CrackArmor

The article demonstrates how owLSM, an open-source Linux security agent with a stateful Sigma rules engine, can be used to detect and prevent exploitation of the CrackArmor vulnerability group. CrackArmor consists of nine vulnerabilities in Linux AppArmor that allow unprivileged local attackers to manipulate AppArmor profiles via SUID binaries, enabling local privilege escalation, denial of service, and access control bypass. The authors show a workflow of running owLSM in observability mode, triggering the exploit, identifying the relevant event, and writing a Sigma-style prevention rule that blocks non-root writes via SUID binaries to AppArmor control files.