60
votes
Accepted
How can I prevent a user from copying files to another hard drive?
You can disable USB storage on Linux by blacklisting the module.
modprobe -r usb-storage
echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf
echo blacklist uas >> /...
- 15.4k
21
votes
How can I prevent a user from copying files to another hard drive?
Client-server architecture
This is another approach that could make copying files much harder, but it requires investing more effort from your side.
Access to the information could be setup on a ...
- 1,234
19
votes
How can I prevent a user from copying files to another hard drive?
In addition to blocking USB (see other answers above):
Disable networking, because...
... otherwise user will use remote access to your machine, e.g. via scp or ftp, and copy files from your machine....
- 12.2k
13
votes
How can I prevent a user from copying files to another hard drive?
OK, I'm totally not a security expert and maybe this is completely off the mark (let me know in the comments!), but...
If you can secure the box physically (otherwise all bets are off), then maybe ...
- 1,030
10
votes
Does linux support signed binaries?
If you're looking for signed binaries you may find elfsign and elfverify to be of interest to you. This doesn't provide a tie in for the linker. It's a manually process that writes the signature into ...
- 2,702
10
votes
How can I prevent a user from copying files to another hard drive?
VNC
Your files could be stored on a computer in a secure location.
Setup a VNC server on it and disable file transfer capability. Per this question on ServerFault it can be done in TightVNC.
Ensure ...
- 1,234
8
votes
How to know if setroubleshoot is running in Centos 7.2
Found it. The problem is that setroubleshootd does not run permanently in CentOS 7. It is started only when an AVC denial message reaches auditd. This is confusing, since you normally expect a ...
- 221
8
votes
Comparison Between AppArmor and Selinux
SELinux is surely a more complete and ambitious security tool than AppArmor. SELinux is a wide universe, it permeates everything, it potentially labels every object in the system and conceptually ...
- 81
7
votes
Accepted
Should I install SELinux onto personal machines?
However I don't see the use of SELinux being promoted as much as I
expected. Why is this the case...?
SELinux is a security mechanism which, unless properly configured and tuned, is going to be ...
- 72.7k
5
votes
SELinux vs. Antivirus
Should you use SELinux or an antivirus? Yes. SELinux and an antivirus perform complementary tasks, so using both is better than using one or the other.
An antivirus is a tool to find known threats. ...
- 34.6k
5
votes
What are the security implications of disabling SELinux?
SELinux is largely about confining processes to specified resources and not allowing them to access other resources.
SELinux knows what Apache is, what files it should be able to access, what ports ...
- 51
5
votes
Prevent apps from having full access to user files
I recommend looking at AppArmor as an alternative to SELinux; it provides the behavior you want and is simpler to maintain. However, it is a great deal of work to define AppArmor profiles suitable for ...
- 46.4k
5
votes
Accepted
Is AppArmor used in production environments?
AppArmor is enabled by default on Debian (and I believe Ubuntu), so yes, it is clearly being used in production environments. In addition, it is typically used to constrain containers, such as those ...
- 9,294
4
votes
Comparison Between AppArmor and Selinux
From my personal experience using SElinux I would say that it didn't add any amount of complexity to GNU+Linux, the only thing that it did and I consider it an advantage is to bring to us the ...
- 41
4
votes
Accepted
Sandbox for GNU/Linux secure enough to run malware in it without harm
Create different sandboxes
Linux currently supports six kernel namespace types:
IPC namespace
Network namespace
Mount namespace
PID namespace
user namespace
UTS namespace
run different programs ...
- 31.4k
4
votes
Accepted
Do AppArmor/SELinux provide any security for workstation?
I did. You need a plan, and you need to master the tools. You need to be able to compromise where you can and where you have to compromise. You need to work to make it reality.
Access control is part ...
- 56
4
votes
Accepted
What is the state of SELinux and are there alternatives?
SELinux provides a more granular permissions system based on the concept of Mandatory Access Control (MAC) and Role-Based Access Control (RBAC). It's much more flexible and capable than the typical ...
- 16.1k
4
votes
Prevent apps from having full access to user files
Applications should not have access to data of other applications or to user's private data unless user allows them. Isn't this an obvious need?
No, this is not obvious. Traditionally software ...
- 198k
4
votes
Accepted
Wise/Safe to use Firejail within a SELinux preconfigured O/S?
To be clear, this question is more of an opinion than a hard fact.
SELinux and Firejail perform sandboxing by separate means. At its core, SELinux is an advanced access control list (using Labels), ...
- 178
4
votes
Accepted
CIS hardened linux vs SELinux(Security Enhanced)
What are the differences between the CIS hardened linux and
SELinux(security linux)?
The CIS guidelines cover a wide array of settings and configurations which improve security on a given system. ...
- 72.7k
3
votes
Difference between SELinux booleans "httpd_can_network_relay" and "httpd_can_network_connect"
The first option [httpd_can_network_relay] is used in an reverse proxy scenario in which your httpd is relaying requests to some backend httpd in behalf of the client.
The second one [...
- 1,848
3
votes
Apparmor system-wide security -- white-listing
By default AppArmor whitelists all applications/programs. To setup apparmor so all applications/programs by default are blacklisted then you need to setup AppArmor Full System Policy. This is not a ...
3
votes
Does linux support signed binaries?
Does it exist in linux?
No.
if I have an opportunity to do signed binaries or add SElinux policies to all services and contain them as much as possible which one would be a bigger ROI in terms of ...
- 18.6k
3
votes
What is the state of SELinux and are there alternatives?
SELinux is a well written and stable bit of software. However:
it doesn't actually do anything. For that you need a policy.
SELinux was designed to provide a permissions model for a new operating ...
- 18.6k
3
votes
Accepted
Can too restrictive Linux MAC policy decrease security?
A MAC policy should be extremely fine-grained, not necessarily extremely restrictive.
It can decrease security under certain conditions. Applications, especially complex ones, often have fallbacks ...
- 66.5k
3
votes
Accepted
Auditd logging related to SELinux?
SELinux uses auditd for logging purposes, but auditd is independent from it. You can use auditd without SELinux present.
- 6,428
3
votes
How can I prevent a user from copying files to another hard drive?
If you just want to disable all usb devices, have a look at usb-storage.ko (USB Mass Storage driver under Linux). Disabling the driver would affect all usb devices, keyboards/mice included. To disable ...
- 203
2
votes
Defense-In-Depth With Common Security Controls
would defense-in-depth still be achieved even though all three security controls have at least one common attack surface?
No, you can see it very well with anti-virus software for instance: they look ...
- 19.2k
Only top scored, non community-wiki answers of a minimum length are eligible