Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card information and other sensitive stuff) instead of just denying the application's action, which could be desired (eg. an email client wanting to sign an email on the user's request).

It will be beneficial to set up strict default security policies for vulnerable applications (especially web browsers and email clients) and let the user decide, whether a given action is desired or not, so vulnerability of the system can be avoided without worsening the user-friendliness.

share|improve this question

You can take a look at the audit subsystem ( and auditd ). There is however some code to write to have a dbus enabled system to have a popup on the desktop. You can take a look at the mandi software, from mandriva ( http://wiki.mandriva.com/en/Projects/Interactive_Firewall ).

share|improve this answer

incron and inotify would let you do some action when specified files are touched.

To see this, install inotify-tools and run inotifywait -m ~/someFile. While that's running in one window, edit the file in another window. You'll see something like:

$ inotifywait -m /home/user/Dropbox/.dropbox
Setting up watches.  
Watches established.
/home/user/Dropbox/.dropbox MODIFY 
/home/user/Dropbox/.dropbox OPEN 
/home/user/Dropbox/.dropbox MODIFY 
/home/user/Dropbox/.dropbox CLOSE_WRITE,CLOSE 

Then you can edit your (or roots) incrontab just like you would edit your (or roots) crontab: incrontab -e. With the above example, you could add the following:

/home/user/Dropbox/.dropbox MODIFY /path/to/program/you/want/to/run

Check the documentation for more information.

share|improve this answer

The FEdora Core 15 SELinux advisor sort of works that way (it pops up a GUI Window when a security breach is detected in SELinux and advises workaronds if the attempt is legitimate). How it is done, though, I do not know.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.