I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access restrictions are not an option.

What are my options? AppArmor? SELinux?

I don't want to restrict single processes, I want to restrict all processes from accessing a directory except a few select ones. Seems AppArmor can't do that.


3 Answers 3


The upside -- yes, you can do this with SELinux. The downside -- you have to know SELinux. :)

You can execute these processes in different SELinux domains. E.g. let's call two processes "privapp" and "unprivapp" -- privapp is able to access /var/lib/app/log and unprivapp cannot access /var/lib/app/log, despite running as the same user.

So, you create two domains privapp_t and unprivapp_t and label the executables as privapp_exec_t and unprivapp_exec_t. You then label /var/lib/app/log as var_lib_privapp_rw_t and indicate that only a process running as privapp_t is able to access it.

This is the easy part -- the hard part is expressing the above in the policy language, which is the bit known to drive grown men and women to tears. :)

  • I ended up using SELinux, it works now (and you were right about the hard part…)
    – leoluk
    Mar 4, 2013 at 11:14
  • @leoluk: congratulations, you're part of the elite few now. :)
    – mricon
    Mar 5, 2013 at 2:24
  • In fairness the polgengui assists, as long as you pick the right options; in F21 it's system-config-selinux
    – Mark
    Jan 26, 2015 at 13:09

I don't think you are going to be able to accomplish that with only a single user. The closest thing to what you are talking about that I can think of is the way Android does it, and that is simply that each process runs under it's own user, thus it can only access it's own files and files of those processes that allow it access. Processes themselves aren't strong identities in any system I know of.

  • It's easily possible using mandatory access control, I'm just unsure about the best way to do it.
    – leoluk
    Feb 1, 2013 at 19:56
  • It's even more easily possible when running processes under separate user accounts. Why use a nailgun when a hammer will suffice? Feb 1, 2013 at 20:25
  • @Leoluk - Yes, mandatory access control would solve it, but you said they were running under a single user. Mandatory access control effectively means that it is being split to the process itself which is basically equivalent to giving them their own user. Feb 1, 2013 at 20:27

I would recommend to look into remote syslog. This way you can be sure that logs cannot be deleted or tampered with.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .