SELinux vs AppArmor applicability

Question

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux.

I am aware of this discussion but this does not make very clear one question I am having in regard to these two LSM implementations:

Is it a fact that:

• SELinux must be applied system-wide (thus the auto-relabeling process on first boot which takes as much time as a filesystem scan)
• AppArmor provides the flexibility to define policies only on those processes / scripts you d' like? - via the interactive auditing process)

(?)

Answer 1

As I answered to the other question, a major difference between AppArmor and SELinux is labeling. AppArmor is path based while SELinux adds additional label to every object. This is why auto relabeling is done at first boot to apply the default file labels. Otherwise it would not be possible to write meaningful policy for file access, as every file would be considered the same (due having same labels).

Both AppArmor and SELinux have unconfined domains, which do not restrict processes. Both systems also have complain mode (called permissive domain in SELinux), which only log policy violations but not enforce the policy. Both AppArmor and SELinux are enabled system-wide and it is possible in both systems to run processes which are not restricted by the security module.

When it comes to automatic policy generation, both systems have similar tools and mechanisms.

AppArmor profiles can be generated using aa-genprof and aa-logprof. aa-genprof creates a basic profile and sets it in complain mode. After running the program the rules can be generated from log files.

SELinux tools are policygentool and audit2allow. The major difference again is the file labeling, but policygentool can automatically create file types for program data (var), configuration files and log files. The policy can then be loaded in permissive mode and rules can be then generated from logs using audit2allow.