SELinux and AppArmor in Linux: mandatory access control

SELinux and AppArmor are an extra layer of protection: they limit what a process is allowed to do, on top of the usual rwx permissions.

Common cases

getenforce                 # SELinux mode: Enforcing or Permissive
sestatus                   # detailed SELinux status
sudo setenforce 0          # switch to Permissive for now
ls -Z file                 # a file's SELinux label
aa-status                  # AppArmor profile status (Ubuntu)

How it works: mandatory control on top of the usual

The usual rwx permissions are 'discretionary' control: the file's owner decides who may do what, and root may do anything. SELinux and AppArmor add 'mandatory' control: an administrator sets the rules through a policy, and even a root process cannot step outside its profile. The point is to contain a compromised service: even after taking over a web server, an attacker cannot read what the profile does not allow. SELinux (RHEL, Fedora) labels everything, while AppArmor (Ubuntu, SUSE) ties rules to paths. If something is oddly denied with correct permissions, check whether the policy is blocking it.

In the book

This topic is covered in full in the chapter Deep security.

See also

File permissions: chmod, The sudo command.