Security-Enhanced Linux (SELinux) is a mandatory access control (MAC) security mechanism implemented in the Linux kernel. Unlike traditional discretionary access control (DAC) where file owners can control access, SELinux enforces security policies defined by administrators.
Key security enhancements:

• Mandatory Access Control: Enforces rules regardless of user permissions
• Process Isolation: Restricts what processes can access based on security contexts
• Principle of Least Privilege: Grants minimal necessary permissions
• Protection against privilege escalation: Even root access is constrained by SELinux policies
  SELinux uses security contexts (labels) attached to files, processes, and system resources to make access decisions based on predefined policies.

SELinux operates in three distinct modes:

1. Enforcing Mode: SELinux actively enforces security policies and denies unauthorized access attempts. Violations are logged and blocked.
2. Permissive Mode: SELinux logs policy violations but doesn't enforce them. Useful for testing and policy development without breaking applications.
3. Disabled Mode: SELinux is completely turned off. No policies are enforced or logged.
   Commands to check and change modes:

# Check current mode
getenforce
# Change mode temporarily
setenforce 0  # Permissive
setenforce 1  # Enforcing
# Change mode permanently (edit /etc/selinux/config)
SELINUX=enforcing|permissive|disabled

AppArmor provides application security through mandatory access control using security profiles that define what resources applications can access.
Key mechanisms:

• Path-based access control: Controls access based on file paths
• Capability restrictions: Limits system capabilities processes can use
• Network access control: Restricts network operations
• Resource limitations: Controls memory, file descriptors, etc.
  AppArmor profiles define:

# Example profile snippet
/usr/bin/firefox {
  /home/*/** r,           # Read access to user files
  /tmp/** rw,             # Read/write to temp
  capability net_bind_service,  # Network capability
  deny /etc/shadow r,     # Explicitly deny access
}

Applications run confined within their profiles, preventing unauthorized access even if compromised.

AppArmor profiles can operate in two modes:

1. Enforce Mode: The profile actively restricts the application's access according to the defined rules. Violations are blocked and logged.
2. Complain Mode: The profile logs access violations but doesn't enforce restrictions. Useful for profile development and testing.
   Commands:

# Check profile status
aa-status
# Set profile to complain mode
aa-complain /path/to/program
# Set profile to enforce mode
aa-enforce /path/to/program
# Disable profile
aa-disable /path/to/program

Profile location: Profiles are stored in /etc/apparmor.d/ directory.