Linux – Core difference between SELinux and Apparmor

apparmorlsmselinux

What is the core [or kernel level] difference of SELinux and Apparmor?

Best Answer

AppArmor and SELinux are both independent Linux security module (LSM) implementations. They are configured using their own specific tools. Some distributions do ship with both kernel modules, but you can select only one at boot time (stacking certain other LSM modules, such as YAMA, is however possible).

A notable practical difference between the two systems is in how rules are applied. SELinux applies security labels to every object and access control rules are written for those labels. Additionally SELinux ships with a labeling database which maps paths with default file labels, creating a sort of path-based rule database. AppArmor rules work directly with paths.

SELinux at the moment contains more features which allow more fine grained or special access controls, such as MLS and MCS. AppArmor at the moment also lacks some more basic features, such as support for fine grained networking rules.

Related Question