SELinux and AppArmor

This chapter covers the following topics:

• SELinux configurations

• SELinux contexts

• AppArmor

This chapter covers the following objective:

• Objective 3.1: Given a scenario, apply or acquire the appropriate user and/or group permissions and ownership.

In Chapter 9, “File Permissions and Escalation,” you learned how users can protect their own files and directories by using permissions. Permissions are a very useful feature; however, they do have one major weak point: the user.

Users are often confused about permissions. A typical user might not understand the complexity of Linux permissions, particularly nuances such as write permission on a directory meaning that users can delete all the files in that directory.

There needs to be a way to protect users from themselves. Several available technologies enable an administrator to add another layer of protection on top of regular file and directory permissions. This chapter explores two of these technologies: SELinux and AppArmor.

“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz enables you to assess whether you should read this entire chapter or simply jump to the “Exam Preparation Tasks” section for review. If you are in doubt, read the entire chapter. Table 10-1 outlines the major headings in this chapter and the corresponding “Do I Know This Already?” quiz questions. You can find the answers in Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes and Review Questions.”

Table 10-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping

1. What is mandatory access control designed to secure?

   1. User accounts

   2. Files and directories

   3. Group accounts

   4. Network ports

2. Which of the following is a valid SELinux mode? (Choose all that apply.)

   1. Disabled

   2. Enforcing

   3. Permissive

   4. None of these are correct.

3. Which command is used to display security context on processes?

   1. show

   2. list

   3. ps

   4. ls

4. Which command is used to display security context on files?

   1. show

   2. list

   3. ps

   4. ls

5. Which of the following is considered a MAC security system?

   1. SecureMAC

   2. AppArmor

   3. Lockdown

   4. AppSecure

Do I Know This Already?

1. B

2. A, B, and C

3. C

4. D

5. B