In this lesson, you will learn how to distinguish the design philosophies of SELinux, AppArmor, and Smack to decide which approach best fits your security needs.
Linux Security Modules (LSM) act as a gatekeeper within the kernel, intercepting system calls before they are executed. While they all serve the same purpose—enforcing Mandatory Access Control (MAC)—they do so through fundamentally different design philosophies.
SELinux: The Policy-Driven Framework
SELinux (Security-Enhanced Linux) uses Label-Based Access Control. Every process, file, and network object is assigned a security context (a label). The policy defines how these labels interact. It is incredibly granular and powerful, but complex to manage because it requires "labeling" everything in the system. It is designed for environments where strict security boundaries are mandatory.
AppArmor: The Path-Based Framework
AppArmor takes a Path-Based approach. Instead of labeling files, it enforces rules based on file paths (e.g., /usr/bin/nginx). If you move a file, the profile might break, but it is much easier to read and configure for human administrators. You might see a profile look like this:
/usr/bin/nginx {
/etc/nginx/** r,
/var/log/nginx/* w,
network inet stream,
}
Because it is path-based, it is often favored for desktop environments or specific service hardening where you know exactly which files a binary needs to touch.
Smack: The Simplicity-First Framework
Smack (Simplified Mandatory Access Control Kernel) is designed for extreme efficiency and ease of use. It uses a very small set of rules based on "labels" but simplifies the logic down to a handful of states like read, write, execute, and append. It is most often found in embedded systems (like Tizen or automotive Linux) where memory is tight and you need a high-security posture without the administrative overhead of a massive SELinux policy.
Comparison Summary
- SELinux: Best for enterprise-grade, high-assurance security where you need to track object interaction regardless of location.
- AppArmor: Best for ease of administration, focusing on what specific applications are allowed to touch on the filesystem.
- Smack: Best for performance-sensitive embedded environments where simplicity is prioritized.
Key Takeaway: While all LSMs enforce Mandatory Access Control, SELinux prioritizes granular labeling, AppArmor focuses on intuitive path-based rules, and Smack emphasizes structural simplicity for constrained environments.