Linux whitelist-based Mandatory Access Control instead of a blacklist-based model

Question

I'm trying to harden a Linux installation on a personal computer - I decided to try both SELinux and AppArmor as a Mandatory Access Control (MAC) to supplement the default Discretionary Access Control (DAC) that Linux comes with by default.

However, after having played around with both solutions for a couple of days it seems to me that both of them have roughly the same model of security:

1. All programs are unconfined by default.
2. You define a security profile where you define access rules and permissions for a program.
3. You enforce the security profile which restricts the program's access/permissions.
4. Repeat this for every program you want to restrict.

This model is a targeted security model where you define a specific security profile for a program based on paths (AppArmor) or object labels (SELinux) that it can access.

This seems quite odd to me, as what I would expect intuitively is a security model like so:

1. All programs are fully confined by default (i.e. can't do anything on the system)
2. You define a list of programs you would like to whitelist (e.g. coreutils, system daemons etc.) or loosen the restrictions for programs that you trust (e.g. editor, package manager etc.)
3. More specific profiles take precedence over the less specific profiles (i.e. /usr/bin/foo takes precedence over /usr/bin/*).
4. When a new program is installed - the default profile is automatically applied to it and you need to manually loosen the restrictions / whitelist it to increase the access permissions of that program.

This model applies the maximum security globally - where every program is confined by default - and uses the whitelist approach to expand the capabilities of a specific program or a list of programs as per your requirements.

As far as I know the first model is how both AppArmor and SELinux function by default. Is there a way to implement a MAC security layer in Linux which follows the second approach? I would like to maximally restrict all programs by default unless I specify otherwise - as this seems to be a better security model in my opinion and is how I would expect the MAC layer to work intuitively.

Answer 1

I seem to have found what I was looking for - using AppArmor global profiles and profile stacking which can be used to implement a whitelist-like model:

https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorSystemWideRestrictions

Answer 2

SELinux behaves the way you expect (white list). All access is denied by default. The other three points you expect also apply to SELinux.

Your experience with SELinux seems to be based on a particular configuration (policy model).

You can turn the white list security model into a black list policy model (SELinux is flexible like that). I think you are being fooled by a specific policy configuration you're using.