Qemu also offers a sandboxing functionality, which would work very well alongside apparmor.
This one uses seccom to block dangerous syscalls and has few other protections.
It can currently be activated by setting the -args: -sandbox on
I've been...
I'm looking to activate Apparmor for the Proxmox VMs, in order to add an additional level of security, especially the processes are running as root.
Currently, this is what I've came up with:
#include <tunables/global>
profile...