This question is a "would it be possible" rather than a "how to".

Can SELinux isolate a binary AV scanner, Kaspersky Endpoint Security for Linux for an example, to only do whats its suppose to do which is scan (read) and detect?

Imagine installing Kaspersky on a extremely sensitive machine. Leakage of information on the machine would cause severe damage. Kaspersky, while being a extremely well performing antivirus scanner and trusted company,is still a company outside of my home nation. Governmental influence, in this case Russia, could force without choice Kaspersky to upload malicious code through normal update processes onto our sensitive workstations, or exporting the files its reading back to home base exposing our information. These risks need to be avoided.

I'm not a SELinux expert, but i would think it would be possible. The way i see it, a couple rules would need to be enforce, wither it be enforced by SELinux or not.

  • The AV scanner should only be able to write to files within its own installed directory, insuring anything the program is creating can be strictly monitored and removed at will.
  • The AV scanner should only be able to read files outside its installed directory, it should not allowed to be creating or executing any files oustide of its installed directory.
  • The AV scanner needs to be monitored to ensure it is not exporting the files it is reading back to a remote server.

Is SELinux flexible enough to cover these risks? Or is the only answer here having access to the source code?


Yes, you could do this with SELinux - but why on earth would you want to?

You're requirements appear to skip over the most likely route for information leakage, and that which launched Kaspersky into the headlines recently and led to major changes in the way software is sourced and integrated. You make no mention of restricting network access. Again SELinux is quite capable of doing this.

The way i see it, a couple rules

Ah, now we come to the tricky bit.

Not a couple of rules. A lot of rules.

It's relatively simple to do with apparmor. Or without any MAC, you could run it chroot with a read only loop back to the real filesystem (NFS, Fuse, Overlay) in its own network namespace with its own network routes / iptables.


Yes, you can write a SELinux policy like that -- at least in theory. I found that, in practice, large binary apps like that want to touch a LOT of different things around the OS and crash when you try to deny access. Writing SELinux policies is not THAT difficult as people have you believe -- if you've ever written iptables rules or sendmail configuration files, then it's a comparable level of complexity. It takes a while to grasp the core concepts, but once you have that under your belt, knowing how to write SELinux policies is an invaluable skill that you'll be able to reuse elsewhere.

  • SELinux is a fair bit more convoluted than iptables, to be fair. The main problem is that everyone is used to path-based MACs, and label-based MACs are simply very unintuitive. – forest Aug 3 '18 at 6:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.