In this lesson, you will learn how to harden your Linux systems by restricting which network protocols and socket types specific applications are permitted to use.
While Mandatory Access Control (MAC) systems like AppArmor are famous for locking down file paths, they are equally powerful at creating a "network sandbox." By default, an application might have access to the entire networking stack of the kernel. However, if your application only needs to communicate via HTTP, there is no technical reason it should have the ability to open raw sockets or use legacy protocols like dccp or sctp.
Restricting Protocols in AppArmor
You can define allowed network access within an AppArmor profile using the network rule. This directive explicitly lists the protocols an application is permitted to interact with. If a protocol is not defined, the kernel will block any attempt to create a socket of that type, effectively mitigating potential exploits that rely on obscure or unneeded protocols.
Consider a microservice that only requires standard TCP/UDP communication:
profile my-web-app /usr/bin/my-web-app {
# Allow standard networking
network inet stream,
network inet dgram,
# Deny raw access and other protocols
deny network raw,
# ... file rules ...
}
In this snippet, network inet stream permits TCP (over IPv4), and network inet dgram permits UDP. By adding deny network raw, you explicitly block the creation of raw sockets, which are frequently used by malicious actors for packet sniffing or custom protocol injection.
Why this matters
Restricting network access follows the Principle of Least Privilege. Even if a vulnerability exists in the application that could allow an attacker to execute arbitrary code, the kernel will prevent them from opening non-permitted socket types. This limits an attacker's ability to scan the internal network, create custom command-and-control channels, or leverage raw-packet capabilities to bypass local firewalls. Always audit your application's actual network requirements before hardening; start with restrictive rules and observe audit logs to identify necessary additions.
Key Takeaway: By defining explicit network rules in your security profiles, you restrict an application's attack surface to only the protocols it strictly requires, effectively neutralizing attempts to leverage unauthorized or dangerous socket types.