Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with restricted access.

share|improve this question
    
possible duplicate of Network policies under AppArmor/SELinux –  Gilles Dec 21 '12 at 15:51
add comment

2 Answers

AppArmor has the ability to block network connections from applications. I've never done it myself, but you should look at the AppArmor community page and the network rules page for details on how to do it.

From the looks of it, the deny network directive should allow you to block all network access for an application.

share|improve this answer
    
thanks a lot, but suddenly I could not run apparmor - AppArmor not available as kernel LSM famous bug:( –  scythargon Aug 23 '12 at 10:44
add comment

If you have SELinux enabled, I was under the impression that the default action was to deny access so what you want to do is to allow network access at times, right?

I suspect that you going to have to do something like this answer on serverfault, which contains SE Linux configuration for a single process httpd and then combines that configuration with iptables to control the network access.

To add in the time aspect, there's a time module in iptables. Here's a link showing some real usage on another forum.

AppArmor has already been well-answered :)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.