Managing Host-Based Firewalls with MAC

Integrate host firewall rules with MAC policies to create a cohesive security boundary.

In this lesson, you will learn how to create a multi-layered security boundary by coupling host-based firewall rules with Mandatory Access Control (MAC) policies to restrict both network reachability and process behavior.

The Strategy of Defense-in-Depth

Managing a host-based firewall (like nftables or iptables) is only half the battle. While a firewall prevents unauthorized external traffic from reaching your services, MAC systems like SELinux or AppArmor prevent compromised services from performing unauthorized internal actions. By integrating these, you ensure that if an attacker manages to bypass a network rule, the process they interact with remains constrained by a MAC profile that limits its ability to manipulate system files or execute sensitive syscalls.

Cohesive Enforcement

To create a cohesive boundary, the MAC policy should explicitly allow the network daemon to bind to specific ports, while the firewall restricts the source IPs that can communicate with those ports.

For instance, consider a web server process. You configure the firewall to accept only traffic on port 80/443. Simultaneously, you write a MAC policy (e.g., in AppArmor) that prevents the web server process from reading /etc/shadow or executing shell binaries:

# /etc/apparmor.d/usr.sbin.nginx
profile nginx /usr/sbin/nginx {
  # Network access is implied by binding capability
  capability net_bind_service,
  
  # Restriction: Prevent access to sensitive directories
  deny /etc/shadow r,
  deny /bin/** x,
  
  # Allow only web content
  /var/www/html/** r,
}

By pairing this with a firewall rule that restricts traffic to your application's public-facing interfaces, you create a "jail." The firewall acts as the perimeter fence, and the MAC policy acts as the secure room the process is confined to. Even if the firewall is misconfigured or bypassed, the MAC layer prevents the application from pivoting deeper into the system, effectively neutralizing the threat. This integration ensures that your host security isn't just a single barrier, but a complex, multi-dimensional restriction that an attacker must break at every level to succeed.

Key Takeaway: Integrating MAC with your firewall provides a dual-layer defense where the firewall controls communication flow and MAC policies restrict the internal capabilities of the processes participating in that flow.