Questions tagged [selinux]
SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.
79
questions
0
votes
0
answers
89
views
Prevent read access to other users' files using SELinux
While running a VPS for shared hosting, I put the data for the various users and websites as /var/www/[USER]/public_html/[DOMAIN]/.... I'd like to make sure that one user cannot access data from ...
- 101
0
votes
0
answers
49
views
What's the use of an object's user and role in SELinux?
SELinux users determine the SELinux roles a process can assume, which in turn determines the domain (type) it can get into. However, objects are also labelled with user:role:type, and only the type ...
0
votes
1
answer
837
views
Is AppArmor used in production environments? [closed]
I was recently having a conversation with a friend about his server system (he does a lot of self-hosting) and he mentioned he was in the middle of configuring SELinux. I was curious about the ...
- 103
1
vote
0
answers
130
views
How can I enforce a security sandbox with any process?
Deno (the node.js fork) is designed to be secure by default. Therefore, unless you specifically enable it, a program run with Deno has no file, network, or environment access. Deno has a set of ...
- 111
1
vote
1
answer
1k
views
CIS hardened linux vs SELinux(Security Enhanced)
What are the differences between the CIS hardened linux and SELinux(security linux)? Also, all the public cloud service providers support CIS hardened linux. Does it mean SELinux has lost the battle? ...
1
vote
1
answer
686
views
Secure way to run a linux binary which needs access to ressources only available to root?
As a developer, I ask how to approach security concerns regarding permissions of a binary which needs access to resources only available to root users.
For example, let's think of a simple tool which ...
- 111
2
votes
0
answers
513
views
How to harden portable Tor Browser installation (SELinux, sandbox)?
tldr
How can I define a SELinux policy, that limits filesystem access of portable Tor Browser to its installation directory, say /home/user/.local/opt/tor-browser_en-US?
How might Tor Browser be ...
- 21
1
vote
1
answer
831
views
Why is php-fpm trying to connect somewhere on port 443?
I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS.
When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
- 300
2
votes
1
answer
519
views
Linux security modules (LSM) and reference monitor implementation
as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision.
Furthermore, I think the Linux ...
- 171
2
votes
2
answers
771
views
Linux whitelist-based Mandatory Access Control instead of a blacklist-based model
I'm trying to harden a Linux installation on a personal computer - I decided to try both SELinux and AppArmor as a Mandatory Access Control (MAC) to supplement the default Discretionary Access Control ...
- 131
2
votes
1
answer
136
views
Is there a good reason (and what can it be) to require DAC restriction on IPC in addition to SELinux rules?
Our company is developing an AOSP-based platform for our customer. Some of our vendor services are using HWBinder for IPC which is using SELinux to restrict service discovery and access. The problem ...
- 121
0
votes
1
answer
227
views
Restrict privileged users from accessing certain directories on Linux servers with Grsecurity?
My question is similar to these:
Protect sensitive data from sysadmin prying eyes
Restrict access to a specific directory on Linux
From those, I understand that SELinux could accomplish my goal. ...
- 340
2
votes
0
answers
2k
views
Ways to transition SELinux domain / process context (securing SELinux boundaries)
(Apologies for multi-question. Theme is the same, but there are quite a few edge cases.)
Browsing the web, I come across resources (see below), but they don't make this quite clear what the situation ...
- 1,040
39
votes
8
answers
13k
views
How can I prevent a user from copying files to another hard drive?
I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
- 509
1
vote
1
answer
318
views
Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it
The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
- 281
7
votes
2
answers
213
views
Opt-in a security profile at runtime, without tedious setup
I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish.
I would like to be able to ...
- 171
2
votes
1
answer
2k
views
Wise/Safe to use Firejail within a SELinux preconfigured O/S?
In my testing of Fedora 29 and came to find it uses SELinux by default; I installed firejail which is available in the repos. Is there any benefit to running Firejail within this environment or is it ...
- 435
1
vote
1
answer
318
views
Is it dangerous to keep permissions at 666 to member file on SELinux?
I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux.
On CentOS help page , I can see that some files in
/selinux/ are writable by other user : https://www....
user192382
9
votes
5
answers
2k
views
Prevent apps from having full access to user files
Applications should not have access to data of other applications or to user's private data unless user allows them. Isn't this an obvious need?
But every program we launch has full access to our $...
- 101
1
vote
1
answer
405
views
Auditd logging related to SELinux? [closed]
Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?
- 525
1
vote
1
answer
2k
views
selinux : blocking sudo and su usage by placing user into user_t profile
I am trying to block privileges escalations from unprivileged accounts such as www-data.
Basically, if my web server is getting compromised, crackers may find ways to escalate (vulnerabilities found ...
- 193
1
vote
2
answers
180
views
Using SELinux to isolate a binary AV scanner to only doing its job, scanning and detecting
This question is a "would it be possible" rather than a "how to".
Can SELinux isolate a binary AV scanner, Kaspersky Endpoint Security for Linux for an example, to only do whats its suppose to do ...
- 153
1
vote
1
answer
823
views
What are the security risks of running a daemon as root even though SELinux is enforcing?
On an board running Linux I see a daemon and an utility run under root when started. The SELinux is enforcing for this system.
Are there any potential threats of running as root, even if the SELinux ...
- 225
4
votes
1
answer
312
views
Can too restrictive Linux MAC policy decrease security?
Can too restrictive MAC profile (e.x. AppArmor profile) decrease application security?
For example: could it be that too restrictive environment for web browser will protect host system very well ...
- 263
1
vote
0
answers
269
views
How to interpret sesearch result
Question
Please suggest how to understand sesearch says.
$ sesearch -s svirt_lxc_net_t -t container_var_run_t -SA
Found 8 semantic av rules:
allow svirt_sandbox_domain file_type : dir { getattr ...
- 295
2
votes
1
answer
2k
views
How to find an appropriate SELinux type to prevent "permission denied"
Objective
Find out a solution to avoid the permission denied due to SELinux.
Background
Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
- 295
5
votes
2
answers
420
views
How to build arbitrary Dockerfile Images Without Compromising Host
I'm building a server that will build images directly from Dockerfile:
docker build -t arbitrarydocker .
This docker file will be built on the same server as other client Dockerfiles, which may have ...
- 151
3
votes
2
answers
3k
views
What is the state of SELinux and are there alternatives?
I have a bunch of virtual machines each one doing a dedicated task: one is hosting a database, another one is a web server using a specific technology, another one is a web server using a different ...
- 4,734
1
vote
0
answers
1k
views
Dirty-COW CVE-2016-5195 not working
I'm working on an Android 4.4.4 device (armeabi-v7a architecture) and I'm testing the SELinux behavior using the Dirty-COW CVE-2016-5195 exploit for escalation priviledge and see what happens. I've ...
- 11
2
votes
1
answer
1k
views
NIST 800-53 rev 4 - CM-7(2) implementation on Linux
NIST 800-53 rev 4 CM-7(2) states:
(2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION
The information system employs automated mechanisms to prevent program execution in accordance with [Selection (...
1
vote
1
answer
270
views
How to interpret SELinux boolean allow rules?
I'm trying to understand what permissions are allowed by some of the SELinux booleans for httpd domain, as it is my main source of concern, and the current policy of my organization is to give truly ...
- 111
1
vote
3
answers
563
views
Pitfalls of using SELinux for LAMP servers
I'm considering the usage of SELinux for several lamp (linux+apache+mysql+php) servers. I have tested SELinux in a virtual machine and have configured some basic rules (allow PHP, email, etc.) and for ...
- 932
0
votes
2
answers
309
views
Does SELinux substitute or complement DAC?
The basic premise of SELinux seems to control which activities system allows each user, process and daemon, everything beyond the allowed set is block as a default.
Does it mean SELinux effectively ...
- 225
2
votes
3
answers
2k
views
Allow access to a directory for certain application only
I would like to restrict an access to a directory. For example, on my system there is ~/.thunderbird directory that contains settings, letters, caches, etc of Thunderbird mail client. Obviously, other ...
- 121
2
votes
1
answer
753
views
SELinux related to fips 140-2?
I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros.
Is SELinux somehow related to FIPS requirements?
...
- 81
4
votes
1
answer
5k
views
How do I setup SELinux to act a as a true whitelisting solution?
I am working on an appliance device running Linux. I would like to utilize the work done so far with the targeted policy in SELinux space. Since I own everything that should be installed and running ...
- 41
1
vote
3
answers
1k
views
Rationale behind SELinux preventing file access
Some of the few times I've had to deal with SELinux were when I setup a local webserver on a Fedora box. Problems occurred when a web application tried to write files to the file system.
I'm used to ...
- 131
5
votes
3
answers
4k
views
Wildcard Paths with semanage fcontext
I am trying to set SELinux contexts within a directory structure. So it is something like this:
/var/www/sites
/www.example.com
/html
/logs
/www.example.org
/html
...
user112461
8
votes
2
answers
13k
views
Difference between SELinux booleans "httpd_can_network_relay" and "httpd_can_network_connect"
I'm in the process of enabling SELinux on my CentOS 7.3 server. I have it set in permissive mode and monitoring the audit log for denials. I'm looking to implement the minimal set of rules that will ...
user112461
2
votes
1
answer
2k
views
SELinux Privilege Escalation Metasploit Nexus 5 Android 5.0.1 LRX22C after Stagefright
I am preparing a part of a security awareness day and one part of the "show" should be about mobile security.
I thought about showing the stagefright exploit.
So I started with getting a mobile phone ...
- 21
5
votes
1
answer
589
views
Should I install SELinux onto personal machines?
I came across SELinux this week and the concepts seem interesting. However I don't see the use of SELinux being promoted as much as I expected. Why is this the case and would anyone recommend ...
- 131
1
vote
0
answers
577
views
Sandboxing applications and files in Debian & GrSecurity [closed]
I'm about to switch from Linux Mint to Debian. But before doing that I'm still looking into a few things to secure Debian.
1)
The first thing I want is a kind of 'sandboxing' technology. This to ...
- 2,770
5
votes
1
answer
277
views
System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl
I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables.
Since it's a kernel related topic, at the ...
- 246
5
votes
1
answer
2k
views
Do AppArmor/SELinux provide any security for workstation?
I decided to harden security on my primary workstation a bit. Before I used to use firejail for certain less trusted apps (all apps with internet access) but it's kind of toy. Didn't work really well ...
- 217
3
votes
3
answers
3k
views
SELinux vs. Antivirus
I am working with an enterprise network with sensitive data nad am not sure if I should use SELinux or an Antivirus for the Servers, POS Terminals, and Desktop Machines.
I need to know what the ...
- 33
10
votes
2
answers
6k
views
Does linux support signed binaries?
I am looking for something similar to what iOS supports. Does it exist in linux?
With a secure boot (based in hardware chain of trust), doesn't it make sense to have signed binaries for security? ...
- 903
2
votes
1
answer
366
views
SELinux vs Vanilla Red Hat? [closed]
Im trying to find a good comparison between SELinux vs Vanilla Red Hat. Im building a mission critical system, and am looking for the best security measures regardless of complexity to setup.
Does ...
- 21
0
votes
0
answers
109
views
Determining which files a process modifies / creates with strace?
For purposes of setting up AppArmor or SE Linux, I'm looking to audit what files a program could possibly need access to.
My understanding is that the end of AppArmor or SE Linux, is to constrain ...
- 1,399
2
votes
1
answer
479
views
SELinux: command line tool to look security context (like selabel_lookup(3))
The selabel_lookup(3) library function gives a way to obtain the SELinux security context information for a file - or rather what security label a file is expected to have [1].
Is there a command ...
- 151
4
votes
1
answer
7k
views
How to know if setroubleshoot is running in Centos 7.2
I have tried systemctl status setroubleshootd.service, but I get
● setroubleshootd.service
Loaded: not-found (Reason: No such file or directory)
Active: inactive (dead)
Neither does setroubleshootd ...
- 221