AppArmor vs SELinux vs Grsecurity

AppArmor learns the behaviors of applications through established access controls (for monitoring and reporting) and enforces application security policies.
Security-Enhanced Linux (SELinux) uses rule-based policy enforcement to restrict the functionality of users and services.
Grsecurity uses Linux Security Modules to enhance security of the Linux kernel.

Features	AppArmor	SELinux	Grsecurity
Allow/Deny Policy	Yes	Yes	Yes
Hierarchical Domains	Yes	Yes	Yes
Object Types	Yes	Yes	Yes
Data Types	No	No	No
Account Management	No	Yes	Yes
Service Management	No	Yes	Yes
Network Management	No*	Yes	Yes
Access Control Lists	Yes	Yes	Yes
Role-Based Access Control	Yes	Yes	Yes
Security Context	No	Yes	No
Linux Kernel Module	Yes	Yes	Yes
Language	No	Yes	Yes
Unified Configuration	Yes	No	No
Doesn't Prohibit Other Applications & Tools	Yes	No	No
No Installation	No	No	No
Few Dependencies	Yes	No	Yes
Automated Execution	Yes	Yes	Yes
Learning Mode	Yes	No	Yes
Self-Managed (no framework, no user interaction)	Yes	No	No
Self-Healing (restorative, no user interaction)	No	No	No
Application Programming Interface	No	Yes	No
Remote Access Control	No	No	No
Intrusion Detection System	Yes	Yes	Yes
Logging	Yes	Yes	Yes
Report Generation	Yes	Yes	No
Intrusion Prevention System	Yes	No	No
Malware Protection	Yes	Yes+	Yes+
Updated Signature Scanning & Analysis	No	No	No
Deep Packet Inspection (DPI)	No	No	No

+ Software supports only blacklisting.

Do you have a suggestion about how to improve this blog? Let's talk about it. Contact me at David.Brenner.Jr@Gmail.com or 720-584-5229.

Comments

The meaning of time in reinforcement learning

Reinforcement learning (RL) is one of three basic machine learning paradigms, alongside supervised learning and unsupervised learning. Reinforcement learning is concerned with how software agents ought to take actions in an environment in order to maximize the notion of cumulative reward through the process of trial and error. In reinforcement learning an agent starts at an empty state then analyzes the available datasets according to a policy of positive states and negative states. Rather than being explicitly taught as in supervised learning the correct set of actions for performing a task, reinforcement learning uses rewards as signals for positive states and punishments as signals for negative states. The agent obtains the best path to a desirable reward as a cumulation of positive states and negative states. As compared to unsupervised learning, reinforcement learning is different in terms of goals. While the goal in unsupervised learning is to find similarities and differences...

OpenStack+Ceph as Software-Defined Storage

SDS reduces the costs of the management of growing data stores by decoupling storage management from its hardware to allow for centralized management of cheaper, popular commodity hardware. The example SDS ecosystem uses open source software like OpenStack as a front-end interface on top of Ceph as the resource provider of a RADOS cluster of commodity solid-state drives. OpenStack provides user-friendly wrappers for accessing and modifying underlying Ceph storage. OpenStack comes in the form of distributed microservices with RESTful API's: Block (Cinder), File (Manila), Image (Glance), and Object (Swift). Each microservice can scale-out as a cluster of stand-alone services to accommodate the varying demands of high-growth storage. With OpenStack the underlying Ceph storage can address the block storage needs, file storage needs, image storage needs, and object storage needs of datacenters adopting open source as their new norm in an industry trend for high performace and high a...

Uploading files through Secure WebDAV using DAVfs

WebDAV is a protocol that facilitates uploading and downloading files through HTTP (port 80) and HTTPS (port 443). Whenever a WebDAV service is being ran over SSL it is called Secure WebDAV. DAVfs is a file system interface to the WebDAV protocol, it works with WebDAV and Secure WebDAV. The command mount uses DAVfs to recognize a WebDAV share as a regular file system so that other tools, scripts, services, and users can access the share's contents (as a file system with actual directories). Here's an easy solution for uploading files to your WebDAV account. These instructions work on Linux, FreeBSD, Solaris, and probably other distributions too. 1. Make a local directory for transferring files. mkdir <your directory>; 2. Stop other processes and users from interfering with your transfers. chown root:root <your directory> && chmod 770 <your directory>; 3. Mount your online cloud share using davfs. Enter your password when the prompt appears askin...

David Brenner Jr

Search This Blog