In this lesson, you will learn how to leverage Linux Security Modules (LSM) to enforce Mandatory Access Control (MAC) over network resources at the kernel level.
Bridging Security and the Network Stack
Standard Linux permissions (like UID/GID) are excellent for files, but they are often too coarse for modern network environments. When a packet traverses the kernel stack, we need a way to ensure that specific processes can only interact with authorized network objects, such as specific ports, protocols, or interfaces, regardless of the user running the process.
LSMs—such as SELinux or AppArmor—hook directly into the kernel’s networking subsystem. Unlike standard firewalls that inspect packets based on headers, MAC policies enforce "who can do what" at the socket creation and data transfer stages.
Applying MAC to Network Sockets
When a process attempts to create a socket, the kernel triggers an LSM hook (like socket_create or socket_connect). If you are using SELinux, for instance, you define security contexts that restrict which labels can bind to specific ports.
Consider a scenario where you want to ensure your web server process can only communicate over port 80, even if the binary is compromised. You define a policy that maps the process context to allowed networking permissions:
# Example SELinux policy logic (pseudocode)
allow httpd_t http_port_t:tcp_socket { name_bind name_connect };
neverallow httpd_t port_range_low_t:tcp_socket { name_bind };
By enforcing these policies, the kernel blocks the socket operation before the packet is even constructed. If a malicious script attempts to bind to a non-standard port or initiate an unauthorized connection, the kernel denies the system call immediately.
This approach is superior to user-space firewalls because it operates at the kernel-level security boundary. Even if an attacker gains root privileges, they are still bound by the loaded MAC policy, which acts as a secondary, immutable layer of control deep within the network stack. By integrating these policies, you move security from being a "perimeter" concern to an inherent property of every network object created by the kernel.
Key Takeaway: Mandatory Access Control integrates with the kernel network stack to enforce socket-level permissions, preventing unauthorized processes from accessing network resources regardless of user-level privileges.