Initial Threat Modeling for Services

In this lesson, you will learn how to systematically identify which Linux services are high-risk targets that necessitate the protective layer of Mandatory Access Control (MAC).

Before we enforce complex policies like SELinux or AppArmor, we must determine which services actually require them. Not every process on your system needs strict isolation; focusing your security efforts saves resources and reduces administrative overhead. We categorize services based on their interaction with the outside world and the sensitivity of the data they handle.

Identifying High-Risk Services

To perform an initial threat model, we evaluate a service against three primary risk vectors:

1. Network Exposure: Does the service listen on an external interface? A web server (like nginx) or a database (postgresql) listening on the network is a primary entry point for attackers.
2. Privilege Level: Does the service run as root? Services that start as root to bind to low ports but don't drop privileges effectively are immediate candidates for MAC confinement.
3. Data Sensitivity: Does the service have access to configuration files containing credentials, or does it write to directories that could lead to a system compromise?

Practical Assessment

For a standard service, you can run a quick audit to see what it touches. For example, if you are assessing an httpd instance, check its scope:

# Check network listeners
ss -tulpn | grep httpd

# Check files accessed during operation (using auditd or strace)
strace -f -e trace=open,openat -p <PID_OF_HTTPD>

If your threat model reveals that a service is network-facing, runs with elevated privileges, and touches sensitive files like /etc/shadow or secret keys, it is high-risk. A service that is purely internal, runs as a non-privileged user, and has no write access to system directories is low-risk.

By mapping these services, you establish a priority list for your MAC implementation. You should always apply security policies to the "high-risk" quadrant first—those that are network-facing and highly privileged—ensuring that even if a vulnerability is exploited, the service remains trapped within its defined security context.

Key Takeaway: Prioritize MAC implementation by modeling services based on their network exposure and privilege level to ensure the highest-risk processes are the first to be confined.