I'm trying to harden a Linux installation on a personal computer - I decided to try both SELinux and AppArmor as a Mandatory Access Control (MAC) to supplement the default Discretionary Access Control (DAC) that Linux comes with by default.
However, after having played around with both solutions for a couple of days it seems to me that both of them have roughly the same model of security:
- All programs are unconfined by default.
- You define a security profile where you define access rules and permissions for a program.
- You enforce the security profile which restricts the program's access/permissions.
- Repeat this for every program you want to restrict.
This model is a targeted security model where you define a specific security profile for a program based on paths (AppArmor) or object labels (SELinux) that it can access.
This seems quite odd to me, as what I would expect intuitively is a security model like so:
- All programs are fully confined by default (i.e. can't do anything on the system)
- You define a list of programs you would like to whitelist (e.g. coreutils, system daemons etc.) or loosen the restrictions for programs that you trust (e.g. editor, package manager etc.)
- More specific profiles take precedence over the less specific profiles (i.e. /usr/bin/foo takes precedence over /usr/bin/*).
- When a new program is installed - the default profile is automatically applied to it and you need to manually loosen the restrictions / whitelist it to increase the access permissions of that program.
This model applies the maximum security globally - where every program is confined by default - and uses the whitelist approach to expand the capabilities of a specific program or a list of programs as per your requirements.
As far as I know the first model is how both AppArmor and SELinux function by default. Is there a way to implement a MAC security layer in Linux which follows the second approach? I would like to maximally restrict all programs by default unless I specify otherwise - as this seems to be a better security model in my opinion and is how I would expect the MAC layer to work intuitively.