Apart from high-overhead solutions like VMs and containers, there are seamless and maintenance-free solutions (after the initial setup):
- systemd service hardening [0] [1]
pretty powerful, but it's a blacklist approach - whack-a-mole
- AppArmor [2]
Whitelist, proactive approach. Contrary to SElinux, it's not a programming language, and could be grasped pretty quickly. I made a tool to easily convert AA logs into usable rules. [3]
Apart from high-overhead solutions like VMs and containers, there are seamless and maintenance-free solutions (after the initial setup):
- systemd service hardening [0] [1]
pretty powerful, but it's a blacklist approach - whack-a-mole
- AppArmor [2]
Whitelist, proactive approach. Contrary to SElinux, it's not a programming language, and could be grasped pretty quickly. I made a tool to easily convert AA logs into usable rules. [3]
[0] https://github.com/alegrey91/systemd-service-hardening
[1] https://github.com/desbma/shh
[2] https://presentations.nordisch.org/apparmor/
[3] https://github.com/nobody43/apparmor-suggest