MISSION LAB

SELinux / AppArmor Enforcement

< Shield House

MISSION OBJECTIVES

0/8 Complete

    MAC POLICY INTEL

    MISSION BRIEFING

    A web application was compromised through a PHP file upload vulnerability. The attacker uploaded a shell because SELinux was in permissive mode. Set it to enforcing and fix the security contexts so the web app works correctly while the shell is contained.

    SELinux Commands

    getenforce
    Show current SELinux mode
    setenforce 1
    Set enforcing mode
    sestatus
    Detailed SELinux status
    ls -Z /path
    Show security contexts
    chcon -t httpd_sys_content_t file
    Change file context
    restorecon -Rv /path
    Restore default contexts
    getsebool -a
    List SELinux booleans
    setsebool -P httpd_can_network_connect on
    Toggle boolean persistently
    Why This Matters
    Mandatory Access Control (MAC) is the last line of defense. Even if an attacker gets code execution, SELinux/AppArmor restricts what processes can access. Disabling SELinux is the single most common (and dangerous) Linux admin mistake.