7

Is there a way to find out if and in case which linux security LSM (apparmor, selinux, grsecurity) is used by the kernel?

To be more specific let's assume I am a legimate root user of the machine?

If information available also it would be nice to furthermore know: With regard to the question, is there a difference with considering the machine being (a) a local computer, (b) a dedicated server and (c) a virtual server "vServer"

update

I know that I could for instance install the user-space stuff (on a debian for instance apt-get install apparmor) and check if it yields results related to the specific LSM. So I could do for apparmor sudo apparmor_status which would then for instance yield: apparmor module is not loaded. which helps me rule out that option. Yet I was looking for a more general approach covering most/all LSM.

update2

I have discovered the path /sys/kernel/security. Maybe this is helpful finding an answer?

Community
  • 1
humanityANDpeace
  • 13,722
  • 13
  • 61
  • 107

2 Answers2

6

Yes you can check /sys/kernel/security what's available.

See also dmesg or /proc/cmdline for boot settings.

If your config.gz available then

zgrep CONFIG_SECURITY /proc/config.gz

else

grep CONFIG_SECURITY /boot/config-`uname -r`
  • thank you for the answer! Good to get confirmation on the `/sys/kernel/security/` The other options have been quite interesting as well. .... my case is case (c) a vServer and there no LSM available and no `/proc/comdline` and no `dmesg` information. vServer seem to suck :(. Thanks for the answer! – humanityANDpeace Mar 02 '14 at 17:39
0

Another thing you can do is search for built-in modules under /sys/module.

E.g., on Ubuntu 16.04 which has apparmor enabled, the following directory exists:

/sys/module/apparmor/

See also: https://superuser.com/questions/287371/obtain-kernel-config-from-currently-running-linux-system

Unfortunately, neither ls /sys/kernel/security or ls /sys/module/ showed anything for selinux on Android AOSP in QEMU, which seems to have selinux, I wonder why.

If the kernel is build with SELinux, boot dmesg contains:

SELinux:  Initializing.
Ciro Santilli OurBigBook.com
  • 17,176
  • 4
  • 113
  • 99