AppArmor bug bounty programs

AppArmor programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
AP AppArmor Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• AP

  AppArmor

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://apparmor.net

  Web

• AppArmor publishes three private intake channels and asks that none of them be public: a GitLab issue marked confidential, which is the preferred route, a Launchpad bug set to Private Security, or the security address that forwards to the team rather than to a public list. No part of the userspace tree is carved out

  Products and areas

• Mediation rules as the userspace expresses them, covering mount, pivot_root, unix socket, network, ptrace, signal and dbus

  Products and areas

• Profile abstractions and the include mechanism, along with the abstractions shipped by the project

  Products and areas

• Profile transitions in full: exec transitions, hats, profile stacking and the fallbacks to unconfined

  Products and areas

• The compiled policy cache, its invalidation logic and the files written under the cache directory

  Products and areas

• The D-Bus mediation path and the bus name, path and interface matching behind it

  Products and areas

• The libapparmor library, including its log parsing and its change_hat and change_profile interfaces

  Products and areas

• The policy compiler (apparmor_parser) end to end, from profile text through to the policy loaded into the kernel

  Products and areas

• The profile generation paths that snapd, LXD and container tooling build on top of

  Products and areas

• The profile language itself: variables, globbing, path rules, aliases, rule precedence and the deny semantics

  Products and areas

• The profiles shipped by the project for common daemons

  Products and areas

• The utilities: aa-genprof, aa-logprof, aa-complain, aa-enforce and aa-status, plus the Python and Perl code behind them

  Products and areas

No target matches. Try part of a host name, such as the company name.