Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

26
votes
8answers
6k views

How can I prevent a user from copying files on another hard drive?

I have a Linux machine that contains sensitive files. Users should be able to access them (read) when they are using the computer, but should not be able to copy them on another hard drive (USB stick ...
0
votes
0answers
43 views

Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it

The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
3
votes
0answers
39 views

Opt-in a security profile at runtime, without tedious setup

I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish. I would like to be able to ...
0
votes
1answer
147 views

Wise/Safe to use Firejail within a SELinux preconfigured O/S?

In my testing of Fedora 29 and came to find it uses SELinux by default; I installed firejail which is available in the repos. Is there any benefit to running Firejail within this environment or is it ...
1
vote
1answer
68 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
5
votes
3answers
230 views

Prevent apps from having full access to user files

Applications should not have access to data of other applications or to user's private data unless user allows them. Isn't this an obvious need? But every program we launch has full access to our $...
1
vote
1answer
96 views

Auditd logging related to SELinux? [closed]

Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?
1
vote
1answer
443 views

selinux : blocking sudo and su usage by placing user into user_t profile

I am trying to block privileges escalations from unprivileged accounts such as www-data. Basically, if my web server is getting compromised, crackers may find ways to escalate (vulnerabilities found ...
1
vote
2answers
50 views

Using SELinux to isolate a binary AV scanner to only doing its job, scanning and detecting

This question is a "would it be possible" rather than a "how to". Can SELinux isolate a binary AV scanner, Kaspersky Endpoint Security for Linux for an example, to only do whats its suppose to do ...
1
vote
1answer
77 views

What are the security risks of running a daemon as root even though SELinux is enforcing?

On an board running Linux I see a daemon and an utility run under root when started. The SELinux is enforcing for this system. Are there any potential threats of running as root, even if the SELinux ...
2
votes
1answer
158 views

Can too restrictive Linux MAC policy decrease security?

Can too restrictive MAC profile (e.x. AppArmor profile) decrease application security? For example: could it be that too restrictive environment for web browser will protect host system very well ...
1
vote
0answers
118 views

How to interpret sesearch result

Question Please suggest how to understand sesearch says. $ sesearch -s svirt_lxc_net_t -t container_var_run_t -SA Found 8 semantic av rules: allow svirt_sandbox_domain file_type : dir { getattr ...
1
vote
1answer
949 views

How to find an appropriate SELinux type to prevent “permission denied”

Objective Find out a solution to avoid the permission denied due to SELinux. Background Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
5
votes
2answers
212 views

How to build arbitrary Dockerfile Images Without Compromising Host

I'm building a server that will build images directly from Dockerfile: docker build -t arbitrarydocker . This docker file will be built on the same server as other client Dockerfiles, which may have ...
2
votes
2answers
452 views

What is the state of SELinux and are there alternatives?

I have a bunch of virtual machines each one doing a dedicated task: one is hosting a database, another one is a web server using a specific technology, another one is a web server using a different ...
1
vote
0answers
459 views

Dirty-COW CVE-2016-5195 not working

I'm working on an Android 4.4.4 device (armeabi-v7a architecture) and I'm testing the SELinux behavior using the Dirty-COW CVE-2016-5195 exploit for escalation priviledge and see what happens. I've ...
1
vote
1answer
394 views

NIST 800-53 rev 4 - CM-7(2) implementation on Linux

NIST 800-53 rev 4 CM-7(2) states: (2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION The information system employs automated mechanisms to prevent program execution in accordance with [Selection (...
1
vote
1answer
80 views

How to interpret SELinux boolean allow rules?

I'm trying to understand what permissions are allowed by some of the SELinux booleans for httpd domain, as it is my main source of concern, and the current policy of my organization is to give truly ...
0
votes
3answers
258 views

Pitfalls of using SELinux for LAMP servers

I'm considering the usage of SELinux for several lamp (linux+apache+mysql+php) servers. I have tested SELinux in a virtual machine and have configured some basic rules (allow PHP, email, etc.) and for ...
0
votes
2answers
151 views

Does SELinux substitute or complement DAC?

The basic premise of SELinux seems to control which activities system allows each user, process and daemon, everything beyond the allowed set is block as a default. Does it mean SELinux effectively ...
2
votes
3answers
209 views

Allow access to a directory for certain application only

I would like to restrict an access to a directory. For example, on my system there is ~/.thunderbird directory that contains settings, letters, caches, etc of Thunderbird mail client. Obviously, other ...
2
votes
1answer
245 views

SELinux related to fips 140-2?

I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros. Is SELinux somehow related to FIPS requirements? ...
3
votes
1answer
2k views

How do I setup SELinux to act a as a true whitelisting solution?

I am working on an appliance device running Linux. I would like to utilize the work done so far with the targeted policy in SELinux space. Since I own everything that should be installed and running ...
1
vote
3answers
328 views

Rationale behind SELinux preventing file access

Some of the few times I've had to deal with SELinux were when I setup a local webserver on a Fedora box. Problems occurred when a web application tried to write files to the file system. I'm used to ...
1
vote
3answers
1k views

Wildcard Paths with semanage fcontext

I am trying to set SELinux contexts within a directory structure. So it is something like this: /var/www/sites /www.example.com /html /logs /www.example.org /html ...
2
votes
2answers
4k views

Difference between SELinux booleans “httpd_can_network_relay” and “httpd_can_network_connect”

I'm in the process of enabling SELinux on my CentOS 7.3 server. I have it set in permissive mode and monitoring the audit log for denials. I'm looking to implement the minimal set of rules that will ...
2
votes
1answer
914 views

SELinux Privilege Escalation Metasploit Nexus 5 Android 5.0.1 LRX22C after Stagefright

I am preparing a part of a security awareness day and one part of the "show" should be about mobile security. I thought about showing the stagefright exploit. So I started with getting a mobile phone ...
5
votes
1answer
255 views

Should I install SELinux onto personal machines?

I came across SELinux this week and the concepts seem interesting. However I don't see the use of SELinux being promoted as much as I expected. Why is this the case and would anyone recommend ...
1
vote
0answers
360 views

Sandboxing applications and files in Debian & GrSecurity [closed]

I'm about to switch from Linux Mint to Debian. But before doing that I'm still looking into a few things to secure Debian. 1) The first thing I want is a kind of 'sandboxing' technology. This to ...
6
votes
1answer
219 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables. Since it's a kernel related topic, at the ...
3
votes
1answer
700 views

Do AppArmor/SELinux provide any security for workstation?

I decided to harden security on my primary workstation a bit. Before I used to use firejail for certain less trusted apps (all apps with internet access) but it's kind of toy. Didn't work really well ...
2
votes
3answers
1k views

SELinux vs. Antivirus

I am working with an enterprise network with sensitive data nad am not sure if I should use SELinux or an Antivirus for the Servers, POS Terminals, and Desktop Machines. I need to know what the ...
5
votes
2answers
2k views

Does linux support signed binaries?

I am looking for something similar to what iOS supports. Does it exist in linux? With a secure boot (based in hardware chain of trust), doesn't it make sense to have signed binaries for security? ...
2
votes
1answer
231 views

SELinux vs Vanilla Red Hat? [closed]

Im trying to find a good comparison between SELinux vs Vanilla Red Hat. Im building a mission critical system, and am looking for the best security measures regardless of complexity to setup. Does ...
0
votes
0answers
32 views

Determining which files a process modifies / creates with strace?

For purposes of setting up AppArmor or SE Linux, I'm looking to audit what files a program could possibly need access to. My understanding is that the end of AppArmor or SE Linux, is to constrain ...
3
votes
1answer
212 views

SELinux: command line tool to look security context (like selabel_lookup(3))

The selabel_lookup(3) library function gives a way to obtain the SELinux security context information for a file - or rather what security label a file is expected to have [1]. Is there a command ...
2
votes
1answer
4k views

How to know if setroubleshoot is running in Centos 7.2

I have tried systemctl status setroubleshootd.service, but I get ● setroubleshootd.service Loaded: not-found (Reason: No such file or directory) Active: inactive (dead) Neither does setroubleshootd ...
6
votes
1answer
2k views

Is the native sandbox of Chrome and Firefox enough or would SELinux improve its security?

Chrome on Windows and Linux and Firefox on Windows are executed in a sandbox. On Linux, is the Chrome sandbox enough or would we gain security if we use SELinux to protect the Chrome execution? I ...
4
votes
3answers
319 views

Defense-In-Depth With Common Security Controls

Many operating systems implement system capabilities, Posix access controls (DAC/ACLs) and mandatory access controls (SELinux), each using different underlying security controls to provide individual ...
2
votes
1answer
464 views

Why doesn't SELinux prevent access to this file?

I have a vanilla CentOS 7 box with SELinux enforcing with the targeted policy: $ ls -lZ /etc/resolv.conf -rw-r--r--. root root system_u:object_r:net_conf_t:s0 /etc/resolv.conf $ sudo id -Z ...
-1
votes
1answer
255 views

Starting a server without SElinux or Apparmor [duplicate]

The Debian kernel that compiled for Beaglebone Black, doesn't support SElinux and Apparmor, AFAIK. I just want to know, is it safe to put a server on the internet without SElinux or Apparmor? However ...
2
votes
3answers
314 views

Linux File Security when connected to internet [closed]

Let me first admit that I am a nobody in computer security - I just know the various threats generally known to public. I have a Linux Cent OS 7 installed on my computer which is connected to the ...
7
votes
2answers
2k views

What are the security implications of disabling SELinux? [closed]

Is there any attack that would be possible just by disabling SELinux? Particularly on a server running http and ssh services?
1
vote
1answer
384 views

Sandbox for GNU/Linux secure enough to run malware in it without harm [closed]

I am seemkng for a sandbox for Linux secure enough to run malware in it securely. It should allow create different sandboxes run different programs in them, including the ones requiring admin ...
9
votes
2answers
520 views

Why does Android use SELinux?

To restrict/sandbox processes Android uses SELinux. Why was that chosen and not the linux capabilities or cgroups+namespaces solution? After all the cgroups+namespaces is kind of home grown for them ...
1
vote
1answer
274 views

Virtual Environments vs SELinux/AppArmor : Which is better for running unreliable applications?

By virtual environments, I mean Linux containers like Docker and Vagrant and not full blown VirtualBox. So, the issue is that I often have to install packages from untrusted sources in my Ubuntu. ...
0
votes
1answer
458 views

SELinux ignoring /etc/sysconfig/selinux directive

I'm running SELinux on CentOS 6.5. In /etc/sysconfig/selinux I have set SELINUX=permissive. But everytime the system starts, sudo getenforce shows SELinux as Enforcing. What could be causing it to go ...
7
votes
1answer
958 views

How does SELinux affect the Linux Kernel networking stack?

I'm interested in how SELinux effects the processing of packets through the networking stack. I've found the following questions and answers: Network policies under AppArmor/SELinux Filtering ...
-1
votes
1answer
135 views

How would one go about setting up a system with security in mind? [closed]

I run a standard laptop at home (dual-boot Fedora 20 and Windows 7; the Windows side is almost never used). Soon my other computer will be working again; it will have Windows 8.1 and some flavor of ...
1
vote
2answers
724 views

Open Source Security Dashboard? [closed]

I'm looking for an open source security dashboard that gives a basic overview of security warnings. Google has pointed me in a few directions but nothing promising. I need something to deal w/ selinux ...