In this lesson, you will learn how AppArmor uses mandatory access control to restrict what a process can do based on its security label.
Understanding Process Labeling
While tools like seccomp limit the system calls a process can make, AppArmor acts as a "path-based" security layer. It assigns a security profile (a label) to a specific program. When you execute an application, the kernel checks the process’s current label and enforces a set of rules defining exactly which files it can read, write, or execute, and which network resources it can access.
Unlike traditional Linux permissions (which are based on User IDs), AppArmor is Mandatory Access Control (MAC). This means the policy is enforced by the kernel regardless of what the user (even root!) wants the process to do. If a process is compromised, the attacker is trapped within the limitations of the profile assigned to that process.
A Practical Example
Imagine you have a web server application. You want to ensure that even if an attacker gains control, they cannot access your /etc/shadow file. You would create an AppArmor profile for your server, usually found in /etc/apparmor.d/.
A basic rule in that profile might look like this:
/usr/sbin/my-web-server {
# Allow reading files in the web directory
/var/www/html/** r,
# Deny everything else by default
deny /etc/** w,
}
When you start the binary, the kernel labels it with this profile. If the process tries to write to /etc/, the kernel immediately blocks the action and logs a violation to the system audit trail.
Why It Matters
By labeling processes, you move security away from "who the user is" to "what the process is allowed to do." This significantly shrinks the attack surface because, even if a user starts a process, the process itself cannot exceed its own predefined "sandbox." This prevents lateral movement within your system, ensuring that a compromised service remains isolated from the rest of your sensitive infrastructure.
Key Takeaway: AppArmor enforces security by assigning mandatory labels to processes, ensuring they can only access the specific system resources explicitly permitted by their profile.