<< Back to article

OS Security Functions (uid/gid, ulimit, apparmor, selinux)

Operating system security is built on layers of access control, resource limits, and mandatory enforcement mechanisms. Linux provides a comprehensive security framework that ranges from discretionary access control (DAC) to mandatory access control (MAC).

Users and Groups: The Foundation of Access Control

Every process runs with an identity determined by:

  • Real UID/GID: The identity of the user who started the process.
  • Effective UID/GID: The identity used for permission checking. This can change when running setuid/setgid programs.
  • Saved UID/GID: Allows a process to temporarily drop and regain privileges.
  • Filesystem UID/GID: Used for filesystem permission checking (Linux-specific).

Groups allow collective permission management. A user can belong to multiple groups. File permissions distinguish between owner, group, and others.

View your current identities with:

id

Change your identity (if authorised) with su or sudo.

File Permissions

Traditional Unix permissions use a 9-bit model:

  • Owner (user): read, write, execute
  • Group: read, write, execute
  • Others: read, write, execute

Set permissions with chmod and ownership with chown:

chmod 750 /usr/local/bin/myapp
chown root:staff /usr/local/bin/myapp

Resource Limits (ulimit)

The OS enforces per-process and per-user resource limits to prevent any single process from exhausting system resources. Configure limits with ulimit:

ulimit -n 1024      # Max open file descriptors
ulimit -u 256       # Max user processes
ulimit -v 1048576   # Max virtual memory (KB)

Common limits include:

  • nofile: Maximum open file descriptors
  • nproc: Maximum number of processes
  • memlock: Maximum locked-in-memory address space
  • cpu: CPU time limit in seconds
  • as: Maximum address space (virtual memory)

Limits can be configured system-wide in /etc/security/limits.conf or via systemd unit files.

AppArmor: Mandatory Access Control

AppArmor (Application Armor) is a Linux kernel security module that restricts programs' capabilities with per-program profiles. Unlike SELinux, which labels files and processes globally, AppArmor uses path-based rules.

AppArmor profiles are stored in /etc/apparmor.d/ and define what files and capabilities a program may access:

  • Enforce mode: Violations are blocked and logged.
  • Complain mode: Violations are logged but not blocked.

Profile states:

aa-status

Reload profiles after editing:

apparmor_parser -r /etc/apparmor.d/usr.sbin.named

SELinux: Security-Enhanced Linux

SELinux is a mandatory access control (MAC) system developed by the NSA. It assigns security contexts (labels) to every process and file, enforcing policies that restrict access based on these labels.

SELinux contexts have the format user:role:type:level:

ls -Z /etc/passwd
-rw-r--r--. root root system_u:object_r:passwd_file_t:s0 /etc/passwd

Key SELinux concepts:

  • Type Enforcement: Processes can only access files of permitted types.
  • Roles: Users operate within authorised roles.
  • Multi-Level Security (MLS): Information flow controlled by sensitivity levels.

SELinux modes:

  • Enforcing: Policy violations are blocked.
  • Permissive: Policy violations are logged but not blocked.
  • Disabled: SELinux is inactive.

Check status with getenforce and view logs with ausearch.

Capabilities

Linux capabilities divide root privileges into discrete units. A process can hold specific capabilities without having full root privileges. This follows the principle of least privilege.

Example capabilities:

  • CAP_NET_ADMIN: Configure network interfaces and routing.
  • CAP_SYS_ADMIN: Broad system administration (dangerous).
  • CAP_DAC_OVERRIDE: Bypass file read/write/execute permission checks.
  • CAP_SETUID: Make arbitrary UID changes.

Grant capabilities to executables:

setcap cap_net_admin+ep /usr/sbin/arping