SELinux and AppArmor

In short: SELinux and AppArmor are extra protection in the Linux kernel: they define what a program may do even when it runs as administrator. If a service is hacked the damage stays limited.

In more detail: The classic permission system asks “who owns the file?”. Mandatory access control (MAC) additionally asks “may this program do that at all?”.

In detail

• SELinux: from the NSA and Red Hat. Every file and process has a label (type). Rules allow certain accesses. Default on Fedora, RHEL, Rocky, Alma. Modes: enforcing, permissive, disabled. getenforce, setenforce 0 (temporary), messages with ausearch -m avc or journalctl.
• AppArmor: profiles per program with paths. Easier to read. Default on Ubuntu, Debian, SUSE. aa-status, profiles under /etc/apparmor.d.
• Common problems: a service cannot access a directory although permissions are right: check the SELinux label (ls -Z, restorecon).
• Do not switch off: better adjust a rule than disable SELinux entirely.
• Other mechanisms: seccomp (allowed system calls), namespaces and cgroups in Containers on Linux: namespaces and cgroups.

See also: Users, groups and file permissions on Linux, System calls and kernel mode