liveBook · Manning

AppArmor

As explained in Kubernetes in Action, Second Edition

AppArmor is a Linux security mechanism that enforces mandatory access control using path-based profiles for processes.

AppArmor is a Linux mandatory access control mechanism that strengthens container isolation. It uses path-based profiles to restrict what processes can access, adding protection beyond basic container isolation. section 2.3.4

AppArmor belongs to a group of mechanisms that reduce the impact of compromised or overly privileged containers:

  • AppArmor focuses on processes and file paths. section 2.3.4
  • SELinux applies policies to labels attached to files, resources, users, and processes. section 2.3.4
  • Together with namespaces, control groups, capabilities, and seccomp, AppArmor contributes to layered container isolation. section 2.3.4 section 2.4

How Kubernetes in Action, Second Edition covers it

How deep it goes
Defines AppArmor’s path-based process model and contrasts it with SELinux, but stops short of profile creation or configuration.
Examples
Uses the contrast between AppArmor paths and SELinux labels as its concrete example.
What it assumes
Assumes a basic understanding of namespaces while introducing AppArmor as one part of container isolation.
What you can do after
Evaluate how AppArmor contributes to layered container isolation and distinguish it from SELinux.
How it connects
Connects AppArmor with mandatory access control, SELinux, namespaces, control groups, capabilities, and seccomp.
Cover of Kubernetes in Action, Second Edition
liveBookmanning.com
Read Kubernetes in Action, Second Edition on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Kubernetes in Action, Second Edition. The section links point to the parts of the book it draws on.