Show HN: Appamor.d – Full set of AppArmor profiles (~ 1500 profiles)

Is this your own work? Show HN is for sharing something you've personally created. See https://news.ycombinator.com/showhn.html

I ask because I don't see any indication of that on this post or the other one (https://news.ycombinator.com/item?id=39867639).

On the XZ back door thread multiple people are shitting on systemd I, but I think its sandboxing model is easier because you just couple the expected behavior of your application along with the unit. Interested people should look here[1] and [2] in case you need resource limitations, like limiting the amount of CPU a process can use.

Of course, there is no way to isolate a backdoored piece of code running in the same address space as yours.

[1] https://www.freedesktop.org/software/systemd/man/latest/syst... [2] https://www.freedesktop.org/software/systemd/man/latest/syst...

These have to be distributed in the operating system by default. Ubuntu ships some, but they sandbox limited set of applications.

I installed some of these anpparmo profiles in Ubuntu, and had to spend a lot of time profiling and fixing permissions. This was an ever changing process, also required security knowledge. Eventually, I removed them.