Securing AI Model Deployments with SELinux

Blocked

Artificial intelligence (AI) model deployments are increasingly targeted by attackers aiming to steal sensitive data, tamper with models, or exploit computational resources. Security-Enhanced Linux (SELinux), a mandatory access control (MAC) framework, offers robust protection beyond traditional discretionary access control (DAC). In this article, we investigate the effectiveness of SELinux in securing AI workloads on Red Hat Enterprise Linux (RHEL) 9 through experiments simulating real-world attack scenarios. Our objectives are to evaluate the Linux security module's ability to prevent unauthorized model modification, workload execution, data theft, and directory tampering.

Prior studies have explored SELinux for securing enterprise systems [1], but its application to AI deployments remains under explored. Research on AI security highlights vulnerabilities in model files and compute resources [2]. Our work bridges this gap by demonstrating the role that SELinux can play in protecting AI systems.

Methodology

Experiments were conducted on RHEL 9, a modern enterprise-grade platform. We deployed an 18-layer convolutional neural network (CNN; ResNet-18) model (PyTorch) with a Flask API and simulated attacks under two conditions: SELinux in permissive mode (relying on DAC) and enforcing mode (with MAC). Attack scenarios included unauthorized model modification, workload execution, file theft, and directory tampering. SELinux policies assigned specific roles (e.g., staff_u) and file contexts (e.g., public_content_t).

Unauthorized AI Model Modification

The objective was to evaluate SELinux's ability to prevent unauthorized modification of deployed AI model files. A ResNet-18 model was stored at /app/model.pth on RHEL 9. Two environments were tested: without SELinux (permissive mode, default DAC permissions 644) and with SELinux (enforcing mode, /app assigned public_content_t context).

In the attack simulation, a non-root user (testuser) attempts to modify the model file with the command:

echo "Malicious Code" >> /app/model.pth

Without SELinux, modification succeeded. The model was compromised, potentially causing API failures. With SELinux, modification was blocked, model integrity was preserved, and access vector cache (AVC) denial logs were generated (Figure 1).

SELinux policies can be configured to secure AI model deployments (Figure 1). Its MAC policy ensures strong protection against unauthorized model modifications.

Unauthorized AI Workload Execution

The second objective was to assess SELinux's ability to block unauthorized execution of AI-related workloads. A fake script (fake_train.py) was placed in /home/testuser/ under the user_home_t context. Two environments were tested: without SELinux (permissive mode) and with SELinux (enforcing mode, user mapped to staff_u).

In the attack simulation, a fake training script was created,

echo "while True: print('Fake training...')" >/home/testuser/fake_train.py
chmod +x /home/testuser/fake_train.py

and an attempt was made to execute it:

python3 /home/testuser/fake_train.py

Without SELinux, execution was unrestricted, and the script consumed resources. With SELinux, execution was blocked and AVC denials were logged, verified by audit logs,

sudo ausearch -m avc -ts recent
<example denial>
avc: denied { execute } for path="/home/testuser/fake_train.py" scontext=... tcontext=...

SELinux prevented unauthorized workload execution and resource exploitation by unauthorized processes (Figure 2).

Sensitive File Protection: AI Model Theft

In this experiment, we evaluated SELinux's ability to protect AI model files from unauthorized reading or copying. The model file /app/model.pth was used under similar environments during access attempts:

cp /app/model.pth /tmp/
cat /app/model.pth

Without SELinux, access succeeded, allowing the model to be copied and read. With SELinux, access failed with permission denied, verified by:

sudo ausearch -m avc -ts recent
<example denial>
avc: denied { read } for path="/app/model.pth" scontext=... tcontext=...

Therefore, SELinux prevents unauthorized access to sensitive model files (Figure 3) and effectively prevents unauthorized data exfiltration.

AI Model Directory Integrity

In an attempt to test SELinux's enforcement of directory integrity to prevent model tampering, model files were placed under /home/ai_user/app/, owned by unconfined_u. A lower privileged attack was attempted:

mv model.pt stolen.pt
rm model.pt
echo "malicious data" >> model.pt

Without SELinux, operations succeeded, and with SELinux, they failed, with strong access controls enforced on directories and files, demonstrating that SELinux enforces directory integrity (Figure 4).

Container Escape Tests with Podman and SELinux

The next test environment used Podman on RHEL 9, enforcing SELinux's targeted policy. A simple Flask app was containerized with vulnerable settings: a --privileged flag and volume mount -v /etc:/host-etc.

In test 1, SELinux set up in permissive mode,

sudo setenforce 0
sudo podman run --privileged -v /etc:/host-etc flask-app
sudo podman exec -it flask-container bash
cat /host-etc/shadow
echo "malicious" >> /host-etc/hosts

demonstrated container escape without SELinux enforcement. The host files were read and modified successfully, so without enforcement, container boundary protections were bypassed (Figure 5).

In test 2, SELinux was set up in enforcing mode (Figure 6),

sudo setenforce 1
sudo podman run --privileged -v /etc:/host-etc flask-app
sudo podman exec -it flask-container bash
cat /host-etc/shadow

to assess SELinux's ability to block container escapes. As a result, SELinux mitigated container escape risks, but partial escape was still possible in some cases (Figure 7).

SELinux mitigates many escape vectors, but --privileged usage can bypass even MAC controls. Further hardening, for example,

podman run --security-opt label=type:container_confined_t

is recommended.

Conclusion

SELinux plays a vital role in fortifying the security posture of AI model deployments, particularly in production environments where confidentiality, integrity, and availability are critical. Our experiments demonstrate that by enforcing mandatory access control, SELinux effectively blocks unauthorized model modification, prevents sensitive data exfiltration, ensures the integrity of AI workload directories, and mitigates resource exploitation attempts (Table 1).

Notably, even under aggressive attack scenarios, SELinux enforcement successfully denied malicious activities that traditional discretionary access control mechanisms failed to contain, as analyzed for SELinux policy consistency and enforcement [3]. Container escape tests highlighted that although container runtime security remains a challenging domain, SELinux substantially reduces the risk of host compromise when properly configured, especially when combined with best practices like avoiding privileged container flags.

Deploying AI systems in environments with SELinux enforcing mode enabled leads to a tangible improvement in overall security resilience. It is strongly recommended that AI models, particularly those handling proprietary or sensitive information, be hosted in hardened environments where SELinux or equivalent MAC frameworks are rigorously implemented. Future work could involve tailoring SELinux policies further for AI-specific contexts to achieve a more fine-grained balance between security and operational flexibility.