3
votes
2answers
797 views

Alternatives to SELinux and AppArmor?

With SELinux developed by NSA and AppArmor by Novell [*], what alternate solutions exists when trying to lock down a system and running applications, based on ACL and similar concepts like Zones on ...
2
votes
2answers
323 views

Apparmor system-wide security — white-listing

I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those ...
5
votes
2answers
4k views

How trustworthy is SELinux? [closed]

Given the ongoing leaks concerning mass surveillance and the fact that the NSA is the original developer of SELinux, I'm wondering whether that means that backdoors should be expected in there? As ...
2
votes
1answer
186 views

Preventing access to file for process running as root

I have a client with a legacy application running on RH 3 (=the latest version supported by app). There is a process that has to run as root (and not in a chroot environment). I need to prevent this ...
3
votes
3answers
811 views

Restrict access to a specific directory on Linux

I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
2
votes
2answers
193 views

Is it possible to boot into root's /bin/bash on a LUKS encrypted device?

I have to check the possibility of case mentioned in the title. An average Linux could be booted up into root's terminal directly without authentication by modifying kernel boot parameters. I'd like ...
13
votes
2answers
518 views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...