Question: Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience?

Not a lab test, not a white paper, not a best practice, not a CERT advisory, but a real example, something like audit2why showing a real hacking attempt stopped in its tracks?

(If you have no example, please keep commentary in comments instead of Answers.)

Thanks!

Answer: 
How about this from [Russell Coker](http://www.coker.com.au/selinux/play.html)? It is a real life example as he has invited everyone onto his machine as root. At first glance I thought this was nuts but then you realize the power of SELinux to make root somewhat useless.

Here are some real life [examples](http://doc.coker.com.au/computers/se-linux-saves/) from his site.
SELinux isn't necessarily about protection from hackers; it's about documenting and enforcing policy for how a system behaves. It's a tool in the toolbox that is valuable, but requires skill to use well.

A real life example of how it saves you is something like this:

> 
> A vulnerability in an FTP daemon
>  allows an anonymous user to gain root
>  privileges. An attacker uses that
>  vulnerability to access user home
>  directories and steal SSH private
>  keys, some of which do not have a
>  passphrase.
> 
> 
> 

---

If SELinux is configured to disallow the "Allow ftp services to read and write files in user home directories" policy, the exploit would not be successful, and the policy violation would be logged.