Linux Security Modules (LSM) are a set of kernel modules that allow the enforcement of various security policies in Linux. Two of the most popular LSMs are SELinux and AppArmor.
SELinux (Security-Enhanced Linux) is a mandatory access control (MAC) system that provides fine-grained control over access to system resources. It labels system objects such as files, processes, and sockets with a security context, and defines rules that specify which contexts can access which objects. This makes it much harder for attackers to exploit vulnerabilities in the system, as they must first bypass the access control policies enforced by SELinux. However, SELinux can be complex to configure and may require significant effort to set up properly.
AppArmor, on the other hand, is a simpler LSM that uses a profile-based approach to restrict the actions of processes. It works by defining a set of rules that specify what a process is allowed to do, based on its identity and the resources it needs to access. For example, a web server may be allowed to read and write files in the /var/www directory, but not in the /etc directory. AppArmor profiles can be easier to create and manage than SELinux policies, but may not provide as fine-grained control.
In both cases, LSMs enhance security by providing an additional layer of protection against attacks. By enforcing strict access control policies on system resources, they make it harder for attackers to exploit vulnerabilities or gain unauthorized access to sensitive data. However, they also require careful configuration and management to ensure that they do not interfere with legitimate system operations or cause unexpected issues.
To use SELinux or AppArmor, you need to install the corresponding packages and configure the policies or profiles for the system and its services. For example, in Ubuntu, you can install the AppArmor package using the command sudo apt-get install apparmor, and then create a profile for a service using the aa-genprof command. To enable SELinux on a Red Hat-based system, you need to install the selinux-policy package and set the SELINUX parameter in the /etc/selinux/config file to enforcing. You can then use the semanage and setsebool commands to manage policies and permissions for individual services and files.