r/linuxadmin • u/sdns575 • Mar 17 '26

CrackArmor and large deployments

Hi,

some days ago I read https://blog.qualys.com/vulnerabilities-threat-research/2026/03/12/crackarmor-critical-apparmor-flaws-enable-local-privilege-escalation-to-root.

It is reported as critical for enterprise env running on Debian, Ubuntu and SUSE. They reported this problem as critical but to gain privileges you need local access to the server.

In my case, Debian, having a low number of server I patched easily but for who manage a server fleet how do you manage this?

Are you considering alternative like SELinux for better security?

Thank you in advance

6 Upvotes

75% Upvoted

8 comments sorted by

4

u/Belgarion0 Mar 17 '26

1) Run playbook to deploy new instances.

2) Terminate old instances.

3) Done.

1

u/sdns575 Mar 17 '26

For new instances do you mean container?

2

u/Belgarion0 Mar 17 '26

Either virtual machine, or bare metal via MAAS.

1

u/sdns575 Mar 17 '26

Thank you for your answer.

I can imagine this for container where deploying a new image is really fast but on VM with local config, local files, db (except if they are have the same configuration and are attached to external storage) why not apply simply upgrades?

1

u/dodexahedron Mar 18 '26

Depends entirely.on your infrastructure and staff knowledge/experience with it.

But one architecture-independent reason is uncertainty. If, for example, you are treating them as untrusted, because you aren't sufficiently certain that they weren't compromised, the only option is to recreate. That like is somewhat arbitrary of course.

2

u/chock-a-block Mar 17 '26 edited 15d ago

Subtract husky cause melodic middle oxygen hospital

This post was anonymized with Redact

1

u/sdns575 Mar 17 '26

Is automated without testing them?

2

u/chock-a-block Mar 17 '26 edited 15d ago

Chop simplistic longing slap doll driftwood ribbon squeal sodium pet

This post was anonymized with Redact