Linux Security Summit Europe 2026

Different LSMs have different approaches to how they implement MAC policy. This session aims to present an analysis and comparison of Apparmor and SELinux approaches by transforming their policy into a common regular language. Using finite state analysis and transitive closure to find commonalities and differences between the different types of policy.

We will discuss the approach used for the analysis, its limitations and compromises made to be able to reach a common base. Looking at the difference in policy structure, the number of rules, types, where, and how they overlap and differ. Examining the different types of policies, in both a static and dynamic capacity.