SELinux and AppArmor, side by side
Domain 3 is 18% of XK0-006 and the pool names SELinux in 35 questions to AppArmor's 4. This guide runs the same idea on both families: a file the web server is refused even though the permissions allow it, the experiment that proves which layer said no when nothing was logged, and why AppArmor's path-keyed profiles behave differently from SELinux labels.
Security Guide 6 of 28 Intermediate
- PlatformsUbuntu 26.04 LTS + AlmaLinux 10.2
- Mandatory access controlAppArmor on Ubuntu, SELinux enforcing on Alma
- Firewallufw / nftables 1.1.6
- TimeAbout 28 min
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| LPLUS-A01 | 192.168.0.73 | Ubuntu 26.04 LTS | Debian-family host - apt, ufw, netplan, AppArmor | 2 Core | 4 GB | 50 GB |
| LPLUS-B01 | 192.168.0.74 | AlmaLinux 10.2 | RPM-family host - dnf, firewalld, NetworkManager, SELinux | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when a service is refused a file whose permissions look correct. This matters because mandatory access control refuses after the permission bits have already allowed it, and on this machine the refusal produced no audit record at all - so knowing the one experiment that identifies it is the difference between a diagnosis and a guess.
- reading the state of both systems, and what each attaches its policy to
- watching a web server be refused a file that its own account can read from a shell
- proving SELinux is the cause with permissive mode, when the audit log has nothing
- fixing the label with
restorecon, and seeing whycpworks wheremvfails - finding that an AppArmor profile follows a path, so a copied binary is unconfined
Before you start
- a-service-an-account-and-the-permission-between-them
-
Two families, two mandatory access control systems
-
What each one attaches its policy to
-
A web server, and a file it is allowed to read
-
The same file, arriving by a route that keeps its old label
-
Proving which layer refused it
-
Why cp and mv behave differently
-
AppArmor is keyed on the path, and that is the difference
-
The tools that change a profile are not installed
-
Switching a profile, and where the mode is kept
-
Putting both machines back