Linux Security Modules
Linux Security Modules (LSM) is a framework to provide an interface for adding MAC on top of DAC. This extra layer of security can be added with SELinux (Red Hat-based distributions and SUSE), AppArmor (Ubuntu and SUSE), or the lesser-known Tomoyo (SUSE). In this section, I'll cover SELinux and AppArmor.
DAC is a model that provides access control based on users who are a member of a group and permissions on files and devices. MAC restricts access on resource objects such as the following:
- Files
- Processes
- TCP/UDP ports
- Users and their roles
MAC, as implemented by SELinux, works by assigning a classification label, also known as context label, to every resource object, whereas AppArmor is path-based. In either case, if one resource object needs access to another object, it needs clearance. So, even if a hacker makes it into, for instance, your web application, the other resources are still protected!
SELinux
SELinux was developed by the NSA and Red Hat in 1998. It can be used...
