8

Does AppArmor decrease the system performance? I have a slow system (900 MHz CPU) which has AppArmor because it was installed by default I would like to know if it become faster if I remove it, security is less important than performance on that system.

  • Probably not as much as some hijacked process running the equivalent of rm -rf --no-preserve-root / – jackweirdy Sep 20 '13 at 8:35
  • But how would such a process get into, for example embedded system with no internet access and like? And why in the world would I run unknown executables as privileged user? – Petr Sep 21 '13 at 8:58
  • My example was a little exaggerated, though plausable in principle. No internet access is a different matter, but consider most modern wireless routers, managed switches and SCADA systems - most run web interfaces for reporting and/or configuration. Some even allow authenticated users to modify config files or run commands. Imagine if a weakness were found in such interfaces that allowed non-authenticated users to run commands (likely as root, as embedded devices often only have one user). You'd want some mechanism to make sure the crucial stuff (like /bin) isn't removed. – jackweirdy Sep 21 '13 at 12:22
  • If you're considering apparmor for a very low powered device with absolutely no network access, you may be ok without it. If it has network access, treat it as if it had internet access. – jackweirdy Sep 21 '13 at 12:23
2

Of course, it slows down your system. To which extent depends on what your applications do. File system accesses are slower (because they have to be checked) and all the other things that can be configured. But if a process does not open files or sockets and so on then it should not be affected at all (after initialization).

I just had a short look at my favorite search engine (why didn't you?) and the result is that the impact is irrelevant in most cases.

| improve this answer | |
  • I have googled this myself, I found a bunch of links saying it does not affect it and bunch of links saying opposite. No clear answer so far... – Petr Apr 24 '13 at 9:26
  • btw when I google for it now, it mostly just link to this very question, no idea what you have found, but I fail to find any clear answer – Petr Apr 24 '13 at 9:28
  • @Petr That's not an independet measurement, of course, but the Novell docs say: "Performance is not affected noticeably by AppArmor." novell.com/documentation/opensuse103/opensuse103_reference/… – Hauke Laging Apr 24 '13 at 9:32
  • ok so is that worth of disabling or not? – Petr Apr 24 '13 at 9:43
  • It seems not to make sense to disable AppArmor for performance reasons. – Hauke Laging Apr 24 '13 at 9:45
1

Unless it says otherwise, probably should assume "no noticeable effect" assumes a 1.8 GHz+ CPU and about 512MB memory or more. One my machines is 800MHz, 512MB memory. The effect of every process is noticeable. Only you can judge if it's worth it.

| improve this answer | |
1

It depends on what your program does: how often does it access files, how often does it spawn new programs, how long does it run,... AppArmor is build using the [LSM]1 interface, which checks every system call. AppArmor may have an access cache to speed up recurring file accesses or subsequent requests to an already open file from the same process, but the most noticeable overhead is during the initialization (a program's profile has to be loaded, and some context initialization must take place). If you are in the mood for a somehow impractical judgement of worst cases, the following is a figure comparing AppArmor to DAC (the traditional permission model) during a study on some other LSM-based framework (CMCAP-Linux). The system was a Linux 4.4.6 booted on an Intel Core2 Duo E8400 running at 3GHz with 8GB of RAM. The micro-benchmark consisted of 10 averaged runs (in tight loops) of 10 million operations for the open+close test, and 10 thousands for the 2 others. No one spawns programs at such a high rate in real life, but you get my point. System call overhead: DAC vs. CMCAP-Linux vs. AppArmor

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.