{"id":587,"date":"2026-07-20T17:58:03","date_gmt":"2026-07-20T17:58:03","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=587"},"modified":"2026-07-20T17:58:03","modified_gmt":"2026-07-20T17:58:03","slug":"securing-vps-selinux-apparmor-mandatory-access-control","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/securing-vps-selinux-apparmor-mandatory-access-control\/","title":{"rendered":"Securing Your VPS with SELinux and AppArmor: A Practical Guide to Mandatory Access Control on Linux"},"content":{"rendered":"\n

A standard Linux VPS runs discretionary access control (DAC) \u2014 if a process has root, it can do anything. Mandatory access control (MAC) systems like SELinux<\/strong> and AppArmor<\/strong> add a second layer of security: even processes running as root can only access what their policy allows. This guide explains how to configure both systems on your VPS, which one to choose, and how to troubleshoot the inevitable access denials.<\/p>\n\n\n\n

Looking for a broader VPS security strategy? Start with our feature overview<\/a> to see what performance and security features different providers offer.<\/p>\n\n\n\n

SELinux vs AppArmor: Which One Should You Use?<\/h2>\n\n\n\n

Both systems enforce MAC, but they approach it differently. The choice often comes down to your Linux distribution:<\/p>\n\n\n\n

Feature<\/th>SELinux<\/th>AppArmor<\/th><\/tr><\/thead>
Default on<\/td>RHEL, CentOS, Fedora, AlmaLinux, Rocky Linux<\/td>Ubuntu, Debian, OpenSUSE<\/td><\/tr>
Policy model<\/td>Label-based (every file, process, and port has a security context)<\/td>Path-based (policies reference file paths and network access)<\/td><\/tr>
Granularity<\/td>Extremely fine-grained. Every system object gets a label.<\/td>Coarser but simpler. Policies target specific applications.<\/td><\/tr>
Learning curve<\/td>Steep. Requires understanding security contexts, booleans, and policy modules.<\/td>Gentle. Policies are human-readable text files.<\/td><\/tr>
Audit logs<\/td>\/var\/log\/audit\/audit.log (use ausearch<\/code> or sealert<\/code>)<\/td>\/var\/log\/syslog or \/var\/log\/kern.log (grep for “DENIED” or “ALLOWED”)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

If you are on Ubuntu or Debian, AppArmor is the natural choice. On RHEL-based distributions, SELinux is the default and is deeply integrated into the system packaging (Nginx, MariaDB, and PHP all ship with SELinux policies).<\/p>\n\n\n\n

Installing and Enabling AppArmor on Ubuntu\/Debian<\/h2>\n\n\n\n

AppArmor is pre-installed on Ubuntu (since 8.04) and Debian (since 7). Verify it is running:<\/p>\n\n\n\n

sudo aa-status\n# Should show: \"apparmor module is loaded.\" and a list of profiles<\/code><\/pre>\n\n\n\n
Installing AppArmor Utilities<\/h3>\n\n\n\n
sudo apt update\nsudo apt install apparmor-utils apparmor-profiles<\/code><\/pre>\n\n\n\n
Creating a Custom AppArmor Profile for Nginx<\/h3>\n\n\n\n
Let us create a profile that restricts Nginx to only the files and network permissions it actually needs.<\/p>\n\n\n\n
# Generate a profile template based on Nginx's actual behavior\nsudo aa-genprof \/usr\/sbin\/nginx\n\n# Follow the interactive prompts. Run typical Nginx operations\n# (request pages, reload config) then press 'S' to scan,\n# and 'A' to allow each detected permission.<\/code><\/pre>\n\n\n\n
After genprof completes, the profile is stored at \/etc\/apparmor.d\/usr.sbin.nginx<\/code>. You can edit it directly:<\/p>\n\n\n\n
# \/etc\/apparmor.d\/usr.sbin.nginx\n#include <tunables\/global>\n\n\/usr\/sbin\/nginx {\n  #include <abstractions\/base>\n  #include <abstractions\/nameservice>\n\n  \/etc\/nginx\/** r,\n  \/var\/log\/nginx\/* w,\n  \/var\/www\/** r,\n  \/run\/nginx.pid rw,\n\n  # Allow listening on port 80 and 443\n  network inet tcp,\n  network inet6 tcp,\n}<\/code><\/pre>\n\n\n\n
Apply the profile:<\/p>\n\n\n\n
sudo aa-enforce \/usr\/sbin\/nginx\n# Or try in complain mode first to log denials without blocking:\n# sudo aa-complain \/usr\/sbin\/nginx<\/code><\/pre>\n\n\n\n
Configuring SELinux on RHEL\/AlmaLinux\/CentOS<\/h2>\n\n\n\n
Check SELinux Status<\/h3>\n\n\n\n
getenforce\n# Output: Enforcing (good) or Permissive or Disabled<\/code><\/pre>\n\n\n\n
If SELinux is disabled, you can enable it by editing \/etc\/selinux\/config<\/code> and setting SELINUX=enforcing<\/code>, then rebooting. Note that changing from disabled to enforcing on an existing system may uncover previously hidden policy violations \u2014 test in permissive mode first.<\/p>\n\n\n\n
Managing SELinux Booleans<\/h3>\n\n\n\n
Booleans are SELinux toggles that adjust policy without writing rules. Common ones for a web server VPS:<\/p>\n\n\n\n
# Allow Nginx to connect to network services (proxying, database)\nsetsebool -P httpd_can_network_connect on\n\n# Allow Nginx to send email\nsetsebool -P httpd_can_sendmail on\n\n# Allow scripts to write to directories (for CMS platforms)\nsetsebool -P httpd_unified on\n\n# List all booleans\ngetsebool -a<\/code><\/pre>\n\n\n\n
Fixing SELinux Denials<\/h3>\n\n\n\n
When SELinux blocks an operation, it logs to \/var\/log\/audit\/audit.log<\/code>. Use sealert<\/strong> to get human-readable solutions:<\/p>\n\n\n\n
# Check for denials in the last hour\nsudo ausearch -m avc -ts recent | audit2allow -a\n\n# Generate a custom policy module to allow a specific denial\nsudo grep \"denied\" \/var\/log\/audit\/audit.log | audit2allow -M myhttpd\nsudo semodule -i myhttpd.pp<\/code><\/pre>\n\n\n\n
Always prefer setting the correct file context over writing allow rules. If a web application needs write access to a directory, set the httpd_sys_content_t or httpd_sys_rw_content_t context:<\/p>\n\n\n\n
# Change file context for a writable directory\nsudo semanage fcontext -a -t httpd_sys_rw_content_t \"\/var\/www\/myapp\/uploads(\/.*)?\"\nsudo restorecon -Rv \/var\/www\/myapp\/uploads<\/code><\/pre>\n\n\n\n
Common Pitfalls and How to Troubleshoot Them<\/h2>\n\n\n\n
Problem<\/th>Likely Cause<\/th>Fix<\/th><\/tr><\/thead>
Nginx returns 403 with correct file permissions<\/td>SELinux context on document root is wrong<\/td>chcon -R -t httpd_sys_content_t \/var\/www<\/code><\/td><\/tr>
PHP cannot connect to MySQL<\/td>SELinux blocking httpd network access<\/td>setsebool -P httpd_can_network_connect on<\/code><\/td><\/tr>
AppArmor blocking log rotation<\/td>logrotate needs write access to var\/log<\/td>Add \/var\/log\/nginx\/* rw,<\/code> to AppArmor profile<\/td><\/tr>
Cannot start Nginx<\/td>AppArmor profile blocks port binding<\/td>Ensure profile includes network inet tcp,<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Best Practices for MAC on Your VPS<\/h2>\n\n\n\n