Snap arm64 on linuxondex

Last time I checked Matthew Garrett started a discussion about providing confinement via SELinux on platforms where SELinux is available instead of AppArmor.

On the implementation side this would require snapd to generate policies using more sophisticated methods, i.e abstracting policy generation away while - where simple template-based string insertion is used now - describing interfaces (user-visible) which are already very abstract through even more abstract means (internally).

Additionally, if it’s possible to have hierarchy-based implications within SELinux policies (context/label x implies y as y being a subset of x) then the path-based nature of AppArmor could indeed be mapped onto SELinux policies.

1 Like