How to Install and Manage SELinux or AppArmor Security Policies

Linux has a well-earned reputation for being secure, but this security goes beyond just usernames, passwords, or file permissions. If you’re running a server, hosting applications, or simply care about protecting your data, you’ll want to go even deeper. That’s where Mandatory Access Control (MAC) frameworks like SELinux and AppArmor come in.

These security modules limit what programs can do—even if a user account is compromised or a service is hijacked. They put a strict set of rules in place, making sure that each application, even if running as root, can only access the files, directories, and resources it’s supposed to. This approach stops many attacks in their tracks and is a core part of hardening any modern Linux system.

But with this power comes complexity. It’s not uncommon to see “permission denied” errors that regular file permissions can’t explain, or to wonder how to enable or adjust these security layers. This guide will walk you through installing, checking, managing, and troubleshooting SELinux and AppArmor—so you can use them with confidence, not confusion.

What Are SELinux and AppArmor?

SELinux (Security-Enhanced Linux)

• Developed by the NSA and Red Hat.
• Most common on RHEL, CentOS, Fedora, Rocky, and AlmaLinux.
• Uses a complex, highly granular set of rules (policies) to control every process’s access to files, ports, devices, and more.
• Can be intimidating at first, but offers powerful protection and can be tuned for specific needs.

AppArmor (Application Armor)

• Developed by SUSE and now the default on Ubuntu, openSUSE, and other distributions.
• Uses human-readable profiles, each specifying what an application can access or do.
• Easier to configure and understand for many users, with a focus on per-application security.

Both tools provide a critical safety net, especially for servers and systems exposed to the internet. In most cases, your Linux distribution will use one or the other, not both.

Step 1: Know Which Security Module Your System Uses

Checking for SELinux

Open your terminal and run:

sestatus

If SELinux is enabled, you’ll see details like:

SELinux status:                 enabled
Current mode:                   enforcing
Policy version:                 31

If you see “command not found,” SELinux is not installed.

Checking for AppArmor

Try:

sudo aa-status

If AppArmor is running, you’ll see loaded profiles and modes. If you see “command not found,” AppArmor isn’t installed.

Tip:

Red Hat, CentOS, Fedora, Rocky, Alma: SELinux
Ubuntu, Debian, SUSE: AppArmor
Some Debian-based systems allow you to choose, but only one is active at a time.

Step 2: How to Install SELinux or AppArmor

Installing SELinux

On Red Hat/CentOS/Fedora/Rocky/Alma:

sudo dnf install selinux-policy selinux-policy-targeted policycoreutils

On Debian/Ubuntu:

SELinux is not enabled by default, but you can install it:

sudo apt update
sudo apt install selinux-basics selinux-policy-default auditd

To activate:

sudo selinux-activate
sudo reboot

After reboot, SELinux should be enabled.

Installing AppArmor

On Ubuntu/Debian:

AppArmor is typically installed and enabled. To ensure it:

sudo apt update
sudo apt install apparmor apparmor-utils
sudo systemctl enable --now apparmor

On SUSE/openSUSE:

sudo zypper install apparmor
sudo systemctl enable --now apparmor

On Red Hat-based systems:

AppArmor is usually not supported. Stick with SELinux for these distros.

Step 3: Checking Security Module Status

SELinux

To check status:

sestatus

Or, for a quick mode check:

getenforce

Possible outputs: Enforcing, Permissive, or Disabled.

AppArmor

To check which profiles are loaded and their modes:

sudo aa-status

Step 4: Changing Security Modes

SELinux

Temporarily change mode (until next reboot):

• Switch to permissive (logs but doesn’t block):

  sudo setenforce 0

• Switch to enforcing:

  sudo setenforce 1

Permanently change mode:

Edit the SELinux config file:

sudo nano /etc/selinux/config

Change the SELINUX= line to enforcing, permissive, or disabled.
Save and reboot for changes to take effect.

AppArmor

Switch a profile to complain (log-only) mode:

sudo aa-complain /etc/apparmor.d/usr.sbin.mysqld

Switch back to enforce mode:

sudo aa-enforce /etc/apparmor.d/usr.sbin.mysqld

Complain mode is useful when you’re testing new profiles or debugging issues.

Step 5: Managing SELinux Policies

Understanding SELinux Policies

SELinux uses detailed policies to control access. These policies decide whether a process can read, write, or execute specific files, use the network, or interact with devices.

Booleans

SELinux “booleans” are switches you can turn on or off to allow or restrict certain behaviors without changing the actual policy files.

getsebool -a

Enable a boolean (example: Allow Apache to connect to the network):

sudo setsebool -P httpd_can_network_connect on

File Contexts

If you move files or restore from backup, their SELinux context may be wrong. Fix with:

sudo restorecon -Rv /var/www/html

Viewing and Troubleshooting SELinux Logs

Most SELinux denials are logged in /var/log/audit/audit.log. If you install the setroubleshoot package, you can use:

sudo sealert -a /var/log/audit/audit.log

Or filter logs directly:

sudo ausearch -m avc -ts recent

Look for lines containing “denied” to see what was blocked.

Writing or Installing Custom SELinux Policies

For advanced tuning or third-party applications, you may need to write or install policy modules. This is best done with tools like audit2allow, which can generate minimal policies from audit logs.

sudo grep nginx /var/log/audit/audit.log | audit2allow -M nginx_custom
sudo semodule -i nginx_custom.pp

Only use this for trusted software, and review the rules before applying.

Step 6: Managing AppArmor Profiles

Understanding AppArmor Profiles

AppArmor uses readable profile files, usually found in /etc/apparmor.d/. Each profile lists the files, directories, or system resources a program can use.

Listing and Viewing Profiles

List profiles:

sudo aa-status

View a profile:

cat /etc/apparmor.d/usr.sbin.nginx

Editing and Reloading Profiles

Edit with your favorite editor:

sudo nano /etc/apparmor.d/usr.sbin.nginx

Reload after changes:

sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.nginx

Switching Modes

Set to complain mode (log-only):

sudo aa-complain /etc/apparmor.d/usr.sbin.nginx

Set back to enforce:

sudo aa-enforce /etc/apparmor.d/usr.sbin.nginx

Generating New Profiles

For programs without an existing profile:

sudo aa-genprof /usr/bin/myapp

Follow the prompts—AppArmor will log what the application tries to do, so you can allow or deny each action.

Viewing and Troubleshooting AppArmor Logs

Look for denials in /var/log/syslog or /var/log/audit/audit.log:

sudo grep DENIED /var/log/syslog

Step 7: Real-World Troubleshooting

Scenario: Web Server Fails to Access Files

SELinux

• Confirm file context:

  ls -Z /var/www/html/index.html

• Restore context if needed:

  sudo restorecon -Rv /var/www/html

• Enable needed boolean for network access:

  sudo setsebool -P httpd_can_network_connect on

• Review logs for denied access:

  sudo ausearch -m avc -ts recent

AppArmor

• Check the relevant profile:

  sudo nano /etc/apparmor.d/usr.sbin.nginx

• Add permission lines for required directories/files.
• Reload the profile:

  sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.nginx

• Check for log denials:

  sudo grep DENIED /var/log/syslog

Step 8: Disabling SELinux or AppArmor (Not Recommended)

Warning:

Disabling these tools removes a major layer of security and is rarely necessary except for troubleshooting.

Disabling SELinux

Edit /etc/selinux/config and set:

SELINUX=disabled

Reboot.

Disabling AppArmor

sudo systemctl stop apparmor
sudo systemctl disable apparmor

Step 9: Best Practices and Tips

• Never disable SELinux or AppArmor unless absolutely necessary. Use permissive/complain mode to debug instead.
• Always check logs after installing new software. If something breaks, it’s often a policy issue.
• Update your profiles as applications change. Software updates may require new permissions.
• Use complain mode (AppArmor) or permissive mode (SELinux) to build or test policies. Then switch back to enforce once you’re confident.
• Backup your configuration files and policies. Before making major changes, keep a copy.
• Consult official documentation. Both SELinux and AppArmor have extensive user guides and communities.

Conclusion

SELinux and AppArmor are the gatekeepers of your Linux system—watching over programs and enforcing the rules you (or your distribution) set. Installing and managing these tools can seem daunting at first, but with a little practice, you’ll see that most daily management boils down to checking status, switching enforcement modes, reviewing logs, and occasionally tuning a policy.

Start by confirming which module your system uses, and make sure it’s active and enforcing. If you run into a “permission denied” that doesn’t make sense, check your logs—chances are, SELinux or AppArmor is doing its job. With these skills, you can protect your servers, troubleshoot tricky issues, and keep your Linux environment safe and reliable.

If you need more detailed guidance, want to write custom policies, or run into a stubborn issue, don’t hesitate to explore the official documentation or reach out to the Linux community. Security is a journey—and mastering SELinux or AppArmor is a major step along the way.