1. AppArmor Update 2015 Linux Security Summit
Presentation by
John Johansen
August 2015

2. What's driving AppArmor development at Canonical?
Securing container workloads with the ability to place the container in its own AppArmor policy namespace
Application isolation for Ubuntu phone and tablet images
wiki.ubuntu.com/SecurityTeam/Specifications/ApplicationConfinement

3. Recent improvements

4. Kernel side Frame work for socket labeling
Supports older simple af masking rules
“Plug-in” arch for per AF finer grained mediation
Unix domain sockets first AF “plug-in” implemented
Labeling core
Bug Fixing (apologies to our users)
Revision & cleanup
Improved backporting support (android kernels)
Improved support for policy versions
Revisions on the new features from last year (signal, ptrace, ...)

5. Userspace Upstreamed dbus daemon mediation support
Lots of Bug fixing on new userspace tools (started as gsoc project)
New library apis for:
Compiled policy cache management
Compiled policy loading
Feature set support/abis supported by the kernel
Basic systemd integration
Server side policy compile for image based updates
Policy compiler improvements (up to 40% faster)

6. Looking forward

7. Kernel Ideally nothing until ...
Finish cleanup and upstream out tree kernel patches
Extension to support userspace helper daemons
Namespace stacking
Secmark support
Ioctl white listing (for some strange reason this has increased in priority)
Filling in the gaps (kdbus, binder, …)
Improvements to learning mode
Better support of bring up mode
Performance improvements

8. Userspace Finish systemd integration Directly use policy load api
More policy compiler performance enhancements
dconf/gsettings privsep
Policy enforces no direct access
Library reroutes to daemon, that consults and enforces policy
Better policy versioning support
Policy improvements
Address developer complaints

9. Questions please Thank you
John Johansen