MediumOS hardeningBLWK-KERNEL-003

No mandatory access control framework is enforcing

What this means

Neither AppArmor nor SELinux has any profile in enforcing mode. Without MAC, a compromised service runs with the full privileges of its process owner instead of being confined to what it actually needs. The enforcement_known guard matters: AppArmor's profile list is readable only with CAP_MAC_ADMIN, so an unprivileged scan on a host where AppArmor is loaded cannot see whether it's enforcing. That is reported as undetermined, not as a finding — claiming “no MAC” because we lack the privilege to look would be alarming and wrong.

How to fix it

On Debian/Ubuntu: sudo aa-enforce /etc/apparmor.d/* for the profiles you want enforced, or install apparmor-profiles.

Check it yourself

Run a scan and look for BLWK-KERNEL-003 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads mac_status and reports this check when:

any_mac_enforcing == false and enforcement_known == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 1.4

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001