SELinux and AppArmor
Linux has two commonly used Linux Security Modules (LSMs) that add additional security policies, controls, and changes to default behavior to the system. In many cases, they modify the Linux kernel itself. Both are available for most Linux distributions, and both carry some degree of risk in implementation – you'll want to do some preparation before implementing to gauge what the impact of implementing one or the other might be. It's not recommended to implement both, as they are likely to conflict.
SELinux is arguably more complete and is definitely more complex to administer. It's a set of kernel modifications and tools that are added to the base install. At a high level, it separates the configuration of security policies and the enforcement of those policies. Controls include Mandatory Access Control, Mandatory Integrity Control, Role-Based Access Control (RBAC), and type enforcement.
SELinux features include the following:
-
...