(For example) I want to restrict write access to /home/backup from anybody, except a particular backup script. (To protect from accidental deletion.) For this, I suppose, it is enough to have two domains: <kernel> and </usr/bin/backup-script>. And I need to enable for <kernel> access to everything except write access to /home/backup. How to do that exception? I don't see exclusion rules in TOMOYO policy specification, and the general ideology of TOMOYO is only granting access, not forbidding.


Acutally no need to exclude kernel. You can tell though files /home/backup/\*{\*}\* may only be changed if domain "<kernel> /usr/bin/backup-script" does access.

relevant links from Tomoyo Guide:

  • Problem is how to forbid other processes (besides backup) write access to backup data. All processes should have full access anywhere except /home/backup/\*{\*}\*. There is no problem allowing access to backup data for backup script, since in TOMOYO you granting accesss (and only granting). – catpnosis Dec 22 '12 at 20:31
  • 1
    If you apply and Enforce a policy for a specific domain you will achive exaclty what you want. Sorry cant explain better -.- – rhasti Dec 22 '12 at 21:01
  • I need to restrict <kernel> do you understand that? I can not just add /\*{\*}\* and exclude /home/backup/\*{\*}\*, I should only add all dirs, excluding /home/\*{\*}\*, than in /home I should explicitly add every dirs of users, except /home/backup/\*{\*}\*. That is tons of rules already. And then every time I add user I should add rule for him. All that fun because TOMOYO is lacking exclusion rules. – catpnosis Dec 23 '12 at 5:56

Tomoyo has some kind of exclusion:

/home/*-backup is what you need


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.