Collaborate Disseminate
I need to intercept log messages from Apache (used as reverse proxy and authentication gateway). In order to do this reliably, I want to use a CustomLogs configuration to run a python script. This is not too complicated. I un… Continue reading SElinux blocks rotatelogs when called from an intermediate script
I have a Linux machine that contains sensitive files. Users should be able to access them (read) when they are using the computer, but should not be able to copy them on another hard drive (USB stick or another hard drive tha… Continue reading How can I prevent a user from copying files on another hard drive?
The premise: on a Linux workstation I regularly download and use various software, let’s say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I can in my home directory,… Continue reading Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it
I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish.
I would like to be able to do this as a normal user, without the in… Continue reading Opt-in a security profile at runtime, without tedious setup
In my testing of Fedora 29 and came to find it uses SELinux by default; I installed firejail which is available in the repos. Is there any benefit to running Firejail within this environment or is it redundant and or potentially opening th… Continue reading Wise/Safe to use Firejail within a SELinux preconfigured O/S?
A serious security vulnerability has been discovered in the core runC container code that affects several open-source container management systems, potentially allowing attackers to escape Linux container and obtain unauthorized, root-level access to t… Continue reading RunC Flaw Lets Attackers Escape Linux Containers to Gain Root on Hosts
I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux.
On CentOS help page , I can see that some files in
/selinux/ are writable by other user : https://www.centos.org/docs/5/html/De… Continue reading Is it dangerous to keep permissions at 666 to member file on SELinux?
Applications should not have access to data of other applications or to user’s private data unless user allows them. Isn’t this an obvious need?
But every program we launch has full access to our $HOME dir, to our mic and cam. Most users w… Continue reading Prevent apps from having full access to user files
Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?
I am trying to block privileges escalations from unprivileged accounts such as www-data.
Basically, if my web server is getting compromised, crackers may find ways to escalate (vulnerabilities found in sudo? root password re… Continue reading selinux : blocking sudo and su usage by placing user into user_t profile