Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

(For example) I want to restrict write access to /home/backup from anybody, except a particular backup script. (To protect from accidental deletion.) For this, I suppose, it is enough to have two domains: <kernel> and </usr/bin/backup-script>. And I need to enable for <kernel> access to everything except write access to /home/backup. How to do that exception? I don't see exclusion rules in TOMOYO policy specification, and the general ideology of TOMOYO is only granting access, not forbidding.

share|improve this question

Acutally no need to exclude kernel. You can tell though files /home/backup/\*{\*}\* may only be changed if domain "<kernel> /usr/bin/backup-script" does access.

relevant links from Tomoyo Guide:

share|improve this answer
Problem is how to forbid other processes (besides backup) write access to backup data. All processes should have full access anywhere except /home/backup/\*{\*}\*. There is no problem allowing access to backup data for backup script, since in TOMOYO you granting accesss (and only granting). – catpnosis Dec 22 '12 at 20:31
If you apply and Enforce a policy for a specific domain you will achive exaclty what you want. Sorry cant explain better -.- – rhasti Dec 22 '12 at 21:01
I need to restrict <kernel> do you understand that? I can not just add /\*{\*}\* and exclude /home/backup/\*{\*}\*, I should only add all dirs, excluding /home/\*{\*}\*, than in /home I should explicitly add every dirs of users, except /home/backup/\*{\*}\*. That is tons of rules already. And then every time I add user I should add rule for him. All that fun because TOMOYO is lacking exclusion rules. – catpnosis Dec 23 '12 at 5:56

Tomoyo has some kind of exclusion:

/home/*-backup is what you need

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.