Linux

AppArmor vs SELinux - A comparison

Markus

Jan 3, 2024 — 7 min read

Linux is a popular operating system that powers many servers, desktops, and devices. However, like any other system, Linux is not immune to security threats and vulnerabilities. To enhance the security of Linux, there are various security modules that can be integrated into the kernel to enforce access control policies on applications and resources. Two of the most widely used security modules are AppArmor and SELinux. In this blog post, we will compare these two modules and see their advantages and disadvantages, as well as how to use them and which one to choose.

What is AppArmor?

AppArmor is a Linux security module that was first developed by Immunix and later acquired by Novell ¹ ². It is based on the principle of least privilege, which means that each application should only have access to the resources that it needs to function properly and nothing more. AppArmor works by using security profiles that specify what actions an application can or cannot perform, such as reading or writing files, accessing network sockets, executing commands, etc. AppArmor identifies applications by their executable paths and stores the security profiles in plain text files in the /etc/apparmor.d/ directory. AppArmor has two modes of operation: enforce and complain. In enforce mode, AppArmor blocks any actions that violate the profile and logs them to the system audit. In complain mode, AppArmor only logs the violations but does not block them. This is useful for testing and debugging purposes.

You may read below for a better overview of AppArmor.

What is SELinux?

SELinux is a Linux security module that was originally developed by the National Security Agency (NSA) and Red Hat ³ ⁴. It is based on the principle of mandatory access control (MAC), which means that each application is assigned a security context that defines its permissions and restrictions. SELinux uses security policies that specify what actions an application can or cannot perform, based on its security context and the security context of the resources it accesses. SELinux identifies applications by their file system labels and stores the security policies in binary files in the /etc/selinux/targeted/policy/ directory. SELinux has three modes of operation: enforcing, permissive, and disabled. In enforcing mode, SELinux blocks any actions that violate the policy and logs them to the system audit. In permissive mode, SELinux only logs the violations but does not block them. This is useful for testing and debugging purposes. In disabled mode, SELinux is turned off completely.

You may read below for a better overview of SELinux.

How to use them?

To use AppArmor or SELinux, you need to have a Linux distribution that supports them and a kernel that has them enabled. Some of the distributions that have AppArmor by default are Ubuntu, SUSE, and Debian. Some of the distributions that have SELinux by default are Red Hat, Fedora, and CentOS.

To check the status of AppArmor or SELinux, you can use the apparmor_status or sestatus command, respectively.

To change the mode of AppArmor or SELinux, you can use the aa-enforce or aa-complain command for AppArmor, or the setenforce command for SELinux.

To create or modify the profiles or policies for AppArmor or SELinux, you can use the apparmor_parser or restorecon command for AppArmor, or the semanage or chcon command for SELinux.

There are also graphical tools and utilities that can help you manage AppArmor or SELinux, such as apparmor-manager or system-config-selinux.

Which one is better?

There is no definitive answer to which security module is better, as they both have their pros and cons. Here are some of the main points of comparison between them:

Access control mechanism: AppArmor uses security profiles based on paths, while SELinux uses security policies based on file labels. This means that AppArmor identifies applications by their executable paths, while SELinux identifies applications by their file system labels. For example, the profile file for Firefox browser in AppArmor is /etc/apparmor.d/usr.bin.firefox, while the policy file for Firefox browser in SELinux is /etc/selinux/targeted/contexts/files/file_contexts.bin.
Availability and compatibility: AppArmor is available for any Linux distribution, but it is mainly used on SUSE and Ubuntu systems. SELinux is also available for any Linux distribution, but it is primarily used on Red Hat and Fedora systems. AppArmor is implemented in the Linux kernel and is thus more efficient than SELinux, which is implemented as a loadable kernel module. However, SELinux is more compatible with other Linux security features, such as namespaces, cgroups, and seccomp.
Difficulty and flexibility: AppArmor is generally considered easier to learn, set up, and administer than SELinux, as it has a simpler and more intuitive syntax and commands. AppArmor also has a shorter learning curve, as it allows users to create and modify profiles in complain mode, which logs violations but does not block them. SELinux, on the other hand, is more complex and less user-friendly, as it requires users to understand the concepts of contexts, types, roles, and domains.

SELinux also has a stricter enforcement mode, which blocks violations by default. However, SELinux is more powerful and flexible than AppArmor, as it provides more granular and fine-grained control over applications and resources. SELinux also supports multi-level security (MLS) and multi-category security (MCS), which allow users to assign different levels and categories of sensitivity to files and processes.
Level of protection: Both AppArmor and SELinux provide a high level of protection for Linux systems, as they can prevent or limit the damage caused by malicious attacks or compromised applications. However, the level of protection depends on the quality and accuracy of the profiles or policies that are defined for the applications. AppArmor and SELinux both have default profiles or policies for common applications, such as web servers, databases, and browsers, but they may not cover all the possible scenarios and use cases.

Therefore, users need to customize and update their profiles or policies according to their specific needs and preferences. AppArmor and SELinux also have different approaches to policy enforcement: AppArmor works on the principle of granting access first, then applying restrictions, while SELinux works on the principle of denying access by default, then granting exceptions. This means that AppArmor is more permissive and less secure than SELinux, but also more flexible and less intrusive.

Which one to choose: AppArmor or SELinux?

The choice between AppArmor and SELinux depends on several factors, such as the type of system, the level of security, the complexity of configuration, and the personal preference of the user. There is no one-size-fits-all solution, as each security module has its strengths and weaknesses. However, here are some general guidelines that may help you decide:

If you are looking for a simple and easy-to-use security module that works well with most applications and does not require much modification, you may prefer AppArmor.
If you are looking for a powerful and flexible security module that can handle complex and sensitive scenarios and provide more control over applications and resources, you may prefer SELinux.
If you are using a SUSE or Ubuntu system, you may want to stick with AppArmor, as it is the default and supported security module for these distributions.
If you are using a Red Hat or Fedora system, you may want to stick with SELinux, as it is the default and supported security module for these distributions.

Ultimately, the best security module is the one that meets your needs and preferences, and that you are comfortable with using and maintaining. You can also try both security modules and compare their performance and functionality, and see which one suits you better. You can also switch between them if you want, as long as you disable one before enabling the other. However, be careful when doing so, as changing the security module may affect the system stability and functionality. Always backup your data and configuration files before making any changes, and test the system thoroughly after switching.

Conclusion

AppArmor and SELinux are two Linux security modules that can enhance the security of Linux systems by enforcing access control policies on applications and resources. They both have their advantages and disadvantages, and they both require some knowledge and skills to use and manage.