SELinux (full name Security Enhanced Linux) is a security module of the Linux kernel. It improves the security of Linux distributions by strengthening access control of files and processes. Another kernel security module with similar goals is AppArmor. Because the two overlap in Linux system access control functions, they have attracted much attention. This article will compare the differences between SELinux and AppArmor to help users choose security modules that are more suitable for their needs based on their functions and ease of use.

Table of contents

• What is SELinux?
• SELinux operations and common commands
• What is AppArmor?
• Comparison of ease of use between SELinux and AppArmor
• FAQ

Recommended reading: 5 most secure Linux-Libre distributions

What is SELinux?

Protect servers with SELinux, get rid of the traditional DAC (autonomous access control) mode based on actual system users and roles. It introduces three element context mechanisms for each process or system user: username , role , and domain , thus enabling more granular system access control.

In SELinux, processes can enter a specific domain only if explicitly allowed by policy configuration. The only exception is to use the runcon command to start the process into the specified context. However, if a conflicting policy exists, SELinux will still reject such context switches. This reflects the security principle of SELinux's "default denial" - any user or process must be explicitly authorized in advance to access files or system resources.

SELinux operations and common commands

As an extension of commonly used commands at the terminal, SELinux provides the -Z parameter to display the security context of files and processes. Commands such as ps and ls can be combined with this parameter to quickly debug or identify configuration errors. The following screenshot shows the use of the ls command:

 <code>ls -Z</code> 

The first part of each line output is the domain, the second part is the object type, and the third part is the username in the SELinux configuration. This approach allows SELinux to accurately control access to each file and process. The following commands can be used to modify the context of files and directories:

Since the context shown in the screenshot is already recursively defined in the "/srv/web" directory, SELinux prompts the user. If undefined, a successful semanage operation usually does not output any information.

System administrators can enable, disable, or set SELinux to tolerant mode through the setenforce command. To view the current execution status, use the getenforce command, as shown in the following figure:

Recommended Reading: How to Securely Transfer Files in Linux using SCP

What is AppArmor?

AppArmor was developed by Canonical, which is also behind the Ubuntu Linux distribution. AppArmor is designed to be more concise and easy to use than SELinux, and its configuration files are stored in the "/etc/apparmor.d/" directory. The following figure shows an AppArmor configuration file for the "/usr/bin/man" process:

Operations and common commands of AppArmor

To view the current status of AppArmor, you can use the aa-status command. The example output is as follows:

The configuration file of AppArmor can be listed by viewing the contents of the "/etc/apparmor.d/" directory, as shown in the following figure:

From the above configuration file list, if the user wants to disable the usr.bin.man configuration file, run the following command:

 <code>sudo aa-complain /usr/bin/man</code>

Note: The disabled configuration file will be moved to the disable subdirectory in the home directory. To re-enable the disabled configuration file, you can execute:

 <code>sudo aa-enforce /usr/bin/man</code>

Comparison of ease of use between SELinux and AppArmor

AppArmor is controlled based on file system paths, while SELinux appends string tags to each file. The advantage of AppArmor is that the configuration of file operations such as reading, writing, and locking is more intuitive and simple. In contrast, although SELinux is more powerful in file access control, its implementation level is deeper and involves the underlying layer of the system.

Therefore, users need to master system operations such as mknod and network sockets to be proficient in using SELinux. AppArmor is obviously easier to get started for non-system administrators.

In addition, AppArmor provides a "learning mode" that can record access violations without blocking access, and assist in generating new configuration files by collecting program behavior data for a long time. SELinux currently does not have similar functional modes.

Recommended Reading: How to Harden Your Linux Home Server

FAQ

Which Linux distributions are pre-installed with SELinux or AppArmor?

All RedHat system distributions are pre-installed or support SELinux configurations, including RHEL, CentOS, and Fedora. AppArmor is pre-installed in Debian, Ubuntu and its derivatives, as well as distributions such as SUSE Enterprise Server and OpenSUSE.

Which security module is more suitable for Linux beginners?

Most mainstream Linux distributions have one of the security modules installed by default, so novices usually don't need to configure it manually. From the perspective of functions and ease of use, if the user is an advanced user or system administrator and pursues more refined system control, SELinux is more suitable; and for ordinary users, AppArmor is a better choice.

Can SELinux and AppArmor replace security tools such as firewalls and antivirus software?

SELinux and AppArmor cannot replace antivirus software or well-configured firewalls to ensure system security and data integrity. It is recommended that security measures such as antivirus software are still needed to provide more comprehensive protection.

Image source: AppArmor official Wiki and SELinux official Wiki. All screenshots are courtesy of Zeeman Memon.

The above is the detailed content of SELinux vs AppArmor: Which One Should You Use? - Make Tech Easier. For more information, please follow other related articles on the PHP Chinese website!