I am wondering how unsafe Ubuntu linux actually is. Having different file permissions for root / and other users might today not be enough and actually when asking many people might point out that all the often unsufficiently safe file permissions in Ubuntu are supplemented by AppArmor.
AppArmor is a MAC (no addres, it means mandatory access controll) and in short its puropose is to limit the mischief a program can do. Without AppArmor a program can do quite a bit of mischief -at least in the context of the user account. And being honest having the whole user-account as a playground a further privelige escalation is possible. Hence here AppArmor should help. A program receives a profile that can will make that even though (from its file permissions) the program could (say delete your files) it is not allowed to do so.
One might think "happy chocolate cake eating", everything is safe, after all Ubunut ships with this magic security thing Apparmor "out of the box"
My question is: Is this the truth? Is ubuntu , having AppArmor, anything safer?
My reasons for that are: - 1) In essence Apparmor is to my believe up to noway configured. And worse even when there is no profile in place this means that the situation is as bad as if there would never ever have been a AppArmor. Then it is useless (source: http://wiki.apparmor.net/index.php/FAQ#Is_AppArmor_policy_Default_Deny_.28White_listing.29)
2) Firefox is the default browser and due to its being using "arbitrary content from the web" it is the number one unsafe thing. If you want so, it is one of the best targets. Any wrong addon (installed in 2min) can basically delete , worse shred all your files. And AppArmor does what about it? Nothing it just ignores firefox. I can only imagine why one would wish to have no protection when indeed it is the most necessary.
3) Lastly: The so-famous apparmor-profiles package (which after all at least tries to bring the missing thing for safety: namely the profiles who limit applications) has been looked at here and it's said that those profiles are unfortunatelly not so safe.
4) What does AppArmor do for the trouble that X-Server can be so easily keylogged? little to nothing. Once typed sudo and entered your credentials? well "Congrats" with your addon-hacker browser there are good chances that a keylogger has yielded some good result. Arguably this flaw to security is not a trouble of Ubnutu and AppArmor only, though it is said that a LSM and AppArmor does nothing about it.
In a nutshell I think the only reason why ubuntu (with AppArmor) is not striken by malware like hell, is because it is not the most werthwhile target. But in no way Ubuntu is safe and not a bit safer even with AppArmor.
But I might be overlooking something and I am eager to learn the truth! Therefore please tell me the answer to the question possed So is UBUNTU absolutely vulnerable and in that context, what is AppArmor werth?