Similar to T937 but this is for defense in depth and even preventing root from getting access to kernel symbols.
Description
Description
Details
Details
- Impact
- Normal
Related Objects
Related Objects
Event Timeline
Comment Actions
/boot/ is already unreadable.
https://github.com/Whonix/apparmor-profile-everything/pull/31
Comment Actions
Still need to add /boot to https://github.com/Whonix/apparmor-profile-everything/blob/master/etc/apparmor.d/abstractions/dangerous-files? Currently cannot find it there.
Comment Actions
/boot isn't allowed in init-systemd anyway so we don't need to add it to dangerous-files. Apparmor denies access to files that aren't explicitly allowed. The only reason we need to blacklist /lib/modules and not /boot is because we give access to all libraries.
Comment Actions
Any attempted access of /boot would be logged the same way anyway although it might be good to use that to stop it from showing up in aa-logprof.