Lessons Learned While Making an AppArmor Play Machine

on YouTube ↗38m

" summary

Demonstrates a VM where everyone logs in as root but is limited solely by AppArmor policies, using Full System Policies (FSP) mode and the apparmor.d toolchain to enforce a role-based tree of profiles. Describes building the live Play Machine (https://play.pujol.io) and publishing profiles and tooling (https://github.com/roddhjav/apparmor.d), debugging profile transitions with kernel audit logs, finding dozens of unexpected profile hops (e.g. ~10 just for motd), and fixing privilege‑leak cases so the demo runs reliably.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 2:11What is AppArmor Play Machine
3. 6:09Confining programs with AppArmor
4. 9:05AppArmor overview and profiles
5. 13:10Confining systemd services
6. 17:28Role-based access control
7. 21:06Debugging profile transitions
8. 26:26Security pitfalls in profiles
9. 28:51Capabilities and limits
10. 31:41Future directions
11. 34:36Conclusion and Q&A

" related talks

• 48mUnprivileged Access Control in AppArmorJohn Johansen, Georgia Garcia · Linux Security Summit North America 2024
• 33mBuilding the Largest Working Set of Apparmor ProfilesAlexandre Pujol · Linux Security Summit North America 2023
• 29mOverview and Recent Developments: AppArmorJohn Johansen · Linux Security Summit Europe 2018
• 39mAppArmor UpdateJohn Johansen · Linux Security Summit Europe 2025
• 17mAppArmorJohn Johansen · Linux Security Summit 2016
• 33mBinary Policy with IMA and AppArmorEric Chiang · Linux Security Summit North America 2019
• 09mSub-system Update: AppArmor Update 2018John Johansen · Linux Security Summit North America 2018
• 07mSubsystem Update: AppArmor Update 2019John Johansen · Linux Security Summit North America 2019