasy" class="mention hashtag" rel="nofollow noopener" target="_blank">#noobeasy</a> <a href="https://social.vivaldi.net/tags/noobsimple" class="mention hashtag" rel="nofollow noopener" target="_blank">#noobsimple</a> <a href="https://social.vivaldi.net/tags/newword" class="mention hashtag" rel="nofollow noopener" target="_blank">#newword</a> <a href="https://social.vivaldi.net/tags/neword" class="mention hashtag" rel="nofollow noopener" target="_blank">#neword</a> <a href="https://social.vivaldi.net/tags/did_i_just_invent_a_new_word" class="mention hashtag" rel="nofollow noopener" target="_blank">#did_i_just_invent_a_new_word</a>?

ToastersonIts always <a href="https://chaos.social/tags/AppArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppArmor</a> <a href="https://chaos.social/tags/ubuntu" class="mention hashtag" rel="nofollow noopener" target="_blank">#ubuntu</a> plucky sponsored by $workplace

Zygmunt KrynickiHave you ever wondered what's inside <a href="https://fosstodon.org/tags/AppArmor" class="mention hashtag" rel="tag">#AppArmor</a> profiles that the kernel interprets?

Zygmunt KrynickiDo you know that a single binary profile can contain two distinct profiles? In this example we can see that a single profile called "name" has a so-called hat profile called "name//hat" that is in the same binary file, ready to be loaded into the Linux kernel.<a href="https://fosstodon.org/tags/AppArmor" class="mention hashtag" rel="tag">#AppArmor</a> <a href="https://fosstodon.org/tags/ImHex" class="mention hashtag" rel="tag">#ImHex</a>

Zygmunt KrynickiI've added support to see capabilities allowed by a given binary <a href="https://fosstodon.org/tags/AppArmor" class="mention hashtag" rel="tag">#AppArmor</a> profile to my apparmor-binary project.<a href="https://gitlab.com/zygoon/apparmor-binary" target="_blank" rel="nofollow noopener" translate="no">https://gitlab.com/zygoon/apparmor-binary</a>The animation shows the <a href="https://fosstodon.org/tags/ImHex" class="mention hashtag" rel="tag">#ImHex</a> hex editor.

Gea-Suan Lin把 rsyslog 訊息串到 Slack 與 Pushover 上把之前想弄的東西弄出來了，直接在 rsyslog 上設定條件，然後串到 Slack 以及 Pushover 上。 rsyslog 這邊有不少眉眉角角要處理，本來查到 omhttp，想直接透過 omhttp 打到 HTTPS endpoint，但發現 omhttp 沒有也沒打算包進標準套件裡面 (因為不是由官方開發的)，但文件上面有... 在 2018 年的「rsyslogd: could not load module 'omhttp' #3302」這邊就有提到這個問題了： Sadly, the omhttp module is currently not part of the def…<a href="https://blog.gslin.org/archives/2025/03/20/12312/%e6%8a%8a-rsyslog-%e8%a8%8a%e6%81%af%e4%b8%b2%e5%88%b0-slack-%e8%88%87-pushover-%e4%b8%8a/" rel="nofollow noopener" translate="no" target="_blank">https://blog.gslin.org/archives/2025/03/20/12312/%e6%8a%8a-rsyslog-%e8%a8%8a%e6%81%af%e4%b8%b2%e5%88%b0-slack-%e8%88%87-pushover-%e4%b8%8a/</a><a href="https://abpe.org/tags/api" class="mention hashtag" rel="nofollow noopener" target="_blank">#api</a> <a href="https://abpe.org/tags/apparmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#apparmor</a> <a href="https://abpe.org/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a> <a href="https://abpe.org/tags/omhttp" class="mention hashtag" rel="nofollow noopener" target="_blank">#omhttp</a> <a href="https://abpe.org/tags/omprog" class="mention hashtag" rel="nofollow noopener" target="_blank">#omprog</a> <a href="https://abpe.org/tags/pushover" class="mention hashtag" rel="nofollow noopener" target="_blank">#pushover</a> <a href="https://abpe.org/tags/rsyslog" class="mention hashtag" rel="nofollow noopener" target="_blank">#rsyslog</a> <a href="https://abpe.org/tags/rsyslogd" class="mention hashtag" rel="nofollow noopener" target="_blank">#rsyslogd</a> <a href="https://abpe.org/tags/script" class="mention hashtag" rel="nofollow noopener" target="_blank">#script</a> <a href="https://abpe.org/tags/shell" class="mention hashtag" rel="nofollow noopener" target="_blank">#shell</a> <a href="https://abpe.org/tags/slack" class="mention hashtag" rel="nofollow noopener" target="_blank">#slack</a> <a href="https://abpe.org/tags/syslog" class="mention hashtag" rel="nofollow noopener" target="_blank">#syslog</a> <a href="https://abpe.org/tags/webhook" class="mention hashtag" rel="nofollow noopener" target="_blank">#webhook</a>

pafurijazAfter I've upgraded from to Ubuntu 24.04 LTS, I encountered the error: "The SUID sandbox helper binary was found, but is not configured correctly"I don't know how fix it, that happens every upgrade the <a href="https://mastodon.social/tags/Ubuntu" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ubuntu</a> <a href="https://mastodon.social/tags/AppArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppArmor</a> sucks! And some AppImage, they don't works, I have to use the option "--no-sandbox" and there are others problems related to that as usual. <a href="https://mastodon.social/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#linux</a>🫠

varx/techI've seen <a href="https://infosec.exchange/tags/AppArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppArmor</a> used primarily to *harden* the security of an existing program. Is it also reasonable to use it to *sandbox* known-malicious code? Or are other methods required?(I assume you also want ulimit or similar on the side, but that's to prevent resource consumption attacks rather than sandbox escapes.)<a href="https://infosec.exchange/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> <a href="https://infosec.exchange/tags/sandboxing" class="mention hashtag" rel="nofollow noopener" target="_blank">#sandboxing</a>

Recent searches

Search options

Administered by:

Server stats:

#apparmor