Move an AppArmor profile from complain to enforce with evidence
AppArmor applies path-based rules from a loaded profile; complain logs would-be denials while enforce blocks them.
Add a Linux audit rule that produces useful evidence without flooding
Audit rules select kernel events by syscall, path, fields, and key; ordering and never rules can suppress later matches.
Replace setuid root with the narrow Linux capability actually required
Capabilities divide traditional root privilege into independently checked units that can be attached to a file or bounded in a service process.
Set a service umask without assuming it repairs existing files
Umask removes permission bits during creation; it does not change existing objects and applications can request narrower modes afterward.
Back up and validate an nftables ruleset before firewall changes
Nft list ruleset emits the active rules in restorable syntax, but runtime-generated state and surrounding network dependencies still need separate evidence.
Configure pam_faillock without locking out every administrator
Pam_faillock records failed authentication events and PAM stack placement determines preauth, authfail, account enforcement, reset, and local-user behavior.
Repair SELinux file contexts persistently with semanage and restorecon
SELinux path labeling policy maps pathname patterns to expected contexts; restorecon applies that policy while chcon creates a local label that relabeling may erase.
Trace sudoers include order with visudo before changing privilege
Sudo reads its main policy and included files in lexical or directive order; the last matching tag and command rules can change effective authorization.
Apply Linux sysctl hardening with precedence and runtime verification
Sysctl settings come from kernel defaults and ordered configuration sources; loading one file can differ from the complete boot-time merge.
Use systemd-analyze security to guide service hardening
Systemd-analyze security inspects configured sandbox properties and reports an exposure score, but it cannot infer application requirements or every kernel boundary.