This question is a "would it be possible" rather than a "how to".
Can SELinux isolate a binary AV scanner, Kaspersky Endpoint Security for Linux for an example, to only do whats its suppose to do which is scan (read) and detect?
Imagine installing Kaspersky on a extremely sensitive machine. Leakage of information on the machine would cause severe damage. Kaspersky, while being a extremely well performing antivirus scanner and trusted company,is still a company outside of my home nation. Governmental influence, in this case Russia, could force without choice Kaspersky to upload malicious code through normal update processes onto our sensitive workstations, or exporting the files its reading back to home base exposing our information. These risks need to be avoided.
I'm not a SELinux expert, but i would think it would be possible. The way i see it, a couple rules would need to be enforce, wither it be enforced by SELinux or not.
- The AV scanner should only be able to write to files within its own installed directory, insuring anything the program is creating can be strictly monitored and removed at will.
- The AV scanner should only be able to read files outside its installed directory, it should not allowed to be creating or executing any files oustide of its installed directory.
- The AV scanner needs to be monitored to ensure it is not exporting the files it is reading back to a remote server.
Is SELinux flexible enough to cover these risks? Or is the only answer here having access to the source code?