Platform and application security: Linux distributions, AppArmor and more

Looking for the safest Linux distribution? Hardening Linux author and security expert James Turnbull ponders the field and difficulties in ranking distro's security in

Requires Free Membership to View

this Q&A . He also weighs in on security tool strength, as in AppArmor versus SELinux, and other platform and application security conundrums.

Is AppArmor suitable as an alternative to SELinux? Since SUSE is dropping support for SELinux, should an IT shop using SUSE switch distros?

More on Linux and open source security:
Ask James a question

See more of James' answers

James Turnbull: AppArmor is perfectly suitable as an alternative to SELinux. Indeed, if your shop already uses SUSE, then I strongly recommend investigating AppArmor before making the significant decision to migrate distributions. I believe you will find that AppArmor provides equivalent support to SELinux and with the additional benefit of being supported under SUSE, hence not requiring distribution migration.

Of course, if you have significant implementation and investment in SELinux, then potentially migration to Red Hat or another distribution that supports SELinux might be an option.

How does security differ between Linux distros? What tools are offered by commercial distros? What are the strengths and weaknesses of them?

Turnbull: There are far too many variables (and far too many distributions!) to make a simple comparison between security on various distributions. Additionally, security is only one of the considerations you need to factor in when deciding on a particular distribution. Cost, ease-of-use, administration and performance are all other factors that should be considered.

Obviously, some distributions (both commercial and not) offer features that others don't. For example, SUSE's support for AppArmor or SELinux support in many distributions. In comparing the security of distributions, some of the factors I'd recommend considering are:

  • Default installation security, i.e. how secure is the host when installed. For example, whether a firewall is enabled or are a minimal number of packages installed, etc.
  • Availability and frequency of patches and updates. It's also worth reviewing previous security vulnerabilities that the distribution has had.
  • Availability of features such as SELinux, GrSecurity, PaX, ExecShield

How does application security on Linux compare to that of UltraSparc Solaris or AIX?

Turnbull: I think application security on Linux compares well with that of Solaris or AIX. However, arbitrary comparisons like this are problematic and too generic.

How application security compares is dependent on how the Linux, Solaris and AIX hosts and their applications are configured, updated, managed and secured. In order to make a more accurate comparison, I'd need to know the applications in question, the precise operating system and some details about their configuration.

Swiftfox, a Firefox-based broswer, has licensing the prohibits re-packaging and re-distribution. Can licensing on these terms provide additional security since there is only one person handling the code, as opposed to many random, unknown users?

Turnbull: Well, the answer to this depends on whether the package is actually CLOSED source or is open source and licensed in that manner. In this case, Swiftfox is not closed source but rather licensed to prevent re-packaging and re-distribution. People can contribute patches and fixes to Swiftfox -- the restriction is that third-parties can't take this source code and re-badge or re-distribute it.

In Swiftfox's situation, this licensing is designed to prevent tainted binaries being distributed. Indeed, the license may make it harder for someone to distribute a malicious copy of Swiftfox they have produced themselves, but only if the user reads the license, works out the package is not legitimate and thus does not install it. Savvy users will probably take note, but users unfamiliar with the variations in licensing probably will not. As the author states, the restriction is a safeguard -- it's not a complete defense.

Additionally, security is more than open or closed source or differences in licenses. Security is a process. Hence, what also must be considered when weighing whether an application is secure are a number of other factors, including:

  • A secure design
  • Security-conscious developer(s)
  • Use of appropriate risk-based controls, such as authentication
  • Appropriate auditing and review of the code for security issues

All of these factors contribute to the overall security of an application and should be weighed, in a risk-based manner, when considering the security of a particular application.

Have a question or comment about the tip? Email us. And don't forget to visit our new blog, the Enterprise Linux Log.

This was first published in April 2007

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.