Linux_security

Chapter 33: Linux Security - SELinux and AppArmor In-Depth

Overview

Linux Security Modules (LSM) provide mandatory access control (MAC) beyond traditional Unix permissions. SELinux and AppArmor are the two main implementations. This chapter covers both in depth with practical examples essential for production environments.

31.1 SELinux Fundamentals

What is SELinux?

                     SELinux Security Context
+------------------------------------------------------------------+
|                                                                   |
|   Security Context              Enforcement                       |
|   +----------+                                                    |
|   |   User   |                                                    |
|   +----+-----+                                                    |
|        |                                                          |
|        v                                                          |
|   +----------+                                                    |
|   |   Role   |                                                    |
|   +----+-----+                                                    |
|        |                                                          |
|        v                                                          |
|   +----------+         Process                                     |
|   |   Type   |-----------+                                        |
|   +----+-----+           |                                        |
|        |                 v          File                         |
|        v            +----------+     +-------+                    |
|   +----------+      | Process  |---->| File  |                   |
|   |  Level   |      +----------+     +-------+                   |
|   +----------+           |                                        |
|                          v          Socket                        |
|                    +----------+     +-------+                    |
|                    | Process  |---->|Socket |                   |
|                    +----------+     +-------+                    |
|                          |                                        |
|                          v          Directory                    |
|                    +----------+     +---------+                  |
|                    | Process  |---->|Directory|                  |
|                    +----------+     +---------+                  |
|                                                                   |
+------------------------------------------------------------------+

SELinux Concepts

# SELinux adds security context to:
# - Files
# - Processes
# - Ports
# - Users

# Security Context Format
# user:role:type:level

# Example contexts
unconfined_u:object_r:httpd_sys_content_t:s0
system_u:system_r:httpd_t:s0

31.2 SELinux Modes and States

Mode Types

# Three modes:
# 1. Enforcing - Enforces policy, denies access
# 2. Permissive - Logs violations but allows
# 3. Disabled - Completely off

# Check current mode
getenforce
sestatus

# Temporary change (resets on reboot)
sudo setenforce 1          # Enforcing
sudo setenforce 0          # Permissive

# Permanent change
# /etc/selinux/config
SELINUX=enforcing
# or
SELINUX=permissive
# or
SELINUX=disabled

31.3 SELinux Contexts

File Contexts

# View file context
ls -Z /var/www/html
ls -Z /etc/passwd

# View process context
ps auxZ | grep nginx

# View port context
semanage port -l

# View user context
id -Z

Context Components

# User (u)
# - SELinux user identity
# - system_u, unconfined_u, user_u

# Role (r)
# - system_r, object_r, unconfined_r

# Type (t)
# - Most important for enforcement
# - httpd_sys_content_t, httpd_t, etc.

# Level (s0, s0-s15)
# - MLS/MCS sensitivity levels

Changing Contexts

# Temporarily change file context
chcon -t httpd_sys_content_t /var/www/html/file.html

# Relabel from policy
restorecon -Rv /var/www/html

# Permanently change context
semanage fcontext -a -t httpd_sys_content_t "/webapp(/.*)?"
semanage fcontext -l | grep /webapp

# List all custom contexts
semanage fcontext -l

31.4 SELinux Booleans

Managing Booleans

# List all booleans
getsebool -a
semanage boolean -l

# List custom booleans
getsebool -a | grep httpd

# Enable boolean
setsebool -P httpd_enable_homedirs on
setsebool -P httpd_can_network_connect on

# Disable boolean
setsebool -P httpd_can_network_connect off

# Check boolean status
getsebool httpd_enable_homedirs

Common SELinux Booleans

# HTTP/Apache
httpd_enable_homedirs          # Allow httpd to access home dirs
httpd_can_network_connect      # Allow HTTP to connect to network
httpd_enable_cgi               # Enable CGI
httpd_use_nfs                  # Allow Apache to use NFS
httpd_use_cifs                 # Allow Apache to use CIFS

# FTP
ftp_home_dir                   # Allow FTP to access home dirs
allow_ftpd_full_access         # Allow FTP full access

# Samba
smbd_anon_write                # Allow SMB to write anonymously
samba_enable_home_dirs         # Enable Samba home directories

# NFS
nfs_export_all_ro              # NFS export read-only
nfs_export_all_rw              # NFS export read-write

# SSH
ssh_sysadm_login               # Allow sysadm users to SSH

31.5 SELinux Users

SELinux User Mapping

# Map Linux user to SELinux user
sudo semanage login -a -s user_u -r s0-s0:c0.c1023 username

# List login mappings
sudo semanage login -l

# Default login mappings
# __default__ user_u:s0-s0:c0.c1023
# root root:s0-s0:c0.c1023
# system_u system_u:s0-s0:c0.c1023

# Map Linux group
sudo semanage login -a -s staff_u:s0-s0:c0.c1023 -r s0-s0:c0.c1023 @groupname

31.6 SELinux Ports

Managing Ports

# List port contexts
semanage port -l

# Add port to type
sudo semanage port -a -t http_port_t -p tcp 8080

# Delete port
sudo semanage port -d -t http_port_t -p tcp 8080

# Modify existing
sudo semanage port -m -t http_port_t -p tcp 8080

# Example: Add custom port for nginx
sudo semanage port -a -t http_port_t -p tcp 8888

31.7 Troubleshooting SELinux

Common Issues and Solutions

# Issue: Apache can't read files
# Symptom: "Permission denied" in browser
# Solution:
sudo chcon -R -t httpd_sys_content_t /var/www/html/
sudo restorecon -Rv /var/www/html/

# Issue: Apache can't connect to database
# Symptom: Can't connect to MySQL
# Solution:
sudo setsebool -P httpd_can_network_connect_db 1

# Issue: Can't use non-standard port
# Symptom: Service won't start on port 81
# Solution:
sudo semanage port -a -t http_port_t -p tcp 81

# Issue: FTP can't access home directory
# Solution:
sudo setsebool -P ftp_home_dir 1

# Issue: SSH can't connect
# Solution:
sudo setsebool -P ssh_sysadm_login 1

Debugging SELinux

# Check for denials in logs
sudo tail -f /var/log/audit/audit.log | grep denied

# Use sealert for analysis
sudo sealert -a /var/log/audit/audit.log

# Set permissive for specific type
sudo semodule - permissive -a httpd_t

# Get detailed denial info
sudo ausearch -m AVC -ts recent

# Generate custom policy module
sudo audit2allow -w -a
sudo audit2allow -M mymodule -a
sudo semodule -i mymodule.pp

31.8 SELinux Policy Management

Modules

# List modules
semodule -l

# Install module
sudo semodule -i module.pp

# Remove module
sudo semodule -r module_name

# Enable/disable module
semodule -d module_name
semodule -e module_name

31.9 AppArmor

Introduction to AppArmor

# AppArmor is Debian/Ubuntu default
# Uses profile-based security

# Check status
sudo aa-status
sudo apparmor_status

# AppArmor modes
# enforce - Enforce the profile
# complain - Log violations but allow
# unconfined - No profile

31.10 AppArmor Profiles

Profile Structure

#include <tunables/global>

/usr/sbin/nginx {
    # Include abstractions
    # - Common program requirements
    # - File access patterns
    # - Network access
    #include <abstractions/apache2-common>
    #include <abstractions/base>
    #include <abstractions/nameservice>

    # Capability rules
    # - Linux capabilities
    capability net_bind_service,
    capability setuid,

    # File rules
    # Allow read access
    /etc/nginx/** r,
    /var/log/nginx/** rw,

    # Deny rules
    deny /etc/shadow r,

    # Network rules
    network inet stream,
    network inet dgram,

    # Run as
    # - May be run as specified user
}

Creating Custom Profile

# 1. Generate profile template
sudo aa-autodep nginx

# 2. Set to complain mode
sudo aa-complain nginx

# 3. Exercise the application
# Use the application normally

# 4. Review log for violations
sudo dmesg | grep apparmor
sudo tail -f /var/log/syslog | grep apparmor

# 5. Load changes to profile
sudo aa-logprof

# 6. Set to enforce mode
sudo aa-enforce nginx

31.11 AppArmor Commands

Managing Profiles

# List profiles
sudo aa-status --enabled

# Show profile details
sudo aa-status

# Enforce mode
sudo aa-enforce /etc/apparmor.d/profile.name
sudo aa-enforce *

# Complain mode
sudo aa-complain /etc/apparmor.d/profile.name
sudo aa-complain *

# Disable profile
sudo aa-disable /etc/apparmor.d/profile.name

# Reload all profiles
sudo systemctl reload apparmor

# Add profile
sudo apparmor_parser -r /etc/apparmor.d/profile.name

Profile Utilities

# Generate profile automatically
sudo aa-autodep program_name

# Learn from application use
sudo aa-logprof

# Merge changes
sudo aa-mergeprof

# Test profile syntax
sudo apparmor_parser -T /etc/apparmor.d/profile.name

31.12 AppArmor vs SELinux Comparison

                     SELinux vs AppArmor
+------------------------------------------------------------------+
|                                                                   |
|   SELinux                     AppArmor                           |
|   +----------+               +----------+                         |
|   | Complex  |               | Simpler  |                         |
|   +----------+               +----------+                         |
|   | Default  |               | Default  |                         |
|   | on RHEL |               | on Ubuntu|                         |
|   +----------+               | /Debian  |                         |
|   | MLS/MCS |               +----------+                         |
|   | support |               | Path-based|                         |
|   +----------+               +----------+                         |
|                                                                   |
|   Pros:                      Pros:                               |
|   +----------+               +----------+                         |
|   | More    |               | Easier   |                         |
|   | granular|               | to learn |                         |
|   | control |               +----------+                         |
|   +----------+               | Intuitive|                        |
|   | MLS/MCS |               | path-based                      |
|   | support |               +----------+                         |
|   +----------+                                                  |
|   |Enterprise|                                                  |
|   | distros |                                                  |
|   +----------+                                                  |
|                                                                   |
|   Cons:                      Cons:                               |
|   +----------+               +----------+                         |
|   | Steep   |               | Less    |                         |
|   | learning|               | granular |                         |
|   | curve   |               +----------+                         |
|   +----------+               | Limited  |                        |
|   | Complex |               | MLS     |                         |
|   | config  |               | support |                         |
|   +----------+               +----------+                         |
|                                                                   |
+------------------------------------------------------------------+

Comparison

# SELinux
# Pros:
# - More granular control
# - MLS/MCS support
# - Default on enterprise distros

# Cons:
# - Steep learning curve
# - Complex configuration
# - Can be overwhelming

# AppArmor
# Pros:
# - Easier to learn
# - Path-based (intuitive)
# - Good for desktop apps

# Cons:
# - Less granular than SELinux
# - Limited MLS support

31.13 Security Hardening Checklist

SELinux Hardening

# 1. Set to enforcing
SELINUX=enforcing

# 2. Use targeted policy
SELINUXTYPE=targeted

# 3. Don't disable booleans unnecessarily
# 4. Regular audits
sudo ausearch -m AVC -ts recent

# 5. Monitor denied operations
sudo sealert -a /var/log/audit/audit.log

AppArmor Hardening

# 1. Enable all enforce profiles
sudo aa-enforce /etc/apparmor.d/*

# 2. Create restrictive profiles
# 3. Regular profile updates
sudo aa-logprof

# 4. Monitor denials
sudo dmesg | grep apparmor

General Security

# 1. Keep system updated
sudo pacman -Syu

# 2. Firewall
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

# 3. Fail2ban
sudo systemctl enable --now fail2ban

# 4. Audit logging
sudo auditctl -w /etc/passwd -p wa -k passwd_modify
sudo auditctl -w /etc/shadow -p wa -k shadow_modify

Summary

In this chapter, you learned:

✅ SELinux fundamentals and concepts
✅ SELinux modes (Enforcing, Permissive, Disabled)
✅ Security contexts and types
✅ SELinux booleans and management
✅ SELinux user mapping
✅ Port management in SELinux
✅ Troubleshooting SELinux denials
✅ AppArmor profiles and structure
✅ Creating AppArmor profiles
✅ SELinux vs AppArmor comparison
✅ Security hardening best practices

Next Chapter

Chapter 32: Firewalls and Network Security

Last Updated: February 2026