In this lesson, you will learn how the structural differences between label-based and path-based mandatory access control (MAC) architectures shape how security policies are enforced on your Linux system.
When we move from discretionary controls to MAC, we shift from "who is the user" to "what is the process allowed to do." The two primary implementations, SELinux and AppArmor, achieve this through fundamentally different architectural models.
Label-based Control (SELinux)
SELinux uses Labels (or Security Contexts) assigned to every object in the system. Whether it is a file, a process, or a network socket, the kernel attaches an "Extended Attribute" (xattr) that describes its security identity.
- The Process: The kernel checks the security context of the subject (e.g., a web server) against the security context of the object (e.g., a configuration file).
- The Advantage: Because the security identity is attached to the inode of the file itself, it is immune to file system changes. If you move a file to a new path, the security context remains bound to the data, ensuring the policy remains consistent.
Path-based Control (AppArmor)
AppArmor uses Paths to define access. It creates profiles based on the absolute file path of the executable.
- The Process: When a process attempts to access a resource, the AppArmor kernel module intercepts the request and verifies the file path against a list of allowed or denied paths defined in the profile.
- The Advantage: This architecture is significantly more intuitive for administrators. If you want to restrict access to
/var/www/html/secret.txt, you simply specify that path in the policy. There is no need to relabel the file system or worry about internal metadata.
Comparison Summary
| Feature | SELinux | AppArmor |
|---|---|---|
| Enforcement | Label-based (Extended Attributes) | Path-based (File Paths) |
| Persistence | Follows the file inode | Follows the directory structure |
| Complexity | High (Policy management is rigorous) | Moderate (Easier to read/write) |
While SELinux provides a more granular and robust architecture that persists regardless of file system movement, AppArmor offers a simpler path-based model that is easier to maintain for most standardized environments.
Key Takeaway: SELinux secures objects by their intrinsic security context, whereas AppArmor secures them by their location in the file system hierarchy.