Skip to main content

Questions tagged [selinux]

SELinux (Security-Enhanced Linux) is an implementation of a flexible mandatory, role-based access control architecture on Linux. It is primarily used to confine system processes.

Filter by
Sorted by
Tagged with
86 votes
9 answers
83k views

Comparison Between AppArmor and Selinux

I was reviewing several different comparisons of AppArmor and SELinux which include: Why I Like AppArmor More Than SELinux SELinux and AppArmor: An Introductory Comparison From these articles I ...
Ali Ahmad's user avatar
  • 4,844
39 votes
8 answers
13k views

How can I prevent a user from copying files to another hard drive?

I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
Iakovos's user avatar
  • 509
29 votes
2 answers
20k views

How trustworthy is SELinux? [closed]

Given the ongoing leaks concerning mass surveillance and the fact that the NSA is the original developer of SELinux, I'm wondering whether that means that backdoors should be expected in there? As ...
0xC0000022L's user avatar
  • 1,672
16 votes
2 answers
3k views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...
Prashanth's user avatar
  • 163
12 votes
3 answers
5k views

Restrict access to a specific directory on Linux

I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
leoluk's user avatar
  • 223
10 votes
2 answers
7k views

Does linux support signed binaries?

I am looking for something similar to what iOS supports. Does it exist in linux? With a secure boot (based in hardware chain of trust), doesn't it make sense to have signed binaries for security? ...
user220201's user avatar
10 votes
2 answers
4k views

What are the security implications of disabling SELinux? [closed]

Is there any attack that would be possible just by disabling SELinux? Particularly on a server running http and ssh services?
Azad's user avatar
  • 201
10 votes
2 answers
1k views

Why does Android use SELinux?

To restrict/sandbox processes Android uses SELinux. Why was that chosen and not the linux capabilities or cgroups+namespaces solution? After all the cgroups+namespaces is kind of home grown for them ...
user220201's user avatar
10 votes
3 answers
66k views

Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?

On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity ...
JJC's user avatar
  • 481
9 votes
5 answers
2k views

Prevent apps from having full access to user files

Applications should not have access to data of other applications or to user's private data unless user allows them. Isn't this an obvious need? But every program we launch has full access to our $...
Sion0's user avatar
  • 101
9 votes
3 answers
7k views

Restrict network access for a single process with SELinux or AppArmor

I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with ...
scythargon's user avatar
8 votes
2 answers
15k views

Difference between SELinux booleans "httpd_can_network_relay" and "httpd_can_network_connect"

I'm in the process of enabling SELinux on my CentOS 7.3 server. I have it set in permissive mode and monitoring the audit log for denials. I'm looking to implement the minimal set of rules that will ...
user avatar
8 votes
1 answer
1k views

How does SELinux affect the Linux Kernel networking stack?

I'm interested in how SELinux effects the processing of packets through the networking stack. I've found the following questions and answers: Network policies under AppArmor/SELinux Filtering ...
RoraΖ's user avatar
  • 12.5k
7 votes
2 answers
1k views

SELinux and text relocations exploitability

I have been assigned the task of adopting and implementing a certain backup software solution for our GNU/Linux farm. As per my deparment defined requirements, this solution should support SELinux ...
dawud's user avatar
  • 448
7 votes
2 answers
240 views

Opt-in a security profile at runtime, without tedious setup

I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish. I would like to be able to ...
fluxrider's user avatar
  • 171
6 votes
1 answer
2k views

Is the native sandbox of Chrome and Firefox enough or would SELinux improve its security?

Chrome on Windows and Linux and Firefox on Windows are executed in a sandbox. On Linux, is the Chrome sandbox enough or would we gain security if we use SELinux to protect the Chrome execution? I ...
Eloy Roldán Paredes's user avatar
6 votes
2 answers
3k views

What are the practical differences between SELinux targeted mode and a capability based OS?

I recently asked a question about the differences between capabilities and mandatory access controls. Among the answers I got the point was made that systems like SE Linux in targeted mode are not a ...
Sonny Ordell's user avatar
  • 3,596
5 votes
1 answer
652 views

Should I install SELinux onto personal machines?

I came across SELinux this week and the concepts seem interesting. However I don't see the use of SELinux being promoted as much as I expected. Why is this the case and would anyone recommend ...
Us3rname's user avatar
  • 131
5 votes
6 answers
10k views

Alternatives to SELinux and AppArmor? [closed]

With SELinux developed by NSA and AppArmor by Novell [*], what alternate solutions exists when trying to lock down a system and running applications, based on ACL and similar concepts like Zones on ...
that guy from over there's user avatar
5 votes
3 answers
4k views

Wildcard Paths with semanage fcontext

I am trying to set SELinux contexts within a directory structure. So it is something like this: /var/www/sites /www.example.com /html /logs /www.example.org /html ...
user avatar
5 votes
1 answer
2k views

Do AppArmor/SELinux provide any security for workstation?

I decided to harden security on my primary workstation a bit. Before I used to use firejail for certain less trusted apps (all apps with internet access) but it's kind of toy. Didn't work really well ...
Lapsio's user avatar
  • 217
5 votes
2 answers
485 views

How to build arbitrary Dockerfile Images Without Compromising Host

I'm building a server that will build images directly from Dockerfile: docker build -t arbitrarydocker . This docker file will be built on the same server as other client Dockerfiles, which may have ...
Dr.Knowitall's user avatar
5 votes
1 answer
303 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables. Since it's a kernel related topic, at the ...
Parsa Samet's user avatar
4 votes
1 answer
7k views

How to know if setroubleshoot is running in Centos 7.2

I have tried systemctl status setroubleshootd.service, but I get ● setroubleshootd.service Loaded: not-found (Reason: No such file or directory) Active: inactive (dead) Neither does setroubleshootd ...
ARX's user avatar
  • 221
4 votes
1 answer
346 views

Can too restrictive Linux MAC policy decrease security?

Can too restrictive MAC profile (e.x. AppArmor profile) decrease application security? For example: could it be that too restrictive environment for web browser will protect host system very well ...
Vladimir Berlev's user avatar
4 votes
3 answers
654 views

Defense-In-Depth With Common Security Controls

Many operating systems implement system capabilities, Posix access controls (DAC/ACLs) and mandatory access controls (SELinux), each using different underlying security controls to provide individual ...
Whome's user avatar
  • 1,239
4 votes
1 answer
5k views

How do I setup SELinux to act a as a true whitelisting solution?

I am working on an appliance device running Linux. I would like to utilize the work done so far with the targeted policy in SELinux space. Since I own everything that should be installed and running ...
IguyKing's user avatar
3 votes
3 answers
3k views

SELinux vs. Antivirus

I am working with an enterprise network with sensitive data nad am not sure if I should use SELinux or an Antivirus for the Servers, POS Terminals, and Desktop Machines. I need to know what the ...
tross44's user avatar
  • 33
3 votes
2 answers
3k views

What is the state of SELinux and are there alternatives?

I have a bunch of virtual machines each one doing a dedicated task: one is hosting a database, another one is a web server using a specific technology, another one is a web server using a different ...
Arseni Mourzenko's user avatar
3 votes
3 answers
5k views

Apparmor system-wide security -- white-listing

I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those ...
securecurve's user avatar
3 votes
1 answer
572 views

Preventing access to file for process running as root

I have a client with a legacy application running on RH 3 (=the latest version supported by app). There is a process that has to run as root (and not in a chroot environment). I need to prevent this ...
Zek's user avatar
  • 133
3 votes
1 answer
2k views

Filtering network access on a user/group/process basis

I am interested in peoples thoughts on what the best approach would be to controlling access to network interfaces at a user/group/process level for a Linux based host. The scenario I have in mind is ...
blueglowey's user avatar
2 votes
2 answers
346 views

Is it possible to boot into root's /bin/bash on a LUKS encrypted device?

I have to check the possibility of case mentioned in the title. An average Linux could be booted up into root's terminal directly without authentication by modifying kernel boot parameters. I'd like ...
sh4d0w's user avatar
  • 325
2 votes
1 answer
157 views

Can I use SELinux to add an extra layer of protection against 0-day VM escape exploits in KVM/QEMU?

My host is Fedora, and I want to add an extra layer of protection against 0day KVM/QEMU exploits that execute code on the host. For example there have been CVEs where if we run a specially crafted ...
OneAndOnly's user avatar
2 votes
1 answer
2k views

Wise/Safe to use Firejail within a SELinux preconfigured O/S?

In my testing of Fedora 29 and came to find it uses SELinux by default; I installed firejail which is available in the repos. Is there any benefit to running Firejail within this environment or is it ...
Tyler's user avatar
  • 445
2 votes
1 answer
641 views

Sandbox for GNU/Linux secure enough to run malware in it without harm [closed]

I am seemkng for a sandbox for Linux secure enough to run malware in it securely. It should allow create different sandboxes run different programs in them, including the ones requiring admin ...
KOLANICH's user avatar
  • 900
2 votes
1 answer
2k views

How to find an appropriate SELinux type to prevent "permission denied"

Objective Find out a solution to avoid the permission denied due to SELinux. Background Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
mon's user avatar
  • 295
2 votes
3 answers
2k views

Allow access to a directory for certain application only

I would like to restrict an access to a directory. For example, on my system there is ~/.thunderbird directory that contains settings, letters, caches, etc of Thunderbird mail client. Obviously, other ...
flaz14's user avatar
  • 121
2 votes
1 answer
1k views

NIST 800-53 rev 4 - CM-7(2) implementation on Linux

NIST 800-53 rev 4 CM-7(2) states: (2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION The information system employs automated mechanisms to prevent program execution in accordance with [Selection (...
positive return's user avatar
2 votes
1 answer
853 views

SELinux related to fips 140-2?

I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros. Is SELinux somehow related to FIPS requirements? ...
user3087632's user avatar
2 votes
1 answer
621 views

Linux security modules (LSM) and reference monitor implementation

as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision. Furthermore, I think the Linux ...
urandom's user avatar
  • 171
2 votes
1 answer
166 views

Is there a good reason (and what can it be) to require DAC restriction on IPC in addition to SELinux rules?

Our company is developing an AOSP-based platform for our customer. Some of our vendor services are using HWBinder for IPC which is using SELinux to restrict service discovery and access. The problem ...
r3mus n0x's user avatar
  • 121
2 votes
1 answer
2k views

SELinux Privilege Escalation Metasploit Nexus 5 Android 5.0.1 LRX22C after Stagefright

I am preparing a part of a security awareness day and one part of the "show" should be about mobile security. I thought about showing the stagefright exploit. So I started with getting a mobile phone ...
Agent H.'s user avatar
2 votes
1 answer
521 views

SELinux: command line tool to look security context (like selabel_lookup(3))

The selabel_lookup(3) library function gives a way to obtain the SELinux security context information for a file - or rather what security label a file is expected to have [1]. Is there a command ...
Juan's user avatar
  • 151
2 votes
1 answer
973 views

Why doesn't SELinux prevent access to this file?

I have a vanilla CentOS 7 box with SELinux enforcing with the targeted policy: $ ls -lZ /etc/resolv.conf -rw-r--r--. root root system_u:object_r:net_conf_t:s0 /etc/resolv.conf $ sudo id -Z ...
Anthony Kraft's user avatar
2 votes
0 answers
595 views

How to harden portable Tor Browser installation (SELinux, sandbox)?

tldr How can I define a SELinux policy, that limits filesystem access of portable Tor Browser to its installation directory, say /home/user/.local/opt/tor-browser_en-US? How might Tor Browser be ...
reynor's user avatar
  • 21
2 votes
2 answers
970 views

Linux whitelist-based Mandatory Access Control instead of a blacklist-based model

I'm trying to harden a Linux installation on a personal computer - I decided to try both SELinux and AppArmor as a Mandatory Access Control (MAC) to supplement the default Discretionary Access Control ...
Dcompoze's user avatar
  • 131
2 votes
0 answers
2k views

Ways to transition SELinux domain / process context (securing SELinux boundaries)

(Apologies for multi-question. Theme is the same, but there are quite a few edge cases.) Browsing the web, I come across resources (see below), but they don't make this quite clear what the situation ...
domen's user avatar
  • 1,050
2 votes
1 answer
393 views

SELinux vs Vanilla Red Hat? [closed]

Im trying to find a good comparison between SELinux vs Vanilla Red Hat. Im building a mission critical system, and am looking for the best security measures regardless of complexity to setup. Does ...
shadee's user avatar
  • 21
2 votes
3 answers
396 views

Linux File Security when connected to internet [closed]

Let me first admit that I am a nobody in computer security - I just know the various threats generally known to public. I have a Linux Cent OS 7 installed on my computer which is connected to the ...
kausDix75's user avatar