Introduction to AppArmor and SELinux on Linux

As cybersecurity threats grow more sophisticated, ensuring the security of your Linux system is critical. Among the arsenal of tools available for enhancing Linux security, AppArmor and SELinux are two of the most powerful. These Mandatory Access Control (MAC) systems provide an additional layer of protection by restricting how applications can interact with the system. In this guide, we will explore AppArmor and SELinux, understand their differences, and provide a comprehensive technical tutorial on how to implement and manage them on your Linux systems.

Understanding AppArmor

AppArmor (Application Armor) is a security module for the Linux kernel that allows the system administrator to restrict the capabilities of individual programs. AppArmor uses security profiles to determine what resources applications can access, thus limiting potential damage from malicious code.

How AppArmor Works

AppArmor works by associating each program with a security profile that specifies its permissions. These profiles can define what files an application can read, write, or execute. AppArmor operates in two modes:

• Enforce mode: In this mode, AppArmor enforces the policies defined in the profiles and blocks any unauthorized access.
• Complain mode: In this mode, AppArmor logs policy violations but does not enforce them, allowing administrators to test profiles before fully implementing them.

AppArmor Profiles

AppArmor profiles are plain text files that define the access rights for applications. These profiles can be set to allow or deny specific actions on files, directories, or even system resources like network access.

Example of an AppArmor Profile

#include <tunables/global>
/usr/sbin/apache2 {
  #include <abstractions/base>
  /var/www/html/** r,
  /etc/apache2/** r,
  /usr/sbin/apache2 mr,
  capability net_bind_service,
  network inet tcp,
}

In the above profile, Apache is granted read access to /var/www/html/, /etc/apache2/, and memory-read (mr) access to its binary. Additionally, it is allowed to bind to a network service via the capability net_bind_service and interact with the TCP network stack.

Getting Started with AppArmor on Linux

Installing AppArmor

AppArmor is available on most Linux distributions, but it may need to be installed and enabled. On Ubuntu, for example, it’s usually installed by default. However, if you need to install it, you can do so with the following commands:

$ sudo apt-get update
$ sudo apt-get install apparmor apparmor-utils

Enabling and Disabling AppArmor

To check if AppArmor is enabled, use:

$ sudo aa-status

To enable AppArmor, you can modify the GRUB configuration. Edit /etc/default/grub and add apparmor=1 security=apparmor to the GRUB_CMDLINE_LINUX_DEFAULT line:

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash apparmor=1 security=apparmor"

Then update GRUB:

$ sudo update-grub
$ sudo reboot

To disable AppArmor, simply remove or comment out the apparmor=1 security=apparmor line from the GRUB configuration and reboot.

Managing AppArmor Profiles

AppArmor profiles are stored in /etc/apparmor.d/. You can create, modify, or delete profiles based on your requirements.

Creating a New AppArmor Profile

To create a new profile, you can use the aa-genprof tool. For example, to create a profile for the /usr/bin/evince application:

$ sudo aa-genprof /usr/bin/evince

Follow the on-screen instructions to specify permissions as the application runs.

Setting a Profile to Enforce Mode

Once a profile is created, you can set it to enforce mode:

$ sudo aa-enforce /etc/apparmor.d/usr.bin.evince

This command ensures that the profile is actively enforcing its rules.

Setting a Profile to Complain Mode

If you prefer to test a profile before enforcement:

$ sudo aa-complain /etc/apparmor.d/usr.bin.evince

In this mode, AppArmor will log any violations without enforcing the restrictions.

Understanding SELinux

Security-Enhanced Linux (SELinux) is another MAC framework that controls access to files, processes, and network resources based on security policies. Originally developed by the NSA, SELinux is known for its fine-grained security control, making it suitable for highly sensitive environments.

How SELinux Works

SELinux operates by labeling files, processes, and other system resources with a context. Policies then define what actions are allowed based on these contexts. SELinux can operate in three different modes:

• Enforcing mode: SELinux enforces its security policies, denying access where policies do not explicitly allow it.
• Permissive mode: SELinux logs policy violations without enforcing them, which is useful for troubleshooting.
• Disabled mode: SELinux is turned off entirely.

SELinux Policies

SELinux policies are comprehensive rulesets that define the access permissions for all subjects and objects in the system. Policies are usually divided into two categories:

• Targeted policies: These apply to specific processes, while the rest of the system operates with DAC (Discretionary Access Control).
• MLS (Multi-Level Security) policies: These provide strict security enforcement for all processes and are used in environments requiring high security, like government systems.

Example of an SELinux Policy

allow httpd_t httpd_sys_content_t:file { read open getattr };

In this policy snippet, the httpd_t domain (typically associated with the Apache server) is allowed to read, open, and get attributes of files labeled with the httpd_sys_content_t type.

Getting Started with SELinux on Linux

Installing SELinux

On most distributions like CentOS, RHEL, and Fedora, SELinux is installed and enabled by default. For Debian-based systems like Ubuntu, it can be installed as follows:

$ sudo apt-get install selinux-basics selinux-policy-default auditd
$ sudo selinux-activate
$ sudo reboot

Configuring SELinux Modes

You can check the current mode of SELinux using the sestatus command:

$ sestatus

To change the mode of SELinux, edit the /etc/selinux/config file:

SELINUX=enforcing

The available options are:

• enforcing: Enforces the SELinux policy.
• permissive: SELinux logs actions but does not enforce the policy.
• disabled: SELinux is turned off.

After making changes, reboot the system for them to take effect.

$ sudo reboot

Managing SELinux Policies

SELinux policies are stored in /etc/selinux/ and can be managed using various tools like semanage, setsebool, and audit2allow.

Creating a New SELinux Policy Module

To create a custom policy module, follow these steps:

1. Write a Type Enforcement (TE) file:

module mymodule 1.0;
require {
  type httpd_t;
  type myapp_exec_t;
}
allow httpd_t myapp_exec_t:file execute;

2. Compile the TE file:

$ checkmodule -M -m -o mymodule.mod mymodule.te
$ semodule_package -o mymodule.pp -m mymodule.mod

3. Install the policy module:

$ sudo semodule -i mymodule.pp

This will load the custom policy into the active SELinux policy.

Managing SELinux Booleans

SELinux Booleans allow you to toggle specific policies on and off. You can list all available Booleans with:

$ sudo getsebool -a

To change a Boolean value, use the setsebool command:

$ sudo setsebool httpd_can_network_connect on

To make this change permanent, add the -P option:

$ sudo setsebool -P httpd_can_network_connect on

AppArmor vs. SELinux: Key Differences

While both AppArmor and SELinux provide MAC security, they have significant differences that affect their use cases and management.

Profile-Based vs. Label-Based

AppArmor uses profile-based controls, where individual profiles are created for each application. These profiles define what resources the application can access. SELinux, on the other hand, is label-based, where every file, process, and resource is labeled with a security context. Policies are then applied based on these labels.

Ease of Use

AppArmor is often considered easier to use due to its straightforward profile system, which requires less in-depth knowledge to create and manage. SELinux, while more powerful, has a steeper learning curve due to its complex policy and labeling system.

Default Availability

AppArmor is the default

MAC system on Ubuntu and some other Debian-based distributions. SELinux is the default on Red Hat-based distributions like CentOS, Fedora, and RHEL.

Granularity of Control

SELinux offers finer-grained control compared to AppArmor. This makes it suitable for environments where security is of utmost importance, such as government or enterprise systems. AppArmor, while effective, does not offer the same level of detailed control.

Use Cases for AppArmor and SELinux

The choice between AppArmor and SELinux often depends on the specific requirements of your environment.

When to Use AppArmor

• Lightweight Security: If you need a straightforward, easy-to-manage security tool, AppArmor is a good choice. It provides effective control with minimal configuration.
• Ubuntu or Debian Environments: Since AppArmor is the default on these systems, it’s easier to implement and manage.

When to Use SELinux

• High-Security Environments: For environments requiring strict security controls, SELinux is ideal due to its detailed policy management.
• Red Hat-Based Systems: SELinux is deeply integrated into these systems, making it the natural choice.

Advanced Configuration and Tuning

Both AppArmor and SELinux can be fine-tuned to meet specific security requirements. This section will cover advanced configuration techniques for both tools.

Advanced AppArmor Configuration

Using AppArmor with Containers

AppArmor can be particularly useful in securing containerized environments. For example, you can assign specific profiles to Docker containers to restrict their capabilities.

$ docker run --rm -it --security-opt apparmor=docker-default ubuntu

This command runs a Docker container with the docker-default AppArmor profile, restricting the container’s access to the host system.

Debugging AppArmor

To debug AppArmor profiles, you can use the aa-logprof tool, which helps in analyzing logs and updating profiles:

$ sudo aa-logprof

This tool will parse the logs and suggest updates to existing profiles based on the logged events.

Advanced SELinux Configuration

Customizing SELinux Labels

Custom labels can be created and applied to files or processes to enforce specific policies. For example, to create a custom label:

$ sudo semanage fcontext -a -t my_custom_t "/custom/path(/.*)?"
$ sudo restorecon -Rv /custom/path

Here, the semanage command defines a custom file context for the specified path, and restorecon applies the new label.

SELinux in Virtualized Environments

SELinux can be particularly beneficial in virtualized environments where security isolation is critical. For instance, you can apply specific SELinux policies to virtual machines to control their access to host resources.

$ sudo virsh setsebool virt_use_execmem on

This command enables the virt_use_execmem Boolean, allowing virtual machines to execute in-memory code, which is essential for certain workloads.

Troubleshooting and Common Issues

Both AppArmor and SELinux come with their set of challenges. This section will address common issues and how to resolve them.

Common Issues with AppArmor

• Profile Conflicts: If an application is not working as expected, it may be due to restrictive AppArmor profiles. Switching the profile to complain mode can help identify the issue.

$ sudo aa-complain /etc/apparmor.d/usr.sbin.mysqld

• Log Analysis: Analyzing /var/log/syslog for AppArmor messages can provide insights into what is being blocked.

Common Issues with SELinux

• Policy Violations: SELinux logs policy violations in /var/log/audit/audit.log. You can use audit2why to understand the reason behind the denial:

$ sudo cat /var/log/audit/audit.log | audit2why

• Permissive Mode: If you’re encountering frequent denials, switching SELinux to permissive mode can help diagnose issues without blocking operations.

$ sudo setenforce 0

FAQs

What is the difference between AppArmor and SELinux?
AppArmor uses a profile-based approach to define security policies for applications, while SELinux uses a label-based system to enforce policies across the entire system.

Is AppArmor easier to use than SELinux?
Yes, AppArmor is generally considered easier to use because it requires less in-depth knowledge to create and manage profiles compared to SELinux’s more complex policy system.

Can I run both AppArmor and SELinux on the same system?
While it’s technically possible to have both installed, it’s not recommended to run both simultaneously as they can conflict with each other. Most systems use one or the other.

How do I switch between enforcing and permissive modes in SELinux?
You can switch modes using the setenforce command. Use setenforce 1 for enforcing mode and setenforce 0 for permissive mode.

Is it necessary to reboot the system after installing SELinux?
Yes, after installing and activating SELinux, a reboot is necessary to apply the security contexts to the system files.

Can AppArmor be used to secure Docker containers?
Yes, AppArmor can secure Docker containers by applying specific profiles that restrict the container’s capabilities.

Conclusion

AppArmor and SELinux are powerful tools in the Linux security toolkit, each offering unique advantages. AppArmor provides a more user-friendly approach with its profile-based system, making it ideal for less complex environments. SELinux, with its fine-grained control and comprehensive policy enforcement, is suited for high-security environments where stringent access controls are necessary. By understanding and properly configuring these tools, you can significantly enhance the security of your Linux systems.