Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

My corporate policy says that Linux boxes must be secured with SELinux (so that a security auditor can check the 'yes, we're extremely secure!' checkbox for each server). I had hoped to take advantage of Ubuntu's awesome default AppArmor security. Is it unwise to run both Apparmor and SELinux? (If so, can this bad idea be mitigated with some apparmor and/or selinux tweaks?)

Update 1/28 -- Kees Cook has pointed out in his answer the dead simple reason why it's a bad idea to run both -- the Linux kernel says you can't1. [ 1 More precisely, the Linux Security Modules interface framework is designed for a single running implementation, and does not support more than a single running implementation. ]

share|improve this question

2 Answers 2

up vote 13 down vote accepted

The Linux Kernel provides the Linux Security Module interface, of which SELinux and AppArmor are both implementations of. (Others include TOMOYO, Smack, ...) This interface is designed currently to only allow a single LSM to be operational at a time. There is no way to run two simultaneously, so you must choose one. There has been discussion from time-to-time about how to "stack" multiple LSMs, but this has not been done yet.

share|improve this answer
    
SELinux and AppArmor are not implementations of the Linux Security Module (LSM) interface. They are consumers of the LSM interface. –  ruief Aug 3 at 16:45

I wouldn't use both.

Both SELinux and AppArmor do the same basic thing: limiting access to files and folders to only the applications that really need access.

But both implement this idea in very different ways.

  • SELinux attaches a label to every file in your filesystem and limits the access of an application to certain labels.
    For example: Apache can only use files and folder labeled explicitly as web files, and other applications can't.
  • AppArmor accomplishes the same thing without using labels, it just uses file paths.

(This is a very very basic explanation of how SELinux and AppArmor operate.)

If you were to use both they would probably get in each other's way, and I really see no need or advantage to using both.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.