SELinux & AppArmor

A daemon already runs under its own restricted account with the right rwx permissions, yet you also want the kernel to stop it touching directories it has no business in even if it is hijacked. What extra layer provides this?

When a running process violates an SELinux rule, many people assume SELinux kills the offending program. What does it actually do?

Administrators frequently switch SELinux off the moment the first problem appears. What two structural criticisms of SELinux drive that reaction?

You want to see the SELinux context of a file. Which command shows it, and where is that context physically stored?

A file ended up with the wrong SELinux context. You reach for restorecon vs chcon — what is the practical difference between the two?

You serve HTML from a non-standard directory like /var/myotherserver and want the correct SELinux context to survive future restorecon runs. What's the durable fix?

In SELinux terminology, what is a process's context called, how do you view it, and which part of the context do most rules actually care about?

You need Apache to run CGI scripts but editing the SELinux policy is out of the question. What mechanism lets you adjust behavior without touching rules, and how do you make the change stick?

SELinux has three operating modes. What are they, where are they configured, and which command reports the current one?

You copy a tree of HTML files into /var/www/html with cp -a and Apache suddenly gets permission denied, even though the files look readable. Why does cp -a specifically cause this?

An SELinux denial leaves no obvious trace in the service log or the journal. Which tool digs the real cause out of the audit log, and which package provides it?

A habit from older systems is to fully disable SELinux by setting SELINUX=disabled in /etc/selinux/config. Why can that fail on current systems, and what's the correct way to disable it?

Why is reading and editing an AppArmor profile considered far more approachable than working with an SELinux policy?

In an AppArmor profile, what do the access-right letters r, w, a, l, k, and m each grant?

An AppArmor profile launches a helper program. What's the difference between marking that execution ix, px, and ux?

In AppArmor path rules, a single asterisk and a double asterisk both mean wildcard, but they aren't interchangeable. What's the distinction?

You suspect AppArmor is blocking a program, but the service log says nothing. Where are AppArmor rule violations actually recorded, and how do you spot them?

Your server keeps home directories outside /home and AppArmor rules assume the default. How do you adjust that without rewriting every profile?

On SUSE, AppArmor is the default MAC system and even ships a YaST configuration module. How much extra capability does that GUI module really give you?

SELinux and AppArmor solve the same problem but ship on different distributions by default. Which system is the out-of-the-box choice on which families?

SELinux ties a file's context to extended attributes, which breaks on filesystems without EA support. How does AppArmor sidestep this problem entirely?

AppArmor's path-based rules are simpler than SELinux's labels, so why do Red Hat's security people argue that approach is inherently weaker?

Where do AppArmor profiles live, and which command tells you not just what profiles exist but which processes are actually being monitored right now?

An AppArmor profile can run in enforce mode or complain mode. What's the behavioral difference, and how do you switch a profile between them?

On Fedora/RHEL, Samba works but users cannot reach their home directories over the share. Which SELinux boolean unblocks home-directory sharing?

You want Samba to share a non-home directory like /samba/shares on Fedora/RHEL. Boolean toggles won't do it — what context must the directory carry, and how do you set it durably?

Traditionally you jail a network daemon in a chroot prison so it cannot touch the rest of the filesystem. Why do Fedora and Red Hat skip chroot for their services by default?

SELinux and AppArmor are the two MAC systems people usually name, but the Linux kernel carries a third, lighter one aimed at a specific niche. What is it and where is it used?

Fedora and RHEL ship more than one SELinux policy. Which one is loaded by default, and when would you install the alternative MLS policy instead?

You need to know exactly which SELinux rules and booleans govern a specific service like Apache or SSH. Where is that documented, and how do you read it?

You fully disabled SELinux with the selinux=0 kernel option and now want it back on. Why isn't re-enabling it a clean, instant reboot?

You want to switch a Debian or SUSE machine from its default MAC system over to SELinux. What one-time prerequisite trips people up?

When AppArmor starts on Debian/Ubuntu, a special filesystem appears at /sys/kernel/security. What is it and what does it expose?

aa-status shows 27 AppArmor profiles loaded but only 4 processes actually monitored, while Apache, Postfix, Dovecot and SSH run unprotected. Why does loaded profile count overstate real protection?

The stock /etc/apparmor.d has few profiles. Which package adds a large batch of extra ones, and what's the catch with them?

Beyond passing a single program path to aa-enforce, what two practical details matter when applying profile mode changes to running server services?

You keep seeing AppArmor 'audit' denials in the logs for a program that otherwise seems to work. What do frequent audit messages usually mean, and what are your options?

SELinux is described as resting on two pillars. What are they, and why is the first pillar useless without correct data?

On RHEL a plain httpd_sys_content_t context lets Apache read a web directory but not write to it. What context does an app like WordPress need so Apache can also upload and update files?