Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite
1

(For example) I want to restrict write access to /home/backup from anybody, except a particular backup script. (To protect from accidental deletion.) For this, I suppose, it is enough to have two domains: <kernel> and </usr/bin/backup-script>. And I need to enable for <kernel> access to everything except write access to /home/backup. How to do that exception? I don't see exclusion rules in TOMOYO policy specification, and the general ideology of TOMOYO is only granting access, not forbidding.

share|improve this question

1 Answer

up vote 1 down vote

Acutally no need to exclude kernel. You can tell though files /home/backup/\*{\*}\* may only be changed if domain "<kernel> /usr/bin/backup-script" does access.

relevant links from Tomoyo Guide:

share|improve this answer
Problem is how to forbid other processes (besides backup) write access to backup data. All processes should have full access anywhere except /home/backup/\*{\*}\*. There is no problem allowing access to backup data for backup script, since in TOMOYO you granting accesss (and only granting). – catpnosis Dec 22 '12 at 20:31
1  
If you apply and Enforce a policy for a specific domain you will achive exaclty what you want. Sorry cant explain better -.- – rhasti Dec 22 '12 at 21:01
I need to restrict <kernel> do you understand that? I can not just add /\*{\*}\* and exclude /home/backup/\*{\*}\*, I should only add all dirs, excluding /home/\*{\*}\*, than in /home I should explicitly add every dirs of users, except /home/backup/\*{\*}\*. That is tons of rules already. And then every time I add user I should add rule for him. All that fun because TOMOYO is lacking exclusion rules. – catpnosis Dec 23 '12 at 5:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.