Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
0
votes
1answer
97 views

Is AppArmor used in production environments? [closed]

I was recently having a conversation with a friend about his server system (he does a lot of self-hosting) and he mentioned he was in the middle of configuring SELinux. I was curious about the ...
1
vote
0answers
59 views

How can I enforce a security sandbox with any process?

Deno (the node.js fork) is designed to be secure by default. Therefore, unless you specifically enable it, a program run with Deno has no file, network, or environment access. Deno has a set of ...
0
votes
1answer
208 views

CIS hardened linux vs SELinux(Security Enhanced)

What are the differences between the CIS hardened linux and SELinux(security linux)? Also, all the public cloud service providers support CIS hardened linux. Does it mean SELinux has lost the battle? ...
0
votes
0answers
71 views

How to only allow whitelisted processes to access a certain file using SElinux?

Let's say you have a important file/folder, and want to only allow certain processes (based on process name, or its corresponding ELF file on the disk, or the digital signature of the corresponding ...
1
vote
1answer
189 views

Secure way to run a linux binary which needs access to ressources only available to root?

As a developer, I ask how to approach security concerns regarding permissions of a binary which needs access to resources only available to root users. For example, let's think of a simple tool which ...
2
votes
0answers
247 views

How to harden portable Tor Browser installation (SELinux, sandbox)?

tldr How can I define a SELinux policy, that limits filesystem access of portable Tor Browser to its installation directory, say /home/user/.local/opt/tor-browser_en-US? How might Tor Browser be ...
0
votes
0answers
82 views

Why is SELinux denying apache to read directory of wordpress plugin?

ausearch reports this error: type=AVC msg=audit(30/03/21 11:54:49.726:125) : avc: denied { read } for pid=8028 comm=httpd name=logs dev="nvme0n1p1" ino=4430391 scontext=system_u:system_r:...
1
vote
1answer
327 views

Why is php-fpm trying to connect somewhere on port 443?

I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS. When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
1
vote
1answer
264 views

Linux security modules (LSM) and reference monitor implementation

as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision. Furthermore, I think the Linux ...
1
vote
2answers
294 views

Linux whitelist-based Mandatory Access Control instead of a blacklist-based model

I'm trying to harden a Linux installation on a personal computer - I decided to try both SELinux and AppArmor as a Mandatory Access Control (MAC) to supplement the default Discretionary Access Control ...
2
votes
1answer
91 views

Is there a good reason (and what can it be) to require DAC restriction on IPC in addition to SELinux rules?

Our company is developing an AOSP-based platform for our customer. Some of our vendor services are using HWBinder for IPC which is using SELinux to restrict service discovery and access. The problem ...
1
vote
0answers
103 views

How to guarantee that files on a USB are never transmitted over the network with SELinux

I have activated SELinux in enforcing targeted mode: # getenforce Enforcing # cat /etc/selinux/config | sed '/^#/d' SELINUX=enforcing SELINUXTYPE=targeted The current context of the sensitive ...
0
votes
1answer
135 views

Restrict privileged users from accessing certain directories on Linux servers with Grsecurity?

My question is similar to these: Protect sensitive data from sysadmin prying eyes Restrict access to a specific directory on Linux From those, I understand that SELinux could accomplish my goal. ...
2
votes
0answers
915 views

Ways to transition SELinux domain / process context (securing SELinux boundaries)

(Apologies for multi-question. Theme is the same, but there are quite a few edge cases.) Browsing the web, I come across resources (see below), but they don't make this quite clear what the situation ...
39
votes
8answers
12k views

How can I prevent a user from copying files to another hard drive?

I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
1
vote
1answer
182 views

Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it

The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
7
votes
2answers
176 views

Opt-in a security profile at runtime, without tedious setup

I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish. I would like to be able to ...
1
vote
1answer
1k views

Wise/Safe to use Firejail within a SELinux preconfigured O/S?

In my testing of Fedora 29 and came to find it uses SELinux by default; I installed firejail which is available in the repos. Is there any benefit to running Firejail within this environment or is it ...
1
vote
1answer
193 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
6
votes
3answers
1k views

Prevent apps from having full access to user files

Applications should not have access to data of other applications or to user's private data unless user allows them. Isn't this an obvious need? But every program we launch has full access to our $...
1
vote
1answer
296 views

Auditd logging related to SELinux? [closed]

Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?
1
vote
1answer
1k views

selinux : blocking sudo and su usage by placing user into user_t profile

I am trying to block privileges escalations from unprivileged accounts such as www-data. Basically, if my web server is getting compromised, crackers may find ways to escalate (vulnerabilities found ...
1
vote
2answers
126 views

Using SELinux to isolate a binary AV scanner to only doing its job, scanning and detecting

This question is a "would it be possible" rather than a "how to". Can SELinux isolate a binary AV scanner, Kaspersky Endpoint Security for Linux for an example, to only do whats its suppose to do ...
1
vote
1answer
467 views

What are the security risks of running a daemon as root even though SELinux is enforcing?

On an board running Linux I see a daemon and an utility run under root when started. The SELinux is enforcing for this system. Are there any potential threats of running as root, even if the SELinux ...
4
votes
1answer
260 views

Can too restrictive Linux MAC policy decrease security?

Can too restrictive MAC profile (e.x. AppArmor profile) decrease application security? For example: could it be that too restrictive environment for web browser will protect host system very well ...
1
vote
0answers
206 views

How to interpret sesearch result

Question Please suggest how to understand sesearch says. $ sesearch -s svirt_lxc_net_t -t container_var_run_t -SA Found 8 semantic av rules: allow svirt_sandbox_domain file_type : dir { getattr ...
2
votes
1answer
2k views

How to find an appropriate SELinux type to prevent "permission denied"

Objective Find out a solution to avoid the permission denied due to SELinux. Background Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
5
votes
2answers
306 views

How to build arbitrary Dockerfile Images Without Compromising Host

I'm building a server that will build images directly from Dockerfile: docker build -t arbitrarydocker . This docker file will be built on the same server as other client Dockerfiles, which may have ...
3
votes
2answers
2k views

What is the state of SELinux and are there alternatives?

I have a bunch of virtual machines each one doing a dedicated task: one is hosting a database, another one is a web server using a specific technology, another one is a web server using a different ...
1
vote
0answers
883 views

Dirty-COW CVE-2016-5195 not working

I'm working on an Android 4.4.4 device (armeabi-v7a architecture) and I'm testing the SELinux behavior using the Dirty-COW CVE-2016-5195 exploit for escalation priviledge and see what happens. I've ...
2
votes
1answer
789 views

NIST 800-53 rev 4 - CM-7(2) implementation on Linux

NIST 800-53 rev 4 CM-7(2) states: (2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION The information system employs automated mechanisms to prevent program execution in accordance with [Selection (...
1
vote
1answer
191 views

How to interpret SELinux boolean allow rules?

I'm trying to understand what permissions are allowed by some of the SELinux booleans for httpd domain, as it is my main source of concern, and the current policy of my organization is to give truly ...
1
vote
3answers
476 views

Pitfalls of using SELinux for LAMP servers

I'm considering the usage of SELinux for several lamp (linux+apache+mysql+php) servers. I have tested SELinux in a virtual machine and have configured some basic rules (allow PHP, email, etc.) and for ...
0
votes
2answers
224 views

Does SELinux substitute or complement DAC?

The basic premise of SELinux seems to control which activities system allows each user, process and daemon, everything beyond the allowed set is block as a default. Does it mean SELinux effectively ...
2
votes
3answers
1k views

Allow access to a directory for certain application only

I would like to restrict an access to a directory. For example, on my system there is ~/.thunderbird directory that contains settings, letters, caches, etc of Thunderbird mail client. Obviously, other ...
2
votes
1answer
516 views

SELinux related to fips 140-2?

I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros. Is SELinux somehow related to FIPS requirements? ...
4
votes
1answer
4k views

How do I setup SELinux to act a as a true whitelisting solution?

I am working on an appliance device running Linux. I would like to utilize the work done so far with the targeted policy in SELinux space. Since I own everything that should be installed and running ...
1
vote
3answers
737 views

Rationale behind SELinux preventing file access

Some of the few times I've had to deal with SELinux were when I setup a local webserver on a Fedora box. Problems occurred when a web application tried to write files to the file system. I'm used to ...
5
votes
3answers
3k views

Wildcard Paths with semanage fcontext

I am trying to set SELinux contexts within a directory structure. So it is something like this: /var/www/sites /www.example.com /html /logs /www.example.org /html ...
6
votes
2answers
9k views

Difference between SELinux booleans "httpd_can_network_relay" and "httpd_can_network_connect"

I'm in the process of enabling SELinux on my CentOS 7.3 server. I have it set in permissive mode and monitoring the audit log for denials. I'm looking to implement the minimal set of rules that will ...
2
votes
1answer
2k views

SELinux Privilege Escalation Metasploit Nexus 5 Android 5.0.1 LRX22C after Stagefright

I am preparing a part of a security awareness day and one part of the "show" should be about mobile security. I thought about showing the stagefright exploit. So I started with getting a mobile phone ...
5
votes
1answer
441 views

Should I install SELinux onto personal machines?

I came across SELinux this week and the concepts seem interesting. However I don't see the use of SELinux being promoted as much as I expected. Why is this the case and would anyone recommend ...
1
vote
0answers
503 views

Sandboxing applications and files in Debian & GrSecurity [closed]

I'm about to switch from Linux Mint to Debian. But before doing that I'm still looking into a few things to secure Debian. 1) The first thing I want is a kind of 'sandboxing' technology. This to ...
5
votes
1answer
260 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables. Since it's a kernel related topic, at the ...
4
votes
1answer
1k views

Do AppArmor/SELinux provide any security for workstation?

I decided to harden security on my primary workstation a bit. Before I used to use firejail for certain less trusted apps (all apps with internet access) but it's kind of toy. Didn't work really well ...
3
votes
3answers
2k views

SELinux vs. Antivirus

I am working with an enterprise network with sensitive data nad am not sure if I should use SELinux or an Antivirus for the Servers, POS Terminals, and Desktop Machines. I need to know what the ...
10
votes
2answers
5k views

Does linux support signed binaries?

I am looking for something similar to what iOS supports. Does it exist in linux? With a secure boot (based in hardware chain of trust), doesn't it make sense to have signed binaries for security? ...
2
votes
1answer
321 views

SELinux vs Vanilla Red Hat? [closed]

Im trying to find a good comparison between SELinux vs Vanilla Red Hat. Im building a mission critical system, and am looking for the best security measures regardless of complexity to setup. Does ...
0
votes
0answers
91 views

Determining which files a process modifies / creates with strace?

For purposes of setting up AppArmor or SE Linux, I'm looking to audit what files a program could possibly need access to. My understanding is that the end of AppArmor or SE Linux, is to constrain ...
2
votes
1answer
371 views

SELinux: command line tool to look security context (like selabel_lookup(3))

The selabel_lookup(3) library function gives a way to obtain the SELinux security context information for a file - or rather what security label a file is expected to have [1]. Is there a command ...