In this lesson, you will learn how to perform black-box penetration testing to verify that your Mandatory Access Control (MAC) policies are truly enforcing the security boundaries you designed.
The Principle of Black-Box Verification
While inspecting policy files (white-box auditing) is essential, it assumes the policy implementation perfectly matches your security model. Black-box penetration testing shifts the focus to the observable behavior of the system. In this approach, you act as an attacker who has no knowledge of your SELinux or AppArmor rule logic. Instead, you attempt to force the system into unauthorized states to see if the kernel-level enforcer stops you.
Executing a Practical Test
To perform black-box testing, you must simulate "unprivileged actor" scenarios. Suppose you have a web server process that should be strictly contained. Your audit isn't about reading the profile; it’s about attempting actions that should fail.
Consider testing for unauthorized file access by attempting to read sensitive system files from a process context that should not have permission:
# Attempt to read /etc/shadow from the context of an unprivileged service
# This is a black-box test to ensure the policy enforces boundaries
sudo -u web_user cat /etc/shadow > /dev/null 2> /tmp/audit_test.log
# Verify the result
if [ $? -ne 0 ]; then
echo "Access denied: Policy boundary verified."
else
echo "CRITICAL: Policy bypass detected!"
fi
Analyzing the Results
The goal of this audit is to confirm that the denied result is not just a standard Unix permission error, but a result of your MAC enforcement. You should examine your MAC audit logs (like /var/log/audit/audit.log for SELinux) immediately following your test. If your command failed but no corresponding "denied" message appears in the audit log, your service might be failing due to standard file permissions, not your security policy.
Black-box testing forces you to confront the reality that security layers are only effective if they actively block the actions they were designed to prevent. By consistently attempting to traverse forbidden directories or execute restricted binaries from restricted processes, you ensure that your security model is not just a paper document, but an active barrier.
Key Takeaway: Effective security auditing requires verifying that your policies actively block unauthorized actions, ensuring that theoretical security boundaries function correctly in practice.