Linux Security Modules (LSM) is a framework to provide an interface for adding MAC on top of DAC. This extra layer of security can be added with SELinux (Red Hat-based distributions and SUSE), AppArmor (Ubuntu and SUSE), or the lesser-known Tomoyo (SUSE). In this section, I'll cover SELinux and AppArmor.
DAC is a model that provides access control based on users who are a member of a group and permissions on files and devices. MAC restricts access on resource objects such as the following:
- Files
- Processes
- TCP/UDP ports
- Users and their roles
MAC, as implemented by SELinux, works by assigning a classification label, also known as context label, to every resource object, whereas AppArmor is path-based. In either case, if one resource object needs access to another object, it needs clearance. So, even if a hacker makes it into, for instance, your web...
