Managing Secrets in Hardened Environments

In this lesson, you will learn how to use Mandatory Access Control (MAC) labels to ensure sensitive configuration files and API keys are accessible exclusively by your authorized processes.

The Problem with Standard Permissions

In a standard Linux environment, secrets are often protected by basic POSIX permissions (e.g., chmod 600). While this prevents unauthorized users from reading the files, it does not prevent a compromised, legitimate service from reading them if it has been subverted. If an attacker gains control of a service, they can read any file the service user has permission to access.

Applying MAC Labels for Secret Isolation

By using AppArmor, we can apply an additional layer of security that doesn't rely on file ownership. Even if a process runs as the correct user, the kernel will block access to the secret file unless there is an explicit allow rule in the profile.

To secure a secret file, define a strict path in your AppArmor profile and ensure no other profiles have permission to access that location.

Example Implementation

Suppose you have an API key stored at /etc/myapp/secrets/api.key. You want to ensure that only the myapp binary can read it.

1. Create the file with specific ownership: chown myapp:myapp /etc/myapp/secrets/api.key chmod 400 /etc/myapp/secrets/api.key

2. Define the access in the AppArmor profile:

   profile myapp /usr/bin/myapp {
     # Deny everything by default; explicitly allow only the necessary secret
     /etc/myapp/secrets/api.key r,
     
     # Deny access to everything else in that directory
     deny /etc/myapp/secrets/* w,
   }
   

Why This Hardens Your System

By labeling this specific file path within the profile, you create a "jail" for your secrets. If an attacker injects code into another process running as the same user—or even if they exploit a vulnerability in a different part of your application—the kernel checks the security label before granting access. If the process attempting to read the file does not have the r (read) permission explicitly granted for that path in its AppArmor profile, the kernel will deny the request, regardless of the file's POSIX ownership.

Key Takeaway: Never rely solely on user-level permissions; use MAC policies to bind secrets to specific process identities so that unauthorized processes remain blind to sensitive data.