Contents
When to use sandbox utility in SELinux?
You can use the sandbox utility to run an application in an SELinux “sandbox” that is confined to reading and writing standard in ( stdin ), standard out ( stdout ), and other file descriptors passed on the command line.
Can you run an application in a sandbox?
To put it more simply: Applications running in a sandbox are very restricted, and can’t read or write to files that aren’t explicitly allowed. Unless explicitly permitted, they also have no network access and so on. First, I’m doing this on a Fedora 14 system.
Can you run Vim in a sandbox with SELinux?
Now you can read and create files that exist in the sehome directory, and Vim can create its temporary files without being stopped by SELinux. But, you still can’t use Ctrl-z to get to a shell from within Vim. Another thing you might notice — things are just a bit slower in the sandbox.
Is it possible to run Firefox on SELinux without network access?
SELinux does add a bit of overhead, not a lot — but it will be noticeable. In particular, you’ll notice a slowdown with more complex GUI apps. But you may want to run things like Firefox in a sandbox if you’re very security and privacy conscious. Now, Firefox is pretty useless without network access.
How to load the SELinux policy in Ubuntu?
If using Ubuntu, download this _load_selinux_policy script (this is a slightly modified version of the script included in the Ubuntu ‘selinux’ package), place it in /usr/share/initramfs-tools/scripts/init-bottom/ then run update-initramfs -u (Upstart in Debian loads the SELinux policy automatically, but Upstart in Ubuntu does not.
How to install and configure SELinux in Debian?
The following steps describe how to install and configure SELinux together with the default policy which enables SELinux for the most important parts of your system (e.g. most Internet-facing daemons, see the policies section below for alternative policies):
Which is the best sandbox program for Linux?
Firejail is a SUID security sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table.
Do you have to enable SELinux on Ubuntu?
If you’re using Ubuntu or openSUSE, or other distros that don’t have SELinux on by default, you may have to jump through some hoops to enable SELinux, but that’s beyond the scope of this article. Let’s start off with a simple application.