Linux security primitives

This chapter follows Users, groups and permissions in Linux.

Traditional Unix security is discretionary: file owners choose permissions. Modern Linux adds mandatory layers and fine-grained privilege so services and containers run with less than root. Docker and Kubernetes rely on the same primitives—see Docker overview—without replacing host hardening on Debian itself.

Capabilities instead of full root

Capabilities split superuser powers (CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, …). setcap grants them to binaries; containers drop caps by default.

1
getcap -r /usr/bin 2>/dev/null | head

Binding port 80 as non-root can use CAP_NET_BIND_SERVICE instead of setuid root. Audit caps after custom packages—unexpected CAP_SYS_PTRACE widens attack surface.

Namespaces for isolation views

Namespaces duplicate kernel data structures so processes see different:

Namespace	Isolates
PID	Process IDs
Mount	Filesystem mount tree
Network	Interfaces, routes, iptables/nftables
UTS	Hostname
IPC	SysV IPC, POSIX mq
User	UID/GID mappings
Cgroup	cgroup hierarchy view

Containers combine namespaces with images; they are not VMs—see Linux on Windows, WSL, containers, and VMs.

cgroups for resource limits

cgroups limit and account CPU, memory, I/O, and pids. systemd places services in slices; Docker and Kubernetes set cgroup limits on containers.

1
systemd-cgtop
2
cat /proc/self/cgroup

OOM within a cgroup kills member processes, not necessarily the whole host—behavior depends on MemoryMax= on units and container runtime settings.

seccomp and syscall filtering

seccomp filters which system calls a process may invoke. Docker and systemd can apply profiles; violations fail closed (process killed) or return errors.

Profiles trade compatibility for containment—stricter filters break apps that use rare syscalls. Test after upgrades.

AppArmor on Debian and SELinux elsewhere

LSM (Linux Security Modules) adds MAC policies:

AppArmor — path-based profiles; default on Debian for many services (/etc/apparmor.d/). aa-status shows enforced profiles.
SELinux — label-based; dominant on RHEL/Fedora (getenforce).

Debian enables AppArmor profiles shipped with packages (nginx, tcpdump). Custom profiles need testing after path changes.

Profiles complement file modes: even if a process reads a file, MAC may deny it.

How containers combine the stack

A typical container runtime:

Namespaces for PID, mount, network, uts, ipc, user (optional).
cgroups for CPU/memory/pids.
Capabilities dropped; maybe seccomp profile.
Read-only root, tmpfs mounts, and MAC (AppArmor/SELinux) if configured.

Host nftables and SSH hardening still matter—the kernel is shared. Docker overview describes user-facing container workflows; this chapter is the kernel-side vocabulary.

Networking on the host stack is next: Networking on Linux.

The next chapter is Networking on Linux.