How to Switch from AppArmor to SELinux in Debian

Debian GNU/Linux relies on AppArmor as its default Mandatory Access Control (MAC) system. This guide provides a step-by-step walkthrough for replacing AppArmor with SELinux, covering package installation, AppArmor deactivation, kernel parameter adjustments, filesystem relabeling, and transitioning the system into full enforcing mode.

Step 1: Update the System and Verify Current MAC Status

Ensure all system repositories and packages are up to date, then check that AppArmor is currently running:

sudo apt update && sudo apt upgrade -y
sudo aa-status

Step 2: Install SELinux Utilities and Policies

Install the required SELinux packages, the default policy, and the audit daemon:

sudo apt install selinux-basics selinux-policy-default auditd -y

Step 3: Disable AppArmor

Stop and disable the AppArmor services to prevent conflicts with SELinux:

sudo systemctl stop apparmor
sudo systemctl disable apparmor

You can optionally remove the AppArmor packages entirely:

sudo apt purge apparmor -y

Step 4: Activate SELinux

Debian provides a helper script called selinux-activate that configures GRUB and prepares the system for initial filesystem relabeling:

sudo selinux-activate

Alternatively, you can manually configure the bootloader by appending security=selinux selinux=1 to the GRUB_CMDLINE_LINUX_DEFAULT variable in /etc/default/grub, followed by running:

sudo update-grub

Step 5: Reboot into Permissive Mode and Relabel

The initial activation sets SELinux to permissive mode and schedules a filesystem relabel on the next reboot. Reboot the system to allow the relabeling process to complete:

sudo reboot

The reboot may take significantly longer than usual depending on disk size, as SELinux contexts are applied to every file on the system.

Step 6: Verify Permissive Operation

Once the system boots, log in and verify that SELinux is active and in permissive mode:

sestatus

The output should show:

  • SELinux status: enabled
  • Current mode: permissive
  • Mode from config file: permissive

Check the audit logs for any potential denials that occurred during boot:

sudo ausearch -m avc -ts recent

Step 7: Switch to Enforcing Mode

Once satisfied that critical services operate without fatal denials, configure SELinux to enforce policies permanently.

Open the configuration file:

sudo nano /etc/selinux/config

Change the SELINUX directive:

SELINUX=enforcing
SELINUXTYPE=default

Save the file and reboot the system to apply the enforcing state:

sudo reboot

Step 8: Confirm Enforcing Status

After the final reboot, run:

getenforce

The command will return Enforcing, confirming that SELinux is now the active Mandatory Access Control system on Debian.