Host security

A permission on a file and a permission on a process are different things. The standard permissions from Part II answer "who owns this and what may they do". Mandatory access control (MAC) adds a second layer: even root is bound by rules it cannot silently step around. On RHEL, Fedora, and CentOS that is SELinux; on Ubuntu and SUSE it is AppArmor.

This chapter is about narrowing privileges down to the minimum that the job needs, seeing who reached for what, and closing the obvious doors: stray sudo rights, unpatched packages, ssh open to passwords.

SELinux: contexts and modes

SELinux attaches a context to every file, process, and port, a label of the form user:role:type:level. The allow-or-deny decision turns on the type, not the UID. Ch