Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with restricted access.

share|improve this question
possible duplicate of Network policies under AppArmor/SELinux – Gilles Dec 21 '12 at 15:51

AppArmor has the ability to block network connections from applications. I've never done it myself, but you should look at the AppArmor community page and the network rules page for details on how to do it.

From the looks of it, the deny network directive should allow you to block all network access for an application.

share|improve this answer
thanks a lot, but suddenly I could not run apparmor - AppArmor not available as kernel LSM famous bug:( – scythargon Aug 23 '12 at 10:44

If you have SELinux enabled, I was under the impression that the default action was to deny access so what you want to do is to allow network access at times, right?

I suspect that you going to have to do something like this answer on serverfault, which contains SE Linux configuration for a single process httpd and then combines that configuration with iptables to control the network access.

To add in the time aspect, there's a time module in iptables. Here's a link showing some real usage on another forum.

AppArmor has already been well-answered :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.