Comment by nobody42

9 hours ago

And it's a proper way to use computer nowadays.

Apart from high-overhead solutions like VMs and containers, there are seamless and maintenance-free solutions (after the initial setup):

- systemd service hardening [0] [1]

pretty powerful, but it's a blacklist approach - whack-a-mole

- AppArmor [2]

Whitelist, proactive approach. Contrary to SElinux, it's not a programming language, and could be grasped pretty quickly. I made a tool to easily convert AA logs into usable rules. [3]

[0] https://github.com/alegrey91/systemd-service-hardening

[1] https://github.com/desbma/shh

[2] https://presentations.nordisch.org/apparmor/

[3] https://github.com/nobody43/apparmor-suggest

0 comments

nobody42

Reply