In this lesson, you will learn how to harden your Linux environment by strictly limiting which processes possess the authority to mount or unmount file systems, effectively closing a common vector for kernel-level escapes.
The Danger of Arbitrary Mounts
By default, the mount system call is a powerful interface. If an attacker gains limited execution privileges within a compromised application, they may attempt to mount a malicious file system (like a crafted ISO or a loopback device) over a critical system directory. By masking existing system files with malicious versions, they can trick legitimate processes into executing unauthorized code or escalating privileges to the kernel level.
Restricting Access with AppArmor
While SELinux uses labels to govern mount access, AppArmor provides a very intuitive path-based approach to lock down these operations. In your profile definitions, you can explicitly deny or permit mounting capabilities.
To restrict mount operations for a specific profile, you utilize the mount rule. When you want to ensure a service has zero capacity to alter the mount table, you simply omit any mount permissions, or explicitly deny them if global policy settings are loose.
Example of a restrictive profile snippet:
profile restricted-service /usr/bin/restricted-service {
# Deny all mount operations explicitly
deny mount,
deny umount,
# Standard file access...
/etc/restricted-service/ r,
/var/log/restricted-service/ rw,
}
Why This Matters
When you define these restrictions, the kernel's LSM (Linux Security Module) intercepts the mount system call before it ever reaches the VFS (Virtual File System) layer. If the profile associated with the calling process does not have an explicit allow rule for that mount point and filesystem type, the kernel returns EPERM (Operation not permitted).
By enforcing this, you ensure that even if an application is compromised, the attacker remains trapped within the file system structure you have already defined. They cannot "break out" by remounting a directory as read-write or overlaying a hostile file system onto a sensitive path like /etc or /proc.
Key Takeaway: Restricting mount operations at the profile level is a critical defense-in-depth strategy that prevents attackers from manipulating the kernel's view of the file system to facilitate escapes.