Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
0 votes
1 answer
217 views

Is AppArmor used in production environments? [closed]

I was recently having a conversation with a friend about his server system (he does a lot of self-hosting) and he mentioned he was in the middle of configuring SELinux. I was curious about the ...
user avatar
1 vote
0 answers
88 views

How can I enforce a security sandbox with any process?

Deno (the node.js fork) is designed to be secure by default. Therefore, unless you specifically enable it, a program run with Deno has no file, network, or environment access. Deno has a set of ...
user avatar
  • 111
0 votes
1 answer
416 views

CIS hardened linux vs SELinux(Security Enhanced)

What are the differences between the CIS hardened linux and SELinux(security linux)? Also, all the public cloud service providers support CIS hardened linux. Does it mean SELinux has lost the battle? ...
user avatar
0 votes
0 answers
110 views

How to only allow whitelisted processes to access a certain file using SElinux?

Let's say you have a important file/folder, and want to only allow certain processes (based on process name, or its corresponding ELF file on the disk, or the digital signature of the corresponding ...
user avatar
1 vote
1 answer
249 views

Secure way to run a linux binary which needs access to ressources only available to root?

As a developer, I ask how to approach security concerns regarding permissions of a binary which needs access to resources only available to root users. For example, let's think of a simple tool which ...
user avatar
  • 111
2 votes
0 answers
305 views

How to harden portable Tor Browser installation (SELinux, sandbox)?

tldr How can I define a SELinux policy, that limits filesystem access of portable Tor Browser to its installation directory, say /home/user/.local/opt/tor-browser_en-US? How might Tor Browser be ...
user avatar
  • 21
1 vote
1 answer
434 views

Why is php-fpm trying to connect somewhere on port 443?

I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS. When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
user avatar
1 vote
1 answer
336 views

Linux security modules (LSM) and reference monitor implementation

as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision. Furthermore, I think the Linux ...
user avatar
  • 161
2 votes
2 answers
380 views

Linux whitelist-based Mandatory Access Control instead of a blacklist-based model

I'm trying to harden a Linux installation on a personal computer - I decided to try both SELinux and AppArmor as a Mandatory Access Control (MAC) to supplement the default Discretionary Access Control ...
user avatar
2 votes
1 answer
102 views

Is there a good reason (and what can it be) to require DAC restriction on IPC in addition to SELinux rules?

Our company is developing an AOSP-based platform for our customer. Some of our vendor services are using HWBinder for IPC which is using SELinux to restrict service discovery and access. The problem ...
user avatar
  • 121
0 votes
1 answer
160 views

Restrict privileged users from accessing certain directories on Linux servers with Grsecurity?

My question is similar to these: Protect sensitive data from sysadmin prying eyes Restrict access to a specific directory on Linux From those, I understand that SELinux could accomplish my goal. ...
user avatar
  • 320
2 votes
0 answers
1k views

Ways to transition SELinux domain / process context (securing SELinux boundaries)

(Apologies for multi-question. Theme is the same, but there are quite a few edge cases.) Browsing the web, I come across resources (see below), but they don't make this quite clear what the situation ...
user avatar
  • 1,040
39 votes
8 answers
12k views

How can I prevent a user from copying files to another hard drive?

I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
user avatar
1 vote
1 answer
195 views

Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it

The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
user avatar
7 votes
2 answers
192 views

Opt-in a security profile at runtime, without tedious setup

I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish. I would like to be able to ...
user avatar
1 vote
1 answer
1k views

Wise/Safe to use Firejail within a SELinux preconfigured O/S?

In my testing of Fedora 29 and came to find it uses SELinux by default; I installed firejail which is available in the repos. Is there any benefit to running Firejail within this environment or is it ...
user avatar
  • 417
1 vote
1 answer
229 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
user avatar
8 votes
4 answers
1k views

Prevent apps from having full access to user files

Applications should not have access to data of other applications or to user's private data unless user allows them. Isn't this an obvious need? But every program we launch has full access to our $...
user avatar
  • 91
1 vote
1 answer
329 views

Auditd logging related to SELinux? [closed]

Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?
user avatar
  • 515
1 vote
1 answer
2k views

selinux : blocking sudo and su usage by placing user into user_t profile

I am trying to block privileges escalations from unprivileged accounts such as www-data. Basically, if my web server is getting compromised, crackers may find ways to escalate (vulnerabilities found ...
user avatar
  • 193
1 vote
2 answers
140 views

Using SELinux to isolate a binary AV scanner to only doing its job, scanning and detecting

This question is a "would it be possible" rather than a "how to". Can SELinux isolate a binary AV scanner, Kaspersky Endpoint Security for Linux for an example, to only do whats its suppose to do ...
user avatar
  • 143
1 vote
1 answer
536 views

What are the security risks of running a daemon as root even though SELinux is enforcing?

On an board running Linux I see a daemon and an utility run under root when started. The SELinux is enforcing for this system. Are there any potential threats of running as root, even if the SELinux ...
user avatar
  • 215
4 votes
1 answer
275 views

Can too restrictive Linux MAC policy decrease security?

Can too restrictive MAC profile (e.x. AppArmor profile) decrease application security? For example: could it be that too restrictive environment for web browser will protect host system very well ...
user avatar
1 vote
0 answers
226 views

How to interpret sesearch result

Question Please suggest how to understand sesearch says. $ sesearch -s svirt_lxc_net_t -t container_var_run_t -SA Found 8 semantic av rules: allow svirt_sandbox_domain file_type : dir { getattr ...
user avatar
  • 265
2 votes
1 answer
2k views

How to find an appropriate SELinux type to prevent "permission denied"

Objective Find out a solution to avoid the permission denied due to SELinux. Background Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
user avatar
  • 265
5 votes
2 answers
321 views

How to build arbitrary Dockerfile Images Without Compromising Host

I'm building a server that will build images directly from Dockerfile: docker build -t arbitrarydocker . This docker file will be built on the same server as other client Dockerfiles, which may have ...
user avatar
3 votes
2 answers
2k views

What is the state of SELinux and are there alternatives?

I have a bunch of virtual machines each one doing a dedicated task: one is hosting a database, another one is a web server using a specific technology, another one is a web server using a different ...
user avatar
1 vote
0 answers
928 views

Dirty-COW CVE-2016-5195 not working

I'm working on an Android 4.4.4 device (armeabi-v7a architecture) and I'm testing the SELinux behavior using the Dirty-COW CVE-2016-5195 exploit for escalation priviledge and see what happens. I've ...
user avatar
2 votes
1 answer
859 views

NIST 800-53 rev 4 - CM-7(2) implementation on Linux

NIST 800-53 rev 4 CM-7(2) states: (2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION The information system employs automated mechanisms to prevent program execution in accordance with [Selection (...
user avatar
1 vote
1 answer
207 views

How to interpret SELinux boolean allow rules?

I'm trying to understand what permissions are allowed by some of the SELinux booleans for httpd domain, as it is my main source of concern, and the current policy of my organization is to give truly ...
user avatar
1 vote
3 answers
502 views

Pitfalls of using SELinux for LAMP servers

I'm considering the usage of SELinux for several lamp (linux+apache+mysql+php) servers. I have tested SELinux in a virtual machine and have configured some basic rules (allow PHP, email, etc.) and for ...
user avatar
  • 932
0 votes
2 answers
250 views

Does SELinux substitute or complement DAC?

The basic premise of SELinux seems to control which activities system allows each user, process and daemon, everything beyond the allowed set is block as a default. Does it mean SELinux effectively ...
user avatar
  • 215
2 votes
3 answers
1k views

Allow access to a directory for certain application only

I would like to restrict an access to a directory. For example, on my system there is ~/.thunderbird directory that contains settings, letters, caches, etc of Thunderbird mail client. Obviously, other ...
user avatar
  • 121
2 votes
1 answer
566 views

SELinux related to fips 140-2?

I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros. Is SELinux somehow related to FIPS requirements? ...
user avatar
4 votes
1 answer
4k views

How do I setup SELinux to act a as a true whitelisting solution?

I am working on an appliance device running Linux. I would like to utilize the work done so far with the targeted policy in SELinux space. Since I own everything that should be installed and running ...
user avatar
1 vote
3 answers
822 views

Rationale behind SELinux preventing file access

Some of the few times I've had to deal with SELinux were when I setup a local webserver on a Fedora box. Problems occurred when a web application tried to write files to the file system. I'm used to ...
user avatar
  • 131
5 votes
3 answers
3k views

Wildcard Paths with semanage fcontext

I am trying to set SELinux contexts within a directory structure. So it is something like this: /var/www/sites /www.example.com /html /logs /www.example.org /html ...
user avatar
7 votes
2 answers
10k views

Difference between SELinux booleans "httpd_can_network_relay" and "httpd_can_network_connect"

I'm in the process of enabling SELinux on my CentOS 7.3 server. I have it set in permissive mode and monitoring the audit log for denials. I'm looking to implement the minimal set of rules that will ...
user avatar
2 votes
1 answer
2k views

SELinux Privilege Escalation Metasploit Nexus 5 Android 5.0.1 LRX22C after Stagefright

I am preparing a part of a security awareness day and one part of the "show" should be about mobile security. I thought about showing the stagefright exploit. So I started with getting a mobile phone ...
user avatar
5 votes
1 answer
469 views

Should I install SELinux onto personal machines?

I came across SELinux this week and the concepts seem interesting. However I don't see the use of SELinux being promoted as much as I expected. Why is this the case and would anyone recommend ...
user avatar
  • 131
1 vote
0 answers
533 views

Sandboxing applications and files in Debian & GrSecurity [closed]

I'm about to switch from Linux Mint to Debian. But before doing that I'm still looking into a few things to secure Debian. 1) The first thing I want is a kind of 'sandboxing' technology. This to ...
user avatar
  • 2,740
5 votes
1 answer
267 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables. Since it's a kernel related topic, at the ...
user avatar
4 votes
1 answer
1k views

Do AppArmor/SELinux provide any security for workstation?

I decided to harden security on my primary workstation a bit. Before I used to use firejail for certain less trusted apps (all apps with internet access) but it's kind of toy. Didn't work really well ...
user avatar
  • 197
3 votes
3 answers
2k views

SELinux vs. Antivirus

I am working with an enterprise network with sensitive data nad am not sure if I should use SELinux or an Antivirus for the Servers, POS Terminals, and Desktop Machines. I need to know what the ...
user avatar
  • 33
10 votes
2 answers
5k views

Does linux support signed binaries?

I am looking for something similar to what iOS supports. Does it exist in linux? With a secure boot (based in hardware chain of trust), doesn't it make sense to have signed binaries for security? ...
user avatar
2 votes
1 answer
328 views

SELinux vs Vanilla Red Hat? [closed]

Im trying to find a good comparison between SELinux vs Vanilla Red Hat. Im building a mission critical system, and am looking for the best security measures regardless of complexity to setup. Does ...
user avatar
  • 21
0 votes
0 answers
99 views

Determining which files a process modifies / creates with strace?

For purposes of setting up AppArmor or SE Linux, I'm looking to audit what files a program could possibly need access to. My understanding is that the end of AppArmor or SE Linux, is to constrain ...
user avatar
  • 1,247
2 votes
1 answer
393 views

SELinux: command line tool to look security context (like selabel_lookup(3))

The selabel_lookup(3) library function gives a way to obtain the SELinux security context information for a file - or rather what security label a file is expected to have [1]. Is there a command ...
user avatar
  • 151
3 votes
1 answer
7k views

How to know if setroubleshoot is running in Centos 7.2

I have tried systemctl status setroubleshootd.service, but I get ● setroubleshootd.service Loaded: not-found (Reason: No such file or directory) Active: inactive (dead) Neither does setroubleshootd ...
user avatar
  • 191
6 votes
1 answer
2k views

Is the native sandbox of Chrome and Firefox enough or would SELinux improve its security?

Chrome on Windows and Linux and Firefox on Windows are executed in a sandbox. On Linux, is the Chrome sandbox enough or would we gain security if we use SELinux to protect the Chrome execution? I ...
user avatar