Bringing Object Delegation To AppArmor
summary
Adds FD-based object delegation to AppArmor that delegates individual open file descriptors (inheritance and SCM_RIGHTS) using a secondary state-machine bounding checked against the original delegator, cached on a file blob, and recorded with an audit trail. Targets existing kernel file objects only; avoids inode xattr complexity. Works with portals, flatpaks and LXD-style container workflows but exposes gaps: clone/namespace edge cases, missing LSM hooks, no revocation, larger policies and slower compiles. Changes are implemented and functional but still work in progress.
AI-written summary · about
chapters (25)
- 0:00AppArmor and object delegation
- 1:04Dynamic access control challenges
- 2:30FD objects implementation scope
- 3:54Delegation rules and policy
- 5:19State machine for delegation
- 7:04Profile access bounding rules
- 9:13Inheritance and domain transitions
- 11:38Clone and namespace issues
- 13:03Delegation checks and fallback
- 14:05Atomic permission delegation
- 15:07Confused deputy risks
- 15:53Delegation in containers
- 17:15Delegation check performance
- 18:21Kernel file blob objects
- 20:09Caching delegation state
- 21:13Memory optimization trade-offs
- 22:17Profile replacement and state
- 24:27Shell environment limitations
- 25:08Flatpak and container benefits
- 26:51Policy complexity and tooling
- 27:55Performance and compilation overhead
- 28:35LSM hook refactoring
- 29:17Revocation and future work
- 30:21Policy analysis comparisons
- 31:02Q&A
related talks
29mOverview and Recent Developments: AppArmor
48mUnprivileged Access Control in AppArmor
32mUsing a Different LSM from the Host in a Container
09mSub-system Update: AppArmor Update 2018
17mAppArmor
07mSubsystem Update: AppArmor Update 2019
39mAppArmor Update
32mSecurity Namespace: Making Linux Security Frameworks Available to Containers