In this lesson, you will learn how to refine Mandatory Access Control (MAC) policies to ensure they remain effective and performant when deployed on systems with a read-only root file system.
The Immutable Paradigm and Security
In an immutable infrastructure model, the operating system's root file system is mounted as read-only. This eliminates entire classes of persistence-based attacks, such as modifying system binaries or injecting malicious shared libraries. However, when using MAC systems like SELinux or AppArmor, an immutable file system introduces a unique challenge: the "security policy vs. file system state" mismatch.
If your policy expects to write logs, audit trails, or transient state files to restricted directories that are now physically read-only, your application will trigger constant policy denials and potentially crash.
Optimizing Policies for Read-Only Roots
When architecting security policies for these environments, you must pivot from "blocking unauthorized changes" to "strictly defining allowed ephemeral activity." Since the base system cannot change, your MAC policy should focus heavily on the boundary between the read-only binaries and the writeable volumes (typically tmpfs or dedicated data partitions).
Consider an AppArmor profile for a service running on a read-only root:
# Example: Service profile for immutable environment
profile web-service /usr/bin/web-app {
# Read-only access to system binaries
/usr/bin/web-app r,
/lib/** mr,
# Deny all write access to the root filesystem
deny /** w,
# Permit specific writes only to a mounted tmpfs/data volume
/var/lib/web-app/data/ rw,
/var/lib/web-app/data/** rw,
# Allow transient logs to a volatile directory
/run/web-app/logs/ w,
}
Strategic Policy Hardening
To optimize, you must move all writeable requirements into specific, high-privilege mount points. Ensure your MAC policy utilizes "deny-by-default" for the entire root path, explicitly allowing only the necessary application-specific subdirectories.
By offloading all mutable states (logs, cache, sockets) to separate tmpfs mounts, you simplify your audit requirements. You no longer need to monitor /etc or /usr for unauthorized writes—your security policy simply enforces that those paths are strictly read-only, while your MAC framework polices the remaining volatile paths.
Key Takeaway: In immutable infrastructure, your MAC policy should act as a strict gatekeeper that enforces a total write-prohibition on the root file system while isolating all permitted mutable operations to dedicated volatile mounts.