Please enable JavaScript.
Coggle requires JavaScript to display documents.
🐧 Linux Security Module (LSM) - Enterprise Security Architecture - Coggle…
🐧 Linux Security Module (LSM) - Enterprise Security Architecture
1️⃣ Linux Security Module (LSM) Fundamentals
🔹 Definition of Linux Security Module (LSM)
Linux Security Module (LSM) is a security framework built into the Linux kernel
LSM provides a common interface that allows different security systems to control:
File access
Process execution
User permissions
Network operations
Kernel object access
System resource usage
LSM works at kernel level
LSM follows:
Principle of Least Privilege (PoLP)
Mandatory Access Control (MAC)
Defense in Depth
🔹 Why LSM Exists
Traditional Linux security:
User ID (UID)
Group ID (GID)
File permissions
ACLs
Capabilities
Limitations:
Root user has almost unlimited power
File permissions cannot control complex security policies
No centralized security policy enforcement
LSM adds:
Advanced access control
Kernel-level security decisions
Mandatory security policies
Fine-grained authorization
2️⃣ Linux Security Architecture Overview
🖥 User Space
Applications
Apache Web Server
MySQL Database
SSH Server
Docker Containers
Kubernetes Pods
⚙ System Calls
Application requests kernel operations
Examples:
open()
read()
write()
execve()
socket()
🧠 Linux Kernel
Kernel Security Hooks
LSM Framework
Security Decision Point
🛡 LSM Security Modules
SELinux
AppArmor
Smack
Tomoyo
💾 Hardware
3️⃣ LSM Internal Architecture
🔹 LSM Hooks
Definition:
Security hooks are checkpoints inside Linux kernel
They intercept security-sensitive operations
Examples:
File Access Hook
Checks:
Can user read this file?
Process Hook
Checks:
Can this process execute?
Network Hook
Checks:
Can this application create network connection?
🔹 LSM Hook Examples
File Operations
inode_permission()
file_open()
Process Operations
task_create()
task_kill()
Network Operations
socket_create()
socket_connect()
4️⃣ Mandatory Access Control (MAC)
🔐 Definition
Mandatory Access Control means:
Security policy decides access
Users cannot override policy
Traditional Linux DAC
Discretionary Access Control
Example:
chmod 777 file.txt
Owner controls permissions
MAC Example:
SELinux denies access even if:
root user
chmod 777
ownership changed
Enterprise Usage:
Government systems
Banking
Military
Critical infrastructure
5️⃣ Main Linux LSM Security Modules
5.1 SELinux
🔐 Security Enhanced Linux
Developed by:
NSA
Red Hat
Default in:
RHEL
CentOS
Fedora
Security Model:
Type Enforcement (TE)
Role Based Access Control (RBAC)
Multi Level Security (MLS)
SELinux Components
SELinux Policy
Location:
/etc/selinux/
Main Configuration:
/etc/selinux/config
Policies:
/etc/selinux/targeted/
Context Database:
/etc/selinux/targeted/contexts/
SELinux Modes
Enforcing
Security policy active
Command:
getenforce
Permissive
Logs violations but allows access
Disabled
SELinux completely off
Commands
Check status:
sestatus
Change mode:
setenforce 1
Disable:
/etc/selinux/config
View context:
ls -Z
Change context:
chcon
Restore context:
restorecon
Manage policy:
semanage
5.2 AppArmor
🔐 Application Armor
Used in:
Ubuntu
Debian
SUSE
Security model:
Path based security
Configuration location:
/etc/apparmor.d/
Check status:
aa-status
Profiles:
Apache profile
SSH profile
Docker profile
Modes:
Enforce
Block violations
Complain
Log only
Commands:
Enable profile:
aa-enforce
Disable profile:
aa-disable
Reload profile:
systemctl reload apparmor
5.3 Smack
Simplified Mandatory Access Control Kernel
Used in:
Embedded Linux
IoT devices
Automotive systems
5.4 Tomoyo
Lightweight MAC system
Features:
Easy policy management
Application behavior control
6️⃣ SELinux Enterprise Implementation
🏢 Enterprise Scenario
Web Server
Apache
PHP
Database
Security Requirement:
Apache can:
Read website files
Apache cannot:
Access database files
Modify system files
SELinux Policy:
httpd_t
Apache process type
Website files:
httpd_sys_content_t
Database files:
mysqld_db_t
Commands:
View Apache context:
ps -eZ | grep httpd
View files:
ls -Z /var/www/html
7️⃣ SELinux Labels and Context
SELinux Context Format:
user:role:type:level
Example:
system_u:object_r:httpd_sys_content_t:s0
Meaning:
user
SELinux identity
role
Permission category
type
Main security decision
level
Security classification
8️⃣ SELinux Type Enforcement
Definition:
Every object receives a security type
Example:
Process:
httpd_t
File:
user_home_t
Policy:
httpd_t can read httpd_sys_content_t
httpd_t cannot read user_home_t
9️⃣ SELinux Troubleshooting Enterprise
Check denial logs:
ausearch -m AVC
AVC:
Access Vector Cache denial
View alerts:
sealert -a /var/log/audit/audit.log
Audit logs:
/var/log/audit/audit.log
Generate policy:
audit2allow
Important:
Never blindly allow everything
Analyze security reason first
🔟 Linux Capabilities with LSM
Definition:
Capabilities divide root privileges into smaller permissions
Location:
/usr/include/linux/capability.h
Examples:
CAP_NET_ADMIN
Network administration
CAP_SYS_ADMIN
System administration
CAP_DAC_OVERRIDE
Ignore file permissions
Commands:
View capabilities:
getcap
Assign capability:
setcap
Example:
setcap cap_net_bind_service=+ep application
1️⃣1️⃣ LSM and Containers
Docker Security
Containers use:
Namespaces
Cgroups
Capabilities
SELinux/AppArmor
Docker SELinux:
docker run --security-opt label=enforcing nginx
Docker AppArmor:
docker run --security-opt apparmor=docker-default nginx
1️⃣2️⃣ LSM and Kubernetes Security
Kubernetes uses:
SELinux
AppArmor
Seccomp
Pod Security:
Restrict container privileges
Example:
Security Context
runAsNonRoot
allowPrivilegeEscalation=false
capabilities drop
1️⃣3️⃣ Enterprise Security Monitoring
Audit Framework
Location:
/var/log/audit/audit.log
Service:
auditd
Command:
systemctl status auditd
SIEM Integration
Forward logs to:
Splunk
Elastic SIEM
QRadar
Wazuh
Detect:
Unauthorized access
Policy violations
Privilege abuse
1️⃣4️⃣ LSM Hardening Checklist
✅ Enable SELinux/AppArmor
✅ Use Enforcing Mode
✅ Remove unnecessary privileges
✅ Apply least privilege
✅ Monitor AVC denials
✅ Audit security events
✅ Protect kernel parameters
✅ Harden services
✅ Integrate with SIEM
1️⃣5️⃣ Enterprise Architecture Example
🏢 Production Linux Server
Users
↓
SSH Authentication
↓
Linux Permissions
↓
Linux Capabilities
↓
LSM Framework
↓
SELinux Policy
↓
Kernel Security Hooks
↓
Protected Resources
1️⃣6️⃣ Important Paths Summary
SELinux:
/etc/selinux/config
/etc/selinux/targeted/
/var/log/audit/audit.log
AppArmor:
/etc/apparmor.d/
/sys/kernel/security/apparmor/
Audit:
/etc/audit/
/var/log/audit/
Kernel Security:
/sys/kernel/security/
1️⃣7️⃣ Enterprise Tools
SELinux Tools:
policycoreutils
selinux-utils
setools
audit2allow
AppArmor Tools:
apparmor-utils
apparmor-profiles
Monitoring:
auditd
Wazuh
Elastic Security
Splunk
1️⃣8️⃣ Interview and Certification Focus
RHCSA:
SELinux modes
Context management
restorecon
semanage
RHCE:
SELinux policy troubleshooting
Custom policies
Security:
MAC vs DAC
LSM architecture
Kernel security hooks
Privilege control