linux-security-analysis
Installation
SKILL.md
Linux Security Analysis
Distro support
Two-family skill. The 10-layer audit applies to both families; some layers inspect different tools. The body uses Debian/Ubuntu; substitute per this matrix.
| Audit layer | Debian/Ubuntu | RHEL family |
|---|---|---|
| Mandatory access control | AppArmor aa-status (profiles loaded/enforced) |
SELinux getenforce must be Enforcing; sestatus |
| Firewall | ufw status |
firewall-cmd --list-all |
| Installed packages | dpkg -l, apt list --installed |
rpm -qa, dnf list installed |
| Pending updates | apt list --upgradable |
dnf check-update |
| Auto updates | unattended-upgrades configured |
dnf-automatic.timer active |
| Sudo group membership | sudo group |
wheel group |
| Audit daemon | auditd |
auditd (also surfaces SELinux AVC denials) |