Mitigating New Vulnerabilities with owLSM

This blog-style technical post demonstrates exploiting the CrackArmor AppArmor vulnerabilities to allow an unprivileged user to remove AppArmor profiles and shows how the open-source owLSM agent can detect the relevant write events and immediately prevent exploitation by applying a Sigma-like rule that blocks non-root writes to /sys/kernel/security/apparmor and kills the SUID process; the article includes an example event JSON, the rule text, and guidance on using owLSM as an interim mitigation when patches are not yet available.