With SELinux developed by NSA and AppArmor by Novell [*], what alternate solutions exists when trying to lock down a system and running applications, based on ACL and similar concepts like Zones on Solaris.

with applications i mean: services that are available and public accessible via network, namely all kinds of web/applicationservers, but also db-servers.

chroot is not an option, because its PITA to setup and maintain in the long run (experiences).

What i want to achieve: limit access of netbased services to its config- and datafiles only (docroot for webservers, dbs for db-server etc); outgoing connections are managed via firewall and service-proxies. if some attacker is able to access the system, he7she shall be limited on what to see and what to do, e.g. dont run programs, dont read other files.

[*] because of gag-orders and such, no trust anymore.

  • 3
    Why is chroot "not an option" ? That seems to be a good map to your question. If your context has some special conditions which forbid the use of chroot then you should detail them, because such conditions are likely to apply to other solutions as well. – Thomas Pornin Sep 18 '13 at 12:33
  • @ThomasPornin: i hope i made it clearer. – that guy from over there Sep 18 '13 at 13:36
  • LIDS used to do it, but that project appears to be defunct - web site not updated since 2010, forum link broken. And I have to say, if the solution you find in this space isn't a PITA to set up and maintain, it's probably not a solution :) – gowenfawr Sep 18 '13 at 14:50
  • i'm investigation lxc and will report later. it maybe possible to have one "master" - container with all needed dependencies and then just mount separate /data - partitions from the host into each container. would be yummy! – that guy from over there Sep 18 '13 at 19:17
  • 3
    chroot can't even be considered a security feature.... – user28177 May 30 '16 at 17:02

Grsecurity could be an alternative to selinux and apparmor on a linux machine. A comparison of the three tools is given over here.

| improve this answer | |
  • 2
    FWIW, Grsecurity is not entirely an alternative, as it can be used together with SELinux – dawud Feb 21 '14 at 18:34
  • It is an alternative. The documentation just shows you that you can opt between selinux or grsecurity rbac. – user28177 May 30 '16 at 17:04
  • It is no longer an alternative, since it has gone closed-source. :/ Although SELinux only is open because that way the most people fall into the NSA trap. – Evi1M4chine Feb 3 '18 at 12:55
  • @Evi1M4chine Strictly speaking, it is not closed source (it's still licensed under the GPL and legally has to be) but, like RHEL, you now need to be a customer to obtain it, which is extremely unfortunate. – forest Nov 21 '18 at 9:04

There is also tomoyo, which provides the means to implement mandatory access control. You will have to trust NTT DATA Corporation to not be evil, though.

Also, arguably, chroot could not be even considered a security feature.

| improve this answer | |

I highly recommend RSBAC, since it is basically SELinux without the NSA.
So it is likely the best choice there is.

Several distributions support it out of the box: https://www.rsbac.org/links
In any other case, patch it yourself, using the the git repository: https://www.rsbac.org/download
(The pre-patched kernels are too outdated to be secure.)

My previous answer was wrong, and it is indeed alive, as this shows:

(Of course, unless you personally check the source, or trust somebody who did, … and run it on a system with no hardware backdoors … it’s all irrelevant anyway.)

| improve this answer | |
  • 1
    I thank @forest for correcting my previous misconception, so please give credit to him too. :) – Evi1M4chine Feb 7 '18 at 16:26

If your problem with chroot was just the difficulty of setting it up and the lack of standardized tooling around it, then you might find Docker a good fit. With Docker, the default is that containers (and therefore anything that exploits an application in the container) don't have any access to your filesystem. You have to opt-in to give them access to what you want, making it easy to verify you're giving them as little access as they need, and you can further restrict the network access or the CPU and memory usage limits.

| improve this answer | |

Google just released gVisor which is a small footprint library for running docker in a secure context.

| improve this answer | |

Selinux and marketed security enhancers are grossly overrated these days and most people looking to employ them is for no other reason than some additional security piece of software is being used.

An up-to-date Linux distribution/kernel after 2.4 that is properly configured to begin with which does not have those security flaws from the first days of unix/linux before kernel 2.4 before year 2000 when many security concepts did not exist is the better alternative you are looking for.

What is the specific end purpose you are wanting SElinux, apparmor, rsbac, whatever and what are you doing specifically that cannot be reasonably and practically accomplished in kernel 3.0 and later?

| improve this answer | |
  • its context was not clear. it was kinda hanging out there all lonesome – schroeder Feb 7 '18 at 21:07
  • Does this say what you wanted to say? The dots are connected now and the pieces make more sense. – schroeder Feb 7 '18 at 21:10
  • SELinux and AppArmor aren't about fixing kernel bugs or hardening it. They're access-control tools to allow processes to be run with finer control over what they're allowed access to. – Macil Feb 8 '18 at 19:27
  • only -2 for such a nonconformist heretic response? I'm not saying do not use selinux or apparmor, i'm just saying as an alternative... and also look into the history and current status of "secure linux". And maybe linux kernel >= 2.6 I don't remember which if it was 2.4 or 2.6 was where the major improvements began to happen – ron Feb 19 '18 at 19:05
  • not to mention the initial post here was 2013, it is now 2018, and the NSA website for SELinux = As such, updates to these SELinux webpages haven't occurred since 2008. nsa.gov/what-we-do/research/selinux – ron Feb 19 '18 at 19:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.