SELinux and AppArmor Differences and Terminology

SELinux is an additional layer of security that works over the traditional security solutions. The conventional security solution includes file and directory permissions, user and group-level permissions, shadow password and password aging mechanisms, and access control lists.

SELinux handles access requests that pass through traditional security solutions. Since it only processes the access requests that come through the existing security methods, it cannot allow the request if it is already blocked or filtered by an existing solution. It enhances existing security solutions, not to replace them.

DAC and MAC

Linux uses a DAC (Discretionary Access Control) method for restricting access. In this approach, users determine permissions for the objects they own. They have complete discretion over the objects they own. Every Linux system has at least one administrative account. A network system can have multiple administrative accounts. If hackers gain access to an administrative account, they will gain complete control over the service managed by that account. Access to the root account grants them unrestricted access to the system and network services.

The United States National Security Agency (NSA) developed the Mandatory Access Control (MAC) structure to mitigate this threat on Linux systems. Unlike DAC, which works in an all-or-nothing mode, it compartmentalizes services and administrative tasks and separately controls what can and cannot be done with policies. It grants access when specific security conditions match, not just when one is an authenticated user. It gives only the necessary access to the applications, processes, files, and devices, nothing more. It protects other services if one service is compromised. For example, if a hacker hacks a web server running on a MAC-implemented system, he can only modify or view files related to the web server. He cannot access the files associated with other processes, such as NFS, SSH, etc.

NSA developed MAC as a Linux Security Module (LSM). It is an essential but optional security module. Linux distributions are free to implement. They are also free to customize it based on their specific requirements.

SELinux and AppArmor

SELinux and AppArmor are two popular implementations of MAC. SELinux is a Red Hat implementation of MAC. Debian-based Linux distributors implement it as AppArmor.

Differences between SELinux and AppArmor

The following table compares SELinux and AppArmor and lists their differences.

SELinux Terminology

SELinux is complicated. It uses numerous terms to define its core components and features. This section describes essential SELinux terms and their functions.

Subject

A subject is a user or process that accesses an object. If a user accesses a file, the user is the subject, and the file is the object. If a process accesses a device, the process is the subject, and the device is the object.

Object

An object is the resource accessed by the subject. Examples of objects are files, directories, devices, ports, network interfaces, pipes, sockets, and processes.

Access

An access is the action the subject performs on an object. Examples of access are creating, reading, updating, copying, moving, and deleting files and directories.

Policy

A policy is a set of rules that govern, analyze, monitor, and implement the security attributes assigned to subjects and objects system-wide. It decides whether to permit a subject's access attempt to an object. The default behavior is to deny the access request.

Targeted

Targeted is the default policy. It categorizes processes into two types: targeted and reset. Targeted processes run in the confined domain. The remaining processes run in an unconfined domain. A targeted process can access only the resources defined in the confined domain. It cannot access anything outside the confined domain. The httpd process is an example of a targeted process. In an unconfined domain, SELinux does not stop the user from accessing any allowed resources. By default, it runs all logged-in users in an unconfined domain. A process running in the unconfined domain is more vulnerable than one running in a confined domain.

Multi-Level Security (MLS)

It adds a security level value to resources. Only users having access to particular levels can access the corresponding files and applications.

Multi-Category Security (MCS)

It extends the configuration of SELinux rules to users. Users can set categories to restrict and control access to their files and applications. Only administrators can create categories. Regular users can only select a category for a file.

Context

A context is also called a label or tag. It stores security attributes for subjects and objects. It includes a SELinux user, role, domain, and sensitivity level. SELinux uses this information to allow or deny access requests.

Labeling

Labeling is a process that maps files with their contexts. It is also called a transition. It works differently on different object types. SELinux assigns contexts to files and directories when you create them. It determines the context of a process when you run the process.

User

SELinux includes many predefined user accounts authorized for specific roles. These user accounts are different from traditional local user accounts. You cannot use them to log in or for any other purpose. These user accounts are technically user identities. SELinux uses them to control what roles and levels a process can enter or execute. It assigns identities to all local user accounts and uses them to restrict their actions. For example, a local user account cannot run the su and sudo commands or programs in their home directory if you map it to the SELinux user_u.

SELinux allows you to update default identities. You can set up a separate corresponding identity for each user or a general identity for all regular users. Typically, administrators use a general identity for all regular users and an administrative identity for administrator accounts. It allows them to configure user-level access.

Domains

Domains define areas for processes. They place restrictions on what processes can do and what they can access. SELinux assigns a domain to each process. A process runs within the domain. It cannot access resources outside the domain. Examples of domains include init_t for the systemd process, firewalld_t for the firewalld process, and unconfined_t for all processes that SELinux does not control.

Types

Types do the same thing for objects (such as files and directories) that domains do for processes. SELinux groups files and directories with similar security requirements into types and uses them to limit their access. Examples of types are the user_home_dir_t for objects in user home directories and usr_t for objects in the /usr directory.

Role

A role classifies who (subject) can access what (object, domain, or type). SELinux assigns a role to each subject to ensure that the system and user processes remain separated. A subject can enter a new role to access other domains and types. Users with the assigned role can access the types and domains assigned to that role. For example, regular users can access user_t type objects but not sysadm_t objects. Examples of roles are user_r for ordinary users, sysadm_r for administrators and system_r for processes.

Conclusion

This tutorial introduced SELinux and explained its fundamentals and terminology. Understanding these basic concepts and terms helps you learn SELinux more effectively and timely.