Mandatory Access Control: SELinux/AppArmor Type Enforcement…

What is Mandatory Access Control

Mandatory Access Control (MAC) is a security model that restricts access to resources based on predefined security labels. Unlike Discretionary Access Control, where owners can decide who accesses their data, MAC enforces strict rules defined by the system administrator or policy.

In SELinux and AppArmor, these security labels are applied to both processes and resources, ensuring that all interactions are checked against a set of predefined policies before they occur.

How SELinux/AppArmor Implement MAC

SELinux uses security contexts to label files, directories, and processes. These labels include categories like user, role, type, and range, which are enforced by the kernel. AppArmor, on the other hand, uses a simpler path-based approach where each program is assigned a profile that defines its allowed actions.

In both systems, every access attempt between a process and a resource is checked against these predefined policies in real-time, ensuring that only authorized interactions occur.

live demo · related simulation● LIVE

Enforcing vs Permissive Mode

SELinux operates in two modes: Enforcing and Permissive. In Enforcing mode, all access attempts are strictly checked against the policy, and if a violation occurs, it is logged but not automatically blocked. This allows administrators to monitor and refine policies.

Permissive mode, on the other hand, does not enforce the policy but still logs violations, providing a way to test and debug policies without immediately blocking access.

Real-World Applications

Mandatory Access Control is widely used in critical systems where security is paramount. For example, it can be found in government networks, financial institutions, and military installations to prevent unauthorized data access.

In the realm of cloud computing, MAC helps in creating secure virtual environments by ensuring that each application runs with minimal privileges, reducing the risk of a compromised application spreading throughout the system.

Frequently asked questions

What is the difference between SELinux and AppArmor?

SELinux uses complex security contexts based on categories like user, role, type, and range, while AppArmor focuses on path-based profiles that define allowed actions for programs.

Why would someone use Permissive mode instead of Enforcing mode?

Permissive mode allows administrators to test policies without immediately blocking access, making it easier to identify and correct issues before moving to a fully enforcing environment.

Can SELinux/AppArmor be used on any operating system?

Yes, both SELinux and AppArmor can be implemented on various Unix-like operating systems such as Linux distributions like CentOS, Fedora, and Ubuntu.

How does MAC enhance security compared to Discretionary Access Control (DAC)?

MAC provides a more robust security model by enforcing strict policies that cannot be bypassed by the resource owner, whereas DAC allows owners to decide who can access their data.

Try it live

Everything above runs in your browser — open Mandatory Access Control: SELinux/AppArmor Type Enforcement and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.

▶ Open Mandatory Access Control: SELinux/AppArmor Type Enforcement simulation