Mandatory Access Control: SELinux vs. AppArmor

Updated

October 30, 2026

Mandatory Access Control: SELinux vs. AppArmor

Under traditional Discretionary Access Control (DAC), if a malicious attacker compromises a daemon running as www-data, they can read any file readable by www-data or world-readable files (/etc/passwd, /tmp).

Mandatory Access Control (MAC) systems enforce non-bypassable security policies defined by the system administrator, regardless of what file permissions say:

+-----------------------------------------------------------+
|                   MAC Architectures Compared              |
|                                                           |
| Dimension          SELinux (Red Hat/Fedora) AppArmor (Debian/Ubuntu)|
| --------------------------------------------------------- |
| Access Model       Type Enforcement (Labels)Path-Based Rules   |
| Policy Complexity  High (steep learning)    Moderate / Human-readable|
| File Association   Extended Attributes (xattr)Absolute File Paths|
| Filesystem Impact  Requires relabeling      Immediate path match|
| Security Granularity Fine-grained (IPC, Net) Process & Path focused|
+-----------------------------------------------------------+

AppArmor: Path-Based Confinement

Used by Debian, Ubuntu, and openSUSE. AppArmor attaches profiles directly to the absolute executable path of a program:

# /etc/apparmor.d/usr.sbin.nginx
#include <tunables/global>

/usr/sbin/nginx {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability net_bind_service,
  capability setuid,
  capability setgid,

  # Allow read access to configuration
  /etc/nginx/** r,

  # Allow read access to web content
  /var/www/** r,

  # Allow logging
  /var/log/nginx/* w,

  # Explicitly forbid execution of shells or compilers
  deny /bin/** x,
  deny /usr/bin/** x,
}

Even if an attacker gains remote code execution inside Nginx and has valid DAC permissions, the Linux kernel blocks them from executing /bin/sh or reading /home!

SELinux: Type Enforcement via Extended Attributes

Developed originally by the National Security Agency (NSA) and standard in Fedora and RHEL. SELinux assigns security contexts to every subject (process) and object (file, socket, port):

system_u:object_r:httpd_sys_content_t:s0
[user]   [role]   [type]              [level]

In Type Enforcement, policy rules state: “Process running in type httpd_t may read files of type httpd_sys_content_t”.
If an administrator copies a file from /home/user/index.html to /var/www/html/, it retains its original user_home_t label. Nginx will be denied access until restorecon updates its extended attribute.
SELinux provides extraordinary security, but requires robust tooling (audit2allow, semanage) to maintain without frustration.