Phase 8: Security
Linux security is built in layers. The kernel has mandatory access control (SELinux, AppArmor), audit logging, privilege separation mechanisms, and cryptographic trust chains from boot onward. Understanding these mechanisms is essential whether you're hardening a server, investigating an incident, or building secure software.
What You'll Learn
1. Linux Security Modules
The LSM framework — how SELinux and AppArmor hook into the kernel.
Advanced2. SELinux
Type enforcement, policies, labels, and how to read AVC denials.
Advanced3. AppArmor
Path-based MAC for Ubuntu and containers — profiles and modes.
Intermediate4. auditd
Kernel audit subsystem — logging file access, system calls, and logins.
Intermediate5. sudo Internals
How sudo works: setuid, PAM authentication, and sudoers rules.
Intermediate6. SUID & SGID
How setuid programs work, privilege escalation risks, and auditing.
Intermediate7. Linux Keyring
Kernel key management for credentials, encryption keys, and secrets.
Advanced8. Secure Boot
How UEFI Secure Boot verifies the bootloader and kernel cryptographically.
Advanced