Linux Mandatory Access Control & Privilege — SELinux, AppArmor & Capabilities
Parent: DevOps, Infrastructure & Observability · researched 2026-06-01T05:56:09.592Z· 12 sources · 9 concepts · skill devops-infra
DevOps / infrastructure / observability family ROUTER. Split into focused sub-hubs — route to: devops-linux-internals (kernel, boot, memory/NUMA, storage/filesystems, virtualization, io_uring, cgroups
devops-infra
- DevOps / infrastructure / observability family ROUTER. Split into focused sub-hubs - route to: devops-linux-internals (kernel, boot, memory/NUMA, storage/filesystems, virtualization, io_uring, cgroups/namespaces, sandboxing, immutable Linux, privilege); devops-linux-admin (sysadmin, systemd, package management, shell scripting, host networking diagnostics); devops-containers-cicd (Docker, Kubernetes, CI/CD pipelines, Terraform/Kafka IaC, git workflows, library packaging); devops-observability (Node/OTel observability, Pino logging, Sentry, eBPF, Linux perf tracing). Pick the sub-hub matching the task. [source]
- This hub routes to on-demand reference files under references/. See each spoke for depth. [source]
Children
- LSM framework (hooks before each kernel access, exclusive vs stackable, SELinux/AppArmor/Smack/TOMOYO/Yama/Landlock/IPE/LoadPin/SafeSetID/BPF-LSM modules, lsm= boot stacking, only one exclusive MAC) (frontier)
- SELinux label model (user:role:type:level contexts, Type Enforcement as the core, RBAC, MLS/MCS, targeted vs mls policy) (frontier)
- SELinux operations (enforcing/permissive/disabled modes, domain transitions, booleans, semanage fcontext/port labeling, restorecon vs chcon, getenforce/setenforce, ls -Z/ps -Z/id -Z) (frontier)
- SELinux troubleshooting loop (AVC denials, ausearch -m avc, sealert, audit2allow -M as last resort, dontaudit semodule -DB) (frontier)
- AppArmor path-based profiles (enforce vs complain/learning, abstractions/includes, aa-genprof/aa-logprof/aa-enforce/aa-status, path-vs-label trade-off, multi-path bypass caveat) (frontier)
- Linux capabilities — five thread sets (permitted/effective/inheritable/bounding/ambient) and the execve() transformation formula (frontier)
- File capabilities + securebits + no_new_privs (security.capability xattr, setcap/getcap, SECBIT_*, prctl PR_SET_NO_NEW_PRIVS) (frontier)
- Dangerous capabilities (CAP_SYS_ADMIN, CAP_DAC_OVERRIDE, CAP_SETUID/SETGID, CAP_NET_ADMIN, CAP_NET_BIND_SERVICE, CAP_SYS_MODULE/PTRACE/BPF) (frontier)
- Container & Kubernetes composition (cap-drop ALL + add, container_t/MCS categories, seLinuxOptions, docker-default/appArmorProfile, seccomp RuntimeDefault, Pod Security Standards Baseline/Restricted) (frontier)
Frontier under this node: AppArmor path-based profiles (enforce vs complain/learning, abstractions/includes, aa-genprof/aa-logprof/aa-enforce/aa-status, path-vs-label trade-off, multi-path bypass caveat), Container & Kubernetes composition (cap-drop ALL + add, container_t/MCS categories, seLinuxOptions, docker-default/appArmorProfile, seccomp RuntimeDefault, Pod Security Standards Baseline/Restricted), Dangerous capabilities (CAP_SYS_ADMIN, CAP_DAC_OVERRIDE, CAP_SETUID/SETGID, CAP_NET_ADMIN, CAP_NET_BIND_SERVICE, CAP_SYS_MODULE/PTRACE/BPF), File capabilities + securebits + no_new_privs (security.capability xattr, setcap/getcap, SECBIT_*, prctl PR_SET_NO_NEW_PRIVS), LSM framework (hooks before each kernel access, exclusive vs stackable, SELinux/AppArmor/Smack/TOMOYO/Yama/Landlock/IPE/LoadPin/SafeSetID/BPF-LSM modules, lsm= boot stacking, only one exclusive MAC), Linux capabilities — five thread sets (permitted/effective/inheritable/bounding/ambient) and the execve() transformation formula, SELinux label model (user:role:type:level contexts, Type Enforcement as the core, RBAC, MLS/MCS, targeted vs mls policy), SELinux operations (enforcing/permissive/disabled modes, domain transitions, booleans, semanage fcontext/port labeling, restorecon vs chcon, getenforce/setenforce, ls -Z/ps -Z/id -Z), SELinux troubleshooting loop (AVC denials, ausearch -m avc, sealert, audit2allow -M as last resort, dontaudit semodule -DB)