Name: Lessons Learned While Making an AppArmor Play Machine - Alexandre Pujol, Linagora
Start: 2025-06-26T09:55:00-0600
End: 2025-06-26T10:40:00-0600

June 26 - 27 | Denver, Colorado
View More Details & Registration
Note: The schedule is subject to change.

The Sched app allows you to build your schedule but is not a substitute for your event registration. You must be registered for Linux Security Summit North America 2025 to participate in the sessions. If you have not registered but would like to join us, please go to the event registration page to purchase a registration.

This schedule is automatically displayed in Mountain Daylight Time (MDT | UTC-6). To see the schedule in your preferred timezone, please select from the drop-down menu to the right, above "Filter by Date."

Thursday June 26, 2025 9:55am - 10:40am MDT

Room BBB 3G+3H

A Play Machine is what is called a system with root as the guest account with only Apparmor to restrict access. It aims to demonstrate that necessary security can be provided by Apparmor without any Unix permissions and thus that root is not everything in modern security.

This play machine uses the apparmor.d project with the Full System Policies (FSP) mode enabled and enforced.
FSP is a special mode of apparmor.d that aims to provide profiles and user roles for every process and users and that ensure no unconfined process can run on the system.

In this talk, we will review the main challenges we encountered — including the security architecture of the profiles, testing, and profile integration. We will also discuss the complications involved in providing open root access on a VM to everyone.

The profiles, tooling, and documentation for the project have been published at https://github.com/roddhjav/apparmor.d. The play machine itself is available at https://play.pujol.io/

Speakers

Alexandre Pujol

System Engineer, Linagora

Alexandre Pujol is a French system engineer at Linagora. He is is graduated from a PhD Student in computer security & privacy in University College Dublin, Ireland. His area of work includes user privacy, secret management, and system security. He is the author of multiple password-store... Read More →

Thursday June 26, 2025 9:55am - 10:40am MDT
Room BBB 3G+3H

Refereed Presentation

Linux Security Summit North America 2025

Alexandre Pujol

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!