Prompt user on Linux security denial

Question

Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card information and other sensitive stuff) instead of just denying the application's action, which could be desired (eg. an email client wanting to sign an email on the user's request).

It will be beneficial to set up strict default security policies for vulnerable applications (especially web browsers and email clients) and let the user decide, whether a given action is desired or not, so vulnerability of the system can be avoided without worsening the user-friendliness.

Answer 1

incron and inotify would let you do some action when specified files are touched.

To see this, install inotify-tools and run inotifywait -m ~/someFile. While that's running in one window, edit the file in another window. You'll see something like:

$ inotifywait -m /home/user/Dropbox/.dropbox
Setting up watches.  
Watches established.
/home/user/Dropbox/.dropbox MODIFY 
/home/user/Dropbox/.dropbox OPEN 
/home/user/Dropbox/.dropbox MODIFY 
/home/user/Dropbox/.dropbox CLOSE_WRITE,CLOSE 

Then you can edit your (or roots) incrontab just like you would edit your (or roots) crontab: incrontab -e. With the above example, you could add the following:

/home/user/Dropbox/.dropbox MODIFY /path/to/program/you/want/to/run

Check the documentation for more information.

Answer 2

You can take a look at the audit subsystem ( and auditd ). There is however some code to write to have a dbus enabled system to have a popup on the desktop. You can take a look at the mandi software, from mandriva ( http://wiki.mandriva.com/en/Projects/Interactive_Firewall ).

Answer 3

The FEdora Core 15 SELinux advisor sort of works that way (it pops up a GUI Window when a security breach is detected in SELinux and advises workaronds if the attempt is legitimate). How it is done, though, I do not know.