cyber-security-resources/linux-hardening/LSM-comparison.md

# A Comparative Overview of SELinux, AppArmor, Yama, TOMOYO Linux, and Smack

Introduction:
In the realm of Linux security, various Linux Security Modules (LSMs) have been developed to enhance access control and provide mandatory access control (MAC) mechanisms. This article explores five popular LSMs: SELinux, AppArmor, Yama, TOMOYO Linux, and Smack. Each of these modules offers unique features and approaches to bolstering the security posture of Linux-based systems.

1. SELinux:
   - Developed by the National Security Agency (NSA), SELinux is widely adopted in mainstream RHEL-based distributions.
   - Implements MAC with fine-grained access controls, allowing administrators to define extensive security policies.
   - Enforces access controls based on security labels, providing powerful isolation and protection against privilege escalation.
   - Requires a specific kernel build with SELinux support, and policies can be complex to configure and manage.
   - Documentation: [SELinux Project](https://github.com/SELinuxProject/selinux/wiki)

2. AppArmor:
   - AppArmor is integrated into mainstream Ubuntu-based distributions and provides profile-based access control.
   - Offers pre-configured profiles for commonly used applications, simplifying the setup and management of security policies.
   - Uses path-based access control to restrict access to files and resources, enhancing application-level security.
   - Provides a balance between security and usability, making it more approachable for many users.
   - Documentation: [AppArmor Wiki](https://gitlab.com/apparmor/apparmor/-/wikis/home)

3. Yama:
   - Yama focuses on process-related security features, allowing fine-grained restrictions on process operations.
   - It enables administrators to limit process tracing, prevent process attachment, and restrict process capabilities.
   - Available in some mainstream distributions such as Fedora, Yama provides additional process-level security controls.
   - Documentation: [Yama Documentation](https://www.kernel.org/doc/html/latest/admin-guide/Yama.html)

4. TOMOYO Linux:
   - TOMOYO Linux employs a lightweight and pathname-based access control mechanism.
   - Administrators define policies based on paths, executables, and attributes, reducing complexity.
   - Offers a white-listing approach to security, allowing only explicitly permitted operations and enhancing security through simplicity.
   - Limited usage compared to SELinux and AppArmor, typically found in specific distributions and niche use cases.
   - Documentation: [TOMOYO Linux Documentation](https://tomoyo.osdn.jp/2.5/policy-specification/index.html)

5. Smack:
   - Smack, a lightweight labeling-based access control LSM, focuses on simplicity and flexibility.
   - Uses security labels assigned to processes and files to enforce access control policies.
   - Smack's labeling approach enables fine-grained access control, enhancing security in a lightweight manner.
   - Not included by default in mainstream distributions but can be enabled with a specific kernel build.
   - Documentation: [Smack Documentation](https://schaufler-ca.com/documentation/smack/)

Conclusion:
LSMs play a vital role in enhancing Linux system security. SELinux, AppArmor, Yama, TOMOYO Linux, and Smack are prominent examples, each offering distinct features and approaches to access control. When selecting an LSM, it is crucial to consider the specific requirements, complexity, and community support to ensure an optimal security solution for your Linux environment. Consult the provided documentation for each LSM to gain a deeper understanding of their features and configuration options.


## Comparison Table

| Feature                 | SELinux                                            | AppArmor                                           | Yama                                                | TOMOYO Linux                                       | Smack                                              |
|-------------------------|----------------------------------------------------|----------------------------------------------------|-----------------------------------------------------|----------------------------------------------------|----------------------------------------------------|
| Purpose                 | Mandatory Access Control (MAC)                     | Profile-based Access Control                       | Process-related security                            | Lightweight, pathname-based Access Control         | Lightweight, labeling-based Access Control         |
| Development             | National Security Agency (NSA)                     | Open-source community                              | Community-driven                                    | Community-driven                                   | Community-driven                                   |
| Default Inclusion       | Mainstream RHEL-based distributions (e.g., CentOS) | Mainstream Ubuntu-based distributions               | Some mainstream distributions (e.g., Fedora)         | Not included by default                            | Not included by default                            |
| Access Control Approach | MAC - Flexible and fine-grained access controls    | Profile-based - Pre-configured profiles for apps   | Process-related - Attach/trace restrictions         | Pathname-based - Path-based access control         | Labeling-based - Security labels for processes/files |
| Complexity              | Higher complexity due to fine-grained control       | Moderate complexity with pre-configured profiles    | Simpler process-related restrictions                 | Moderate complexity with pathname-based policies   | Simpler labeling-based access control              |
| Usage                   | Commonly used in RHEL-based enterprise systems     | Commonly used in Ubuntu-based distributions         | Limited usage, primarily process-related security    | Limited usage, specific distributions and use cases | Limited usage, specific distributions and use cases |
| Integration             | Requires specific kernel build with SELinux support | Included by default in Ubuntu and some distributions | Included in some mainstream distributions            | Requires specific kernel build with TOMOYO support | Requires specific kernel build with Smack support  |

Please note that the features and usage mentioned in the table are general characteristics, and specific implementations and configurations may vary. The choice between these LSMs depends on factors such as the Linux distribution, security requirements, and specific use case considerations. It's important to evaluate each LSM's documentation and community support to determine the best fit for your needs.