Description:

Mandatory Access Control (MAC) is a security system built into the Linux kernel that controls what applications and users can access on the system , adding an extra layer of protection beyond standard permissions. Linux provides two MAC systems: AppArmor and SELinux. Both serve the same security purpose but only ONE can be active at a time. AppArmor is the default MAC system on Ubuntu and is recommended for most users. SELinux is an alternative system.

Rationale:

Without Mandatory Access Control, a compromised application has access to all resources available to its running user. Enabling AppArmor or SELinux limits the blast radius of a security breach by restricting what each application can do, even if it is exploited. This prevents privilege escalation and unauthorized access to sensitive system resources.

Impact:

  • Restricts applications to only the files and resources defined in their security profiles.

  • Reduces the impact of exploited applications by limiting their system access.

  • Logs every action that violates a security profile, so administrators can review it.

  • Enforce mode actively blocks policy violations, preventing unauthorized access.

  • AppArmor and SELinux are mutually exclusive — only one can be active at a time.

  • SELinux requires a system reboot after initial activation.

Default Value:

AppArmor is installed and enabled by default on Ubuntu. SELinux is NOT installed by default on Ubuntu — it must be manually installed and activated. Activating SELinux (selinux-activate followed by a reboot) switches the system from AppArmor to SELinux. The compliance tool checks whether AppArmor or SELinux is actively running on the device.

Pre-Requisite:

  • Ubuntu 20.04 LTS or later (or equivalent Linux distribution).

  • Administrator (sudo) privileges on the device.

  • Only ONE MAC system can be active — do not install both AppArmor and SELinux simultaneously.

Remediation:

Why are there 2 options?

Ubuntu comes with AppArmor already installed and enabled by default. SELinux is an alternative that serves the same purpose. You only need ONE of them active — they cannot run together. For most Ubuntu users, AppArmor is the right choice as it is already built into Ubuntu.

→ If you are unsure, go directly to Option A and follow the steps.

Test Plan:

Pre-Implementation Check (run before making any changes)

Run the following commands to check which MAC system (if any) is currently active on your device.

Check 1 — AppArmor status:

sudo systemctl is-active apparmor


If the output shows active, AppArmor is currently enabled. If it shows inactive or not found, AppArmor is not running.

Check 2 — SELinux status:

sestatus


If it shows “SELinux status: enabled”, SELinux is active. If you see “command not found”, SELinux is not installed on your system.

Based on the output above, identify your scenario:

Scenario 1: AppArmor is enabled (Step 1 output: active)

•  You can continue using AppArmor — no action needed. Go to the Post-Implementation Check below to confirm.

•  If you want to switch to SELinux instead, you must first disable AppArmor:

sudo systemctl stop apparmor

sudo systemctl disable apparmor


•  Then proceed to Option B (SELinux) in Implementation Steps below. The selinux-activate step in Option B completes the switch.

Scenario 2: SELinux is enabled (sestatus output: SELinux status: enabled)

•  You can continue using SELinux — no action needed. Go to the Post-Implementation Check below to confirm.

•  If you want to switch to AppArmor instead, you must first disable SELinux:

sudo nano /etc/selinux/config


Change SELINUX=enforcing to SELINUX=disabled, then save and exit.

Next, remove the SELinux boot setting so AppArmor can load again:

sudo nano /etc/default/grub


On the line starting with GRUB_CMDLINE_LINUX, delete security=selinux (and selinux=1 if present), keep anything else on that line, then save and exit. Apply the change:

sudo update-grub

sudo reboot


•  Then proceed to Option A (AppArmor) in Implementation Steps below.

Scenario 3: Neither AppArmor nor SELinux is enabled

•  Proceed to the Implementation Steps below.

•  Choose Option A (AppArmor — recommended for Ubuntu) or Option B (SELinux).

Post-Implementation Check (run after completing the Implementation Steps)

If you use AppArmor (Option A):

sudo aa-status


Expected output: apparmor module is loaded. X profiles are loaded. X profiles are in enforce mode.

systemctl status apparmor


Expected: Active: active (exited)

If you use SELinux (Option B):

sestatus


Expected output: SELinux status: enabled | Current mode: enforcing

getenforce


Expected output: Enforcing

Implementation Steps:

Option A: Enable AppArmor (Recommended for Ubuntu)

Step 1: Install AppArmor (if not installed)

If AppArmor is not installed, run:

sudo apt update

sudo apt install apparmor apparmor-utils -y


Step 2: Enable and start AppArmor service

Enable AppArmor to start on boot and start it immediately:

sudo systemctl enable apparmor

sudo systemctl start apparmor


Step 3: Check profile modes (optional)

Most Ubuntu profiles are already in enforce mode. Do not switch every profile to enforce at once — some are shipped in complain mode on purpose, and forcing them can stop applications from working. To see which profiles are in complain mode, run sudo aa-status. To enforce one specific profile, run the following with that profile’s file name:

sudo aa-enforce /etc/apparmor.d/<profile-name>


Option B: Enable SELinux (Alternative)

Note: SELinux on Ubuntu is community-maintained and not officially supported by Canonical. Test it on a non-production device first.

Step 1: Install SELinux packages

Install SELinux and its required packages:

sudo apt update

sudo apt install selinux-basics selinux-policy-default auditd -y


Step 2: Activate SELinux

Run the SELinux activation script and reboot the system:

sudo selinux-activate

sudo reboot


Note: The system will perform an initial filesystem relabeling on first boot and may restart automatically once more. This may take several minutes.

Step 3: Set SELinux to Enforcing mode permanently (after reboot)

After rebooting, SELinux runs in permissive mode (it logs problems but does not block them). First check for actions that enforcing mode would block:

sudo ausearch -m avc -ts boot


If this shows no entries (“<no matches>”) or nothing related to applications you need, set enforcing mode permanently in the configuration file:

sudo nano /etc/selinux/config


Change SELINUX=permissive to SELINUX=enforcing, then save and exit. Then apply it immediately without rebooting:

sudo setenforce 1


Backout Plan:

If AppArmor was enabled (Option A):

Step 1: Switch profiles to complain mode (less restrictive)

If AppArmor blocks a legitimate application, switch its profile to complain mode instead of disabling AppArmor entirely:

sudo aa-complain /etc/apparmor.d/<profile-name>


Step 2: Disable AppArmor service (not recommended)

Only if absolutely necessary, disable AppArmor:

sudo systemctl stop apparmor

sudo systemctl disable apparmor


Note: Disabling AppArmor removes Mandatory Access Control protection. Re-enable as soon as the conflict is resolved.

If SELinux was enabled (Option B):

Step 1: Switch to Permissive mode (less restrictive)

If SELinux blocks a legitimate application, switch to permissive mode (logs but does not block):

sudo setenforce 0


This change is temporary and resets on reboot. To make it permanent, edit /etc/selinux/config and set SELINUX=permissive.

Step 2: Disable SELinux permanently (not recommended)

To fully disable SELinux, edit the configuration file:

sudo nano /etc/selinux/config


Change SELINUX=enforcing to SELINUX=disabled, then save and exit. Next, open /etc/default/grub (sudo nano /etc/default/grub), delete security=selinux (and selinux=1 if present) from the GRUB_CMDLINE_LINUX line, run sudo update-grub, and reboot. AppArmor will be active again after the reboot.

Note: Disabling SELinux removes Mandatory Access Control protection. Re-enable as soon as the conflict is resolved.

Note:

  • AppArmor and SELinux are mutually exclusive — only one MAC system can be active at a time.

  • Ubuntu uses AppArmor by default. Do not install SELinux unless specifically required.

  • Activating SELinux on Ubuntu (selinux-activate followed by a reboot) replaces AppArmor as the active MAC system.

  • If a legitimate application is blocked by AppArmor, add a custom profile rather than disabling enforcement entirely.

  • SELinux requires a full system reboot after initial activation — plan accordingly.

Reference: