Security Policy: Secure by Design | Building AppArmor Policies for Linux
Traditional Linux security relies on Discretionary Access Control (DAC), which anchors permissions to the User Identity (UID/GID). But this traditional method is vulnerable to "Ambient Authority," where a compromised application running with root privilege can expose sensitive data.
This video shifts your security focus from "Who is running the code?" to "What is the code allowed to do?" by introducing Mandatory Access Control (MAC).
Learn to implement application-centric security with AppArmor, a Linux kernel security module that restricts what an application can do, regardless of the user's privileges.
In this video, you will learn how to:
Understand why DAC is not enough and the benefits of MAC in securing critical systems.
Prepare and install AppArmor on Alpine Linux.
Develop a C program that attempts to read both a "standard file" and a "secret file".
Write a security policy (AppArmor profile) to allow access to the standard file but explicitly deny access to the secret file.
Use apparmor_parser and utilities like aa-genprof and aa-enforce to load and manage your profiles.
Test the program with the policy enforced to demonstrate application sandboxing.
Secure your applications by making them "Secure by Design" with AppArmor policies.
Resources & Links
AppArmor Documentation: https://gitlab.com/apparmor/apparmor/...
EmbeddedCraft Website: http://www.embeddedcraft.org/
#SecureByDesign #LinuxSecurity #AppArmor #MandatoryAccessControl #MACvsDAC #ApplicationSecurity #Cybersecurity #LinuxKernel #AlpineLinux #EmbeddedSystems #SecurityPolicy #AmbientAuthority #privilegeescalation
Chapters
02:21 Introduction AppArmor
03:15 Starting Alpine Linux
05:25 Installing AppArmor Security Module
06:36 Creating AppArmor Profile Manually
09:58 Review AppArmor Setup
10:41 Comparison between MAC and DAC
Subscribe to our channel for all our latest tech tutorials / @embeddedcraft-org
Code link
https://github.com/embeddedcraft/secu...
************************************************
Follow us ...
Facebook:
/ embeddedcraft
X:
https://x.com/embeddedcraft
Linkedin:
/ embeddedcraft-craft-99a47617
**********************************************************
More videos on Embedded System and related topics can be found here…
Review Ubuntu 25.04 | Installation in QEMU and Review New Features
• Review Ubuntu 25.04 - Installation in QEMU...
Configuring NAT with IPTABLES in QEMU - Easy Steps to Get Your VM Online
• Configuring NAT with IPTABLES in QEMU - Ea...
Creating Linux Image for Raspberry PI using Yocto
• Creating Linux Image for Raspberry PI usin...
Installing Alpine Linux on QEMU and using QEMU Monitor
• Installing Alpine Linux on QEMU and using ...
Creating Linux Virtual Machine using QEMU
• Creating Linux Virtual Machine using QEMU
Networking in QEMU part 1 : Host forward method
• Networking in QEMU part 1 : Host forward m...
**********************************************************
Buildroot Tutorial- Linux Kernel on QEMU Virtual board - Booting Linux and Running Linux Application
• Buildroot Tutorial- Linux Kernel on QEMU V...
LED Blinking Application for STM32 Board on QEMU
• LED Blinking for STM32 Board on QEMU
Eclipse and GCC Compiler - Configuring Eclipse to use GCC Compiler for QEMU
• Eclipse and GCC Compiler - Configuring Ecl...
Using QEMU to Emulate Cortex M based board and Running LED Blinking Program
• Using QEMU to Emulate Cortex M based board...
************************************************
Other Important videos
Webserver in Embedded Linux | Running webserver in Raspberry PI
• Webserver in Embedded Linux | Running webs...
Uboot MMC Commands - View content of directory from uboot
• Uboot MMC Commands - View content of direc...
Arduino NANO 33 IOT, Getting Started and Explaining Code
• Arduino NANO 33 IOT, Getting Started and E...
SPI in Embedded Linux – Quick Reference Guide
• SPI in Embedded Linux - Quick Reference Guide
Building Bare-Minimum Linux for QEMU
• Building Bare-Minimum Linux for QEMU
I2C Tutorial-Accessing I2C EEPROM in Linux
• I2C Tutorial-Accessing I2C EEPROM in Linux
Building Linux Kernel and Preparing bootable SD CARD for Beaglebone Board
• Building Linux Kernel and Preparing bootab...
Buildroot Tutorial- Linux Kernel on QEMU Virtual board - Booting Linux and Running Linux Application
• Buildroot Tutorial- Linux Kernel on QEMU V...
LED Blinking Application for STM32 Board on QEMU
• LED Blinking for STM32 Board on QEMU
Run and Debug Embedded Linux Application using GDBServer and GDB
• Run and Debug Embedded Linux Application u...
Building Linux Kernel for QEMU for ARM Board
• Building Linux Kernel for QEMU for ARM Board
Building Linux Kernel, Kernel Modules and Device Tree for Beaglebone Black Board
• Building Linux Kernel, Kernel Modules and ...
Eclipse and GCC Compiler - Configuring Eclipse to use GCC Compiler for QEMU
• Eclipse and GCC Compiler - Configuring Ecl...