SELinux and AppArmor in Plain Terms

Normal permissions let the file owner decide. Mandatory access control adds rules the owner cannot override, so a compromised service stays contained.

	CentOS and RHEL	Ubuntu
System	SELinux	AppArmor
Model	Labels on every file and process	Path-based profiles per program
Status	getenforce, sestatus	sudo aa-status

getenforce                          # Enforcing, Permissive or Disabled
sudo setenforce 0                   # temporary: Permissive, for diagnosis only
sudo ausearch -m avc -ts recent     # recent denials
sudo semanage port -a -t http_port_t -p tcp 8081   # allow a service on a new port

The usual first reaction to a permission error on CentOS is to disable SELinux. Do not. Switch to Permissive to confirm it is the cause, read the denial, and fix the label or the boolean (setsebool -P httpd_can_network_connect 1). On Ubuntu, aa-status shows which profiles are enforced.