Lion Cipher Lab
Confine a Linux service with an AppArmor profile (mandatory access control)
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Ordinary Linux permissions decide what a USER can touch. But when an attacker exploits your web server, they are running AS that server's user — so every file that user could read, they can now read too. Mandatory access control flips this: you write a profile that says "this program may only ever touch these exact paths," and the kernel enforces it even against a fully compromised, root-adjacent process. A web server confined by AppArmor cannot read /etc/shadow or your SSH keys even after it is popped, because those paths were never in its profile. That containment — turning a full…
What you'll learn
- Mandatory access control (MAC) vs discretionary access control (DAC)
- Reading AppArmor state with aa-status
- Writing a minimal AppArmor profile
- Complain (audit) mode vs enforce (block) mode
- Reading apparmor="DENIED" audit lines in the kernel log
- Defense-in-depth Linux hardening
Steps in this lab
- The one idea: permissions vs. confinement (DAC vs MAC)
- Get on a real Ubuntu box (not WSL)
- Install the AppArmor tools
- See what is already confined: aa-status
- Build a tiny target — and prove plain permissions allow the read
- Write a minimal AppArmor profile
- Stage it in complain mode first (log, don't block)
- Flip to enforce — and watch the confinement bite
- Read the denial in the log — how you debug a profile
- The judgment: when to reach for this, and when not to