umbermark-cli 1.0.0rc1__py3-none-any.whl

umbermark/checks/firewall_protective.py

@@ -0,0 +1,247 @@
+"""Host firewall — must have a *protective* input policy, not just NAT rules.
+
+Distinguishes Docker-installed NAT chains from real INPUT-chain protection.
+The v0.2 implementation was naive — any nftables chains counted as 'firewalled',
+which produced PASS verdicts on every Docker host. This version requires a
+filter-hook input chain with drop/reject policy and at least one accept rule,
+or an iptables INPUT policy of DROP/REJECT with explicit accept rules.
+
+firewalld (RHEL/Rocky/Alma default, UMBR-30) is judged from its own zone model
+rather than the ruleset it generates: firewalld's nft base chain has *policy
+accept* and ends in an unconditional reject, and `iptables -S` on iptables-nft
+shows only the empty compat table, so the ruleset heuristics below would call a
+correctly firewalled RHEL host unprotected.
+"""
+from __future__ import annotations
+
+import re
+from typing import Callable
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.firewall import is_loopback_iface, is_overlay_iface, sources_are_private
+from umbermark.core.ssh import CommandRunner
+
+# firewalld commands. Issued unconditionally once ufw is ruled out so the Tier-2
+# capture enumeration (all-failing runner) records every one of them.
+C_FWD_STATE = "firewall-cmd --state 2>/dev/null"
+C_FWD_DEFAULT = "firewall-cmd --get-default-zone 2>/dev/null"
+C_FWD_ZONES = "firewall-cmd --list-all-zones 2>/dev/null"
+
+# Interfaces whose inbound traffic originates on this host (container / VM
+# bridges). Docker >= 20.10 binds docker0 + br-<id> to an ACCEPT-target "docker"
+# zone and libvirt binds virbr* to an ACCEPT-target "libvirt" zone by design.
+_LOCAL_BRIDGE_RX = re.compile(r"^(docker\d*|br-[0-9a-f]{12}|virbr\d+|cni\d*|podman\d*|veth\w*)$")
+
+
+class FirewallProtectiveCheck(Check):
+    id = "firewall_protective"
+    title = "Host firewall has protective input rules"
+    category = "network"
+    severity = Severity.CRITICAL
+    weight = 20
+    applicable_distros = ()  # universal
+    remediation = (
+        "Enable a host firewall that actually drops unsolicited inbound traffic.\n"
+        "For Ubuntu/Debian with ufw:\n"
+        "    sudo ufw default deny incoming\n"
+        "    sudo ufw allow OpenSSH\n"
+        "    sudo ufw enable\n"
+        "For RHEL/Rocky with firewalld:\n"
+        "    sudo systemctl enable --now firewalld\n"
+        "    sudo firewall-cmd --set-default-zone=public\n"
+        "Docker-installed NAT/FORWARD rules do not constitute host protection;\n"
+        "the INPUT chain must have a DROP/REJECT policy with explicit accept\n"
+        "rules for the services you intend to expose."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        # 1) Prefer ufw if it's active (Debian/Ubuntu default).
+        r = runner.run("ufw status 2>/dev/null", sudo=True)
+        if r.ok and r.stdout.strip():
+            head = r.stdout.strip().splitlines()[0].lower()
+            if re.search(r"\bactive\b", head):
+                return self._finding(Verdict.PASS, evidence="ufw status: active")
+
+        # Rulesets are read up front: the firewalld verdict is only trusted
+        # when they show firewalld's rules are actually loaded.
+        r2 = runner.run("nft list ruleset 2>/dev/null", sudo=True)
+        r3 = runner.run("iptables -S 2>/dev/null", sudo=True)
+
+        # 2) firewalld — judge the zone model it enforces, provided its rules are
+        # really in the kernel. `firewall-cmd --state` keeps saying "running"
+        # after the whole ruleset is wiped (e.g. nftables.service loading a config
+        # that starts by clearing everything), which would be a false PASS.
+        state = runner.run(C_FWD_STATE, sudo=True)
+        default = runner.run(C_FWD_DEFAULT, sudo=True)
+        zones = runner.run(C_FWD_ZONES, sudo=True)
+        if (state.ok and state.stdout.strip() == "running" and zones.ok
+                and _firewalld_rules_loaded(r2, r3)):
+            builder = _verdict_from_firewalld(
+                default.stdout.strip() if default.ok else "", zones.stdout
+            )
+            if builder is not None:
+                return builder(self)
+
+        # 3) nftables — protective input chain check.
+        if r2.ok and r2.stdout.strip():
+            builder = _verdict_from_nftables(r2.stdout)
+            if builder is not None:
+                return builder(self)
+
+        # 4) iptables (legacy).
+        if r3.ok and r3.stdout.strip():
+            builder = _verdict_from_iptables(r3.stdout)
+            if builder is not None:
+                return builder(self)
+
+        return self._finding(
+            Verdict.FAIL,
+            evidence="no protective host firewall detected (ufw inactive, no protective INPUT chain in nftables/iptables)",
+        )
+
+
+def _firewalld_rules_loaded(nft, ipt) -> bool:
+    """Do the rulesets show firewalld's rules (nft backend: `table inet firewalld`;
+    iptables backend: *_ZONES chains)? If neither ruleset could be read at all we
+    cannot contradict firewall-cmd, so trust it; a readable ruleset without
+    firewalld's rules means they were wiped and nothing enforces the zones.
+    """
+    nft_text = nft.stdout if nft.ok else ""
+    ipt_text = ipt.stdout if ipt.ok else ""
+    if "table inet firewalld" in nft_text or "INPUT_ZONES" in nft_text or "INPUT_ZONES" in ipt_text:
+        return True
+    return not nft.ok and not ipt.ok
+
+
+def _parse_firewalld_zones(text: str) -> dict[str, dict[str, str]]:
+    """Parse `firewall-cmd --list-all-zones` into {zone: {key: value, ...}}.
+
+    Zone headers are unindented ("public (default, active)" on firewalld >= 0.9,
+    "public (active)" on 0.6); attributes are indented "key: value" lines. The
+    header flags are stored under the pseudo-key "_flags".
+    """
+    zones: dict[str, dict[str, str]] = {}
+    current: dict[str, str] | None = None
+    for line in text.splitlines():
+        if not line.strip():
+            continue
+        if not line[0].isspace():
+            m = re.match(r"^(\S+)(?:\s+\(([^)]*)\))?\s*$", line)
+            if not m:
+                current = None
+                continue
+            current = {"_flags": (m.group(2) or "").replace(" ", "")}
+            zones[m.group(1)] = current
+        elif current is not None:
+            key, sep, value = line.strip().partition(":")
+            if sep and key not in current:
+                current[key] = value.strip()
+    return zones
+
+
+def _verdict_from_firewalld(default_zone: str, text: str) -> Callable[[Check], Finding] | None:
+    """Verdict from firewalld's zones, or None (fall through) if they're unreadable.
+
+    The default zone handles every interface not bound elsewhere, so its target
+    decides the public posture: "default" (reject), REJECT/%%REJECT%% and DROP
+    are protective; ACCEPT is "trusted" = no firewall. Any *other* zone with an
+    ACCEPT target that is bound to a public-looking interface, or to sources that
+    are not all private, also opens the host. ACCEPT zones bound only to loopback,
+    VPN overlays or local container/VM bridges are fine.
+    """
+    zones = _parse_firewalld_zones(text)
+    if not zones:
+        return None
+    flagged_default = [n for n, z in zones.items() if "default" in z["_flags"].split(",")]
+    default_zone = default_zone or (flagged_default[0] if flagged_default else "")
+    if default_zone not in zones:
+        return None
+
+    problems: list[str] = []
+    for name, z in zones.items():
+        if z.get("target", "").upper() != "ACCEPT":
+            continue
+        if name == default_zone:
+            problems.append(f"default zone '{name}' has target ACCEPT (accepts all inbound)")
+            continue
+        ifaces = z.get("interfaces", "").split()
+        exposed = [i for i in ifaces if not (
+            is_loopback_iface(i) or is_overlay_iface(i) or _LOCAL_BRIDGE_RX.match(i))]
+        if exposed:
+            problems.append(f"zone '{name}' (target ACCEPT) bound to {', '.join(exposed)}")
+        sources = z.get("sources", "").split()
+        if sources and not sources_are_private(sources):
+            problems.append(f"zone '{name}' (target ACCEPT) bound to sources {' '.join(sources)}")
+    if problems:
+        return lambda self: self._finding(
+            Verdict.FAIL, evidence="firewalld running but " + "; ".join(problems),
+        )
+    dz = zones[default_zone]
+    services = dz.get("services", "") or "none"
+    ports = dz.get("ports", "")
+    detail = f"services: {services}" + (f"; ports: {ports}" if ports else "")
+    return lambda self: self._finding(
+        Verdict.PASS,
+        evidence=(f"firewalld running; default zone '{default_zone}' "
+                  f"(target {dz.get('target', 'default')}, unmatched inbound rejected); {detail}"),
+    )
+
+
+def _verdict_from_nftables(text: str) -> Callable[[Check], Finding] | None:
+    """Inspect nftables ruleset; return a Finding-builder, or None to fall through.
+
+    Looks for any 'chain X { type filter hook input ... }' with a drop/reject
+    policy and at least one non-policy rule. Distinguishes Docker-only NAT
+    output (where INPUT-hook chains either don't exist or have ACCEPT policy).
+    """
+    # Match every chain block. Use DOTALL because nftables output is multi-line per chain.
+    chains = re.findall(r"chain\s+\S+\s*\{([^}]*?)\}", text, re.DOTALL)
+    has_protective_input = False
+    has_docker_table = "DOCKER" in text or "table ip nat" in text
+    for body in chains:
+        if not re.search(r"type\s+filter\s+hook\s+input", body):
+            continue
+        policy_match = re.search(r"policy\s+(\w+)", body)
+        policy = policy_match.group(1).lower() if policy_match else "accept"
+        # Count rules that aren't the policy or type lines.
+        rule_lines = [
+            ln.strip()
+            for ln in body.splitlines()
+            if ln.strip()
+            and not ln.strip().startswith(("type ", "policy", "#"))
+        ]
+        if policy in ("drop", "reject") and len(rule_lines) >= 1:
+            has_protective_input = True
+            break
+    if has_protective_input:
+        return lambda self: self._finding(
+            Verdict.PASS,
+            evidence="nftables: protective input chain (drop/reject policy + explicit accepts)",
+        )
+    if has_docker_table:
+        return lambda self: self._finding(
+            Verdict.FAIL,
+            evidence="nftables: only docker NAT/forward rules present, no protective INPUT chain",
+        )
+    return None
+
+
+def _verdict_from_iptables(text: str) -> Callable[[Check], Finding] | None:
+    """Inspect iptables -S output for INPUT policy + rules."""
+    policy_match = re.search(r"^-P\s+INPUT\s+(\w+)", text, re.M)
+    policy = policy_match.group(1).upper() if policy_match else "ACCEPT"
+    rule_count = len(re.findall(r"^-A\s+INPUT\s", text, re.M))
+    if policy in ("DROP", "REJECT") and rule_count >= 1:
+        return lambda self: self._finding(
+            Verdict.PASS,
+            evidence=f"iptables: INPUT policy {policy}, {rule_count} accept rules",
+        )
+    if rule_count == 0 and policy == "ACCEPT":
+        return lambda self: self._finding(
+            Verdict.FAIL,
+            evidence="iptables: INPUT policy ACCEPT with no rules",
+        )
+    return lambda self: self._finding(
+        Verdict.FAIL,
+        evidence=f"iptables: INPUT policy {policy}, {rule_count} rules (no protective config)",
+    )

umbermark/checks/journald_persistence.py

@@ -0,0 +1,55 @@
+"""journald persistence — logs survive reboot."""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class JournaldPersistenceCheck(Check):
+    id = "journald_persistence"
+    title = "journald configured for persistent storage"
+    category = "logging"
+    severity = Severity.MEDIUM
+    weight = 4
+    applicable_distros = ()
+    remediation = (
+        "Enable persistent journald logs (survive reboots, valuable for incident response):\n"
+        "    sudo mkdir -p /var/log/journal\n"
+        "    sudo systemd-tmpfiles --create --prefix /var/log/journal\n"
+        "    sudo systemctl restart systemd-journald\n"
+        "Or set explicitly in /etc/systemd/journald.conf:\n"
+        "    [Journal]\n"
+        "    Storage=persistent"
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        # /var/log/journal existing means journald is persistent regardless of conf
+        rdir = runner.run("[ -d /var/log/journal ] && echo yes || echo no", timeout=5)
+        if rdir.ok and rdir.stdout.strip() == "yes":
+            return self._finding(
+                Verdict.PASS, evidence="/var/log/journal exists (logs are persistent)"
+            )
+        # Otherwise inspect journald.conf for explicit Storage=persistent
+        rconf = runner.run(
+            "grep -E '^[[:space:]]*Storage' /etc/systemd/journald.conf 2>/dev/null",
+            timeout=5,
+        )
+        if rconf.ok and rconf.stdout:
+            m = re.search(r"Storage\s*=\s*(\w+)", rconf.stdout)
+            if m:
+                storage = m.group(1).lower()
+                if storage == "persistent":
+                    return self._finding(
+                        Verdict.PASS,
+                        evidence="journald.conf Storage=persistent",
+                    )
+                return self._finding(
+                    Verdict.WARN,
+                    evidence=f"journald.conf Storage={storage} (volatile/auto/none — logs lost on reboot)",
+                )
+        return self._finding(
+            Verdict.WARN,
+            evidence="journald storage unconfigured (default Storage=auto means volatile if /var/log/journal absent)",
+        )

umbermark/checks/kernel_age.py

@@ -0,0 +1,74 @@
+"""Kernel age — derived from build timestamp in /proc/version."""
+from __future__ import annotations
+
+import re
+from datetime import datetime, timezone
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class KernelAgeCheck(Check):
+    id = "kernel_age"
+    title = "Kernel age (running an up-to-date kernel)"
+    category = "patching"
+    severity = Severity.HIGH
+    weight = 12
+    remediation = (
+        "Update the kernel and reboot:\n"
+        "    sudo apt update && sudo apt upgrade   # Debian/Ubuntu\n"
+        "    sudo dnf upgrade                       # RHEL-like\n"
+        "    sudo reboot\n"
+        "Confirm afterward with `uname -r`."
+    )
+
+    @staticmethod
+    def _parse_build_date(text: str) -> datetime | None:
+        # ctime-style: "Wed Apr 19 08:22:18 UTC 2023"
+        m = re.search(
+            r"\b([A-Z][a-z]{2})\s+([A-Z][a-z]{2})\s+(\d{1,2})\s+\d{2}:\d{2}:\d{2}\s+\S+\s+(\d{4})\b",
+            text,
+        )
+        if m:
+            try:
+                return datetime.strptime(
+                    f"{m.group(2)} {m.group(3)} {m.group(4)}", "%b %d %Y"
+                ).replace(tzinfo=timezone.utc)
+            except ValueError:
+                pass
+        # Debian-style: "(2024-11-01)"
+        m2 = re.search(r"\((\d{4})-(\d{2})-(\d{2})\)", text)
+        if m2:
+            try:
+                return datetime(
+                    int(m2.group(1)),
+                    int(m2.group(2)),
+                    int(m2.group(3)),
+                    tzinfo=timezone.utc,
+                )
+            except ValueError:
+                pass
+        return None
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run("cat /proc/version 2>/dev/null")
+        if not r.ok or not r.stdout.strip():
+            return self._finding(
+                Verdict.SKIP, skip_reason="could not read /proc/version"
+            )
+        text = r.stdout.strip()
+        build_date = self._parse_build_date(text)
+        if build_date is None:
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason=f"could not parse kernel build date from /proc/version: {text[:120]!r}",
+            )
+        age_days = (datetime.now(timezone.utc) - build_date).days
+        evidence = f"kernel built {build_date.date()}, age {age_days} days"
+        if age_days > 540:
+            return self._finding(Verdict.FAIL, evidence=evidence + " (>18mo)")
+        if age_days > 365:
+            return self._finding(Verdict.FAIL, evidence=evidence + " (>12mo)")
+        if age_days > 180:
+            return self._finding(Verdict.WARN, evidence=evidence + " (>6mo)")
+        return self._finding(Verdict.PASS, evidence=evidence)

umbermark/checks/listen_vs_firewall_delta.py

@@ -0,0 +1,136 @@
+"""Public LISTEN sockets that the host firewall exposes without an explicit allow rule.
+
+Catches the 'service is listening on 0.0.0.0 and the firewall is misconfigured
+so it actually IS reachable' class of bug. Complements public_listen_anomalies
+(which checks against a static allow-list).
+
+Verdicts follow the firewall's real behaviour (core.firewall parses nft sets,
+iifname scoping, jumps and base-chain policy, iptables and ufw):
+
+* a LISTEN port the firewall drops (by policy or rule) is NOT exposed: PASS.
+  A default-drop policy is the desired state, never something to "fix".
+* a port accepted by an explicit allow rule is deliberately exposed: PASS.
+* a port accepted only because the chain policy is accept (no rule says so)
+  is drift: that is what this check flags.
+
+When no firewall is readable, or it does nothing for any listening port,
+SKIPs and points at firewall_protective.
+"""
+from __future__ import annotations
+
+from umbermark.core.access import C_SS, get_access_context
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.firewall import Exposure
+from umbermark.core.ssh import CommandRunner
+
+
+def _public_listen_ports(ss_output: str) -> set[int]:
+    """Parse `ss -tln` LISTEN lines bound to 0.0.0.0 / * / :: -> port set."""
+    ports: set[int] = set()
+    for line in ss_output.splitlines():
+        if not line.startswith("LISTEN"):
+            continue
+        cols = line.split()
+        if len(cols) < 4:
+            continue
+        local = cols[3]
+        if local.startswith(("0.0.0.0:", "*:", "[::]:", ":::")):
+            tail = local.rsplit(":", 1)[-1]
+            if tail.isdigit():
+                ports.add(int(tail))
+    return ports
+
+
+class ListenVsFirewallDeltaCheck(Check):
+    id = "listen_vs_firewall_delta"
+    title = "Public LISTEN sockets are not exposed by a default-accept firewall"
+    category = "network"
+    severity = Severity.HIGH
+    weight = 12
+    applicable_distros = ()
+    remediation = (
+        "Switch the firewall to default-deny. These public ports are open only because\n"
+        "the default policy is accept, not because a rule allows them:\n"
+        "  1. Set the input policy to drop/deny (ufw: `ufw default deny incoming`;\n"
+        "     nftables: `policy drop;` on the input hook chain), then add explicit\n"
+        "     allow rules ONLY for services meant to be public.\n"
+        "  2. Or stop the service listening publicly: bind it to 127.0.0.1\n"
+        "     (e.g. postgresql `listen_addresses = '127.0.0.1'`).\n"
+        "Do not open ports to make this check pass; a LISTEN port that the firewall\n"
+        "drops is the desired state."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        ctx = get_access_context(runner)
+        raw = ctx.raw.get(C_SS.command)
+        if raw is None or not raw.ok or not raw.stdout.strip():
+            return self._finding(
+                Verdict.SKIP, skip_reason="ss -tln produced no output"
+            )
+        listen_ports = _public_listen_ports(raw.stdout)
+        if not listen_ports:
+            return self._finding(
+                Verdict.PASS, evidence="no public LISTEN sockets to cross-check"
+            )
+
+        fw = ctx.firewall
+        if not fw.readable:
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason="no protective firewall to compare against (see firewall_protective)",
+            )
+
+        unguarded: list[int] = []
+        allowed: list[int] = []
+        blocked: list[int] = []
+        dnat_risk: list[int] = []
+        for port in sorted(listen_ports):
+            v = fw.evaluate(port, "tcp")
+            if v.state == Exposure.BLOCKED:
+                if ctx.dnat_suspect(port):
+                    dnat_risk.append(port)  # INPUT drop is not proof: DNAT bypasses INPUT
+                else:
+                    blocked.append(port)
+            elif v.state == Exposure.ACCEPTED and not v.explicit:
+                unguarded.append(port)
+            else:  # explicit allow rule, or accepted only for specific sources
+                allowed.append(port)
+
+        if not (blocked or allowed or dnat_risk):
+            # The firewall demonstrably does nothing for any listening port
+            # (no rules, or accept-all): that is firewall_protective's finding.
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason="no protective firewall to compare against (see firewall_protective)",
+            )
+
+        summary = (
+            f"{len(allowed)} allowed by explicit rule {allowed}, "
+            f"{len(blocked)} blocked by firewall (not exposed) {blocked}"
+        )
+        if dnat_risk:
+            summary += (
+                f"; {dnat_risk} dropped by INPUT but DNAT / port-publishing evidence "
+                f"({'; '.join(ctx.dnat_evidence[:3]) or 'unknown'}) means they may still be reachable via FORWARD"
+            )
+        if not unguarded and dnat_risk:
+            return self._finding(
+                Verdict.WARN,
+                evidence=f"INPUT drop is not proof of non-exposure (DNAT): {summary}",
+                remediation=(
+                    "Published container ports (Docker, rootful podman) are DNAT-ed and bypass the INPUT\n"
+                    "chain. Restrict them where they are published: bind to 127.0.0.1 (-p 127.0.0.1:PORT:PORT),\n"
+                    "or filter in the DOCKER-USER / forward hook chain."
+                ),
+            )
+        if not unguarded:
+            return self._finding(Verdict.PASS, evidence=f"{len(listen_ports)} public LISTEN sockets: {summary}")
+        if len(unguarded) <= 2:
+            return self._finding(
+                Verdict.WARN,
+                evidence=f"public LISTEN ports exposed only by default-accept policy: {unguarded} ({summary})",
+            )
+        return self._finding(
+            Verdict.FAIL,
+            evidence=f"{len(unguarded)} public LISTEN ports exposed only by default-accept policy (first 6: {unguarded[:6]}) ({summary})",
+        )

umbermark/checks/mac_framework_enforcing.py

@@ -0,0 +1,97 @@
+"""Mandatory Access Control framework — AppArmor (Debian) or SELinux (RHEL).
+
+Both frameworks reduce the blast radius of a compromised process by constraining
+which files / network sockets / capabilities it can touch. Disabling them is a
+common 'just make it work' shortcut that drops the host's defense in depth.
+"""
+from __future__ import annotations
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class MacFrameworkEnforcingCheck(Check):
+    id = "mac_framework_enforcing"
+    title = "Mandatory access control (AppArmor / SELinux) enforcing"
+    category = "hardening"
+    severity = Severity.HIGH
+    weight = 10
+    applicable_distros = ()
+    remediation = (
+        "Re-enable the distro's MAC framework. On Debian/Ubuntu:\n"
+        "    sudo systemctl enable --now apparmor\n"
+        "    sudo aa-enforce /etc/apparmor.d/*\n"
+        "On RHEL/Rocky/Alma:\n"
+        "    sudo setenforce 1                         # immediate\n"
+        "    sudo sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config\n"
+        "    sudo reboot                                # makes it persistent\n"
+        "Both frameworks have a 'complain' (AppArmor) / 'permissive' (SELinux)\n"
+        "mode that logs but doesn't block — useful for diagnosis, NOT for production."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        # AppArmor: `aa-status --enabled` exits 0 if enabled. Parse `aa-status` text
+        # output for the profile counts.
+        rapp = runner.run("aa-status 2>/dev/null", sudo=True, timeout=5)
+        if rapp.ok and rapp.stdout:
+            txt = rapp.stdout
+            if "apparmor module is loaded" in txt.lower() or "profiles are loaded" in txt.lower():
+                # Look for "X profiles are in enforce mode" line
+                lines = [ln.strip() for ln in txt.splitlines()]
+                enforced = _extract_int(lines, "in enforce mode")
+                complain = _extract_int(lines, "in complain mode")
+                if enforced is None:
+                    return self._finding(
+                        Verdict.SKIP,
+                        skip_reason="aa-status output unparseable",
+                    )
+                if enforced == 0 and (complain or 0) == 0:
+                    return self._finding(
+                        Verdict.FAIL,
+                        evidence="AppArmor loaded but 0 profiles in enforce or complain mode",
+                    )
+                if enforced == 0 and (complain or 0) > 0:
+                    return self._finding(
+                        Verdict.WARN,
+                        evidence=f"AppArmor: 0 enforcing, {complain} complaining (logs only, no block)",
+                    )
+                return self._finding(
+                    Verdict.PASS,
+                    evidence=f"AppArmor: {enforced} profiles enforcing, {complain or 0} complaining",
+                )
+            if "apparmor module is not loaded" in txt.lower():
+                return self._finding(
+                    Verdict.FAIL, evidence="AppArmor module not loaded"
+                )
+
+        # SELinux: `getenforce` outputs Enforcing / Permissive / Disabled.
+        rse = runner.run("getenforce 2>/dev/null", timeout=5)
+        if rse.ok and rse.stdout.strip():
+            state = rse.stdout.strip()
+            if state == "Enforcing":
+                return self._finding(Verdict.PASS, evidence="SELinux: Enforcing")
+            if state == "Permissive":
+                return self._finding(
+                    Verdict.WARN, evidence="SELinux: Permissive (logs but does not block)"
+                )
+            if state == "Disabled":
+                return self._finding(Verdict.FAIL, evidence="SELinux: Disabled")
+            return self._finding(
+                Verdict.SKIP, skip_reason=f"unknown SELinux state: {state!r}"
+            )
+
+        return self._finding(
+            Verdict.SKIP,
+            skip_reason="neither aa-status (AppArmor) nor getenforce (SELinux) responded",
+        )
+
+
+def _extract_int(lines: list[str], needle: str) -> int | None:
+    for ln in lines:
+        if needle in ln:
+            # Lines look like "  N profiles are in enforce mode."
+            tokens = ln.split()
+            for t in tokens:
+                if t.isdigit():
+                    return int(t)
+    return None