AppArmor
Description
AppArmor is a Mandatory Access Control framework that Ubuntu has been using for a while.
Current Debian testing (Wheezy) has an AppArmor-enabled kernel.
Some Tails and Debian developers want to see Wheezy released with at least a few working profiles, and specifically (in decreasing order of priority):
- some of the Usual Suspects™ on the Desktop: evince, iceweasel, isc-dhcp-client, pidgin;
- some software that is particularly important in the context of Tails and other privacy-sensitive contexts: Tor, Vidalia;
some low-hanging fruits from Ubuntu's Supported profiles in main list: apache2, libvirt, ntp...
The general workflow wrt. profiles is to find existing profiles, test them in the context of Debian sid, adapt them if needed, and propose them to Debian package maintainers.
Current status
Some of us test a few AppArmor profiles, mainly grabbed from Ubuntu
Patches to add profiles to Debian packages are being filed: Bugs tagged with "new-profile" (used for adding profiles to packages)
How to help
Test: enable AppArmor, enforce a bunch of profiles on your Debian testing/unstable systems, report bugs: testing instructions
Fix bugs tagged "new-profile".
Fix bugs in the apparmor source package.
Import profiles from Ubuntu: get the latest version, test, prepare Debian patch, file bug tagged "new-profile".
Documentation: write basic documentation about the user side of things, starting with: how one enables AppArmor and enforces profiles on Debian.
Other Information
Contact Information
We have no mailing-list yet, but once you and others tell us you want to join the dance, it may be worth creating one; in the meantime:
intrigeri (intrigeri@debian.org)
AppArmor maintainers (apparmor@packages.debian.org)