Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm following the Debian SELinux setup guide with my Linux Mint Debian Edition system. I installed the necessary packages:

sudo aptitude install selinux-basics selinux-policy-default selinux-utils policycoreutils

Activated SELinux and rebooted twice:

sudo selinux-activate

Checked the installation. No critical errors were reported:

sudo check-selinux-installation

When I run a simple sandbox command, e.g.

sandbox -X -H ~/selinux/home -T ~/selinux/tmp -t sandbox_web_t firefox

it tells me that the sandbox command wasn't found. I've seen other questions that seem to indicate with Debian, there are issues with the sandbox command, but its nonexistence isn't one of them.

Running semodule -l or locate *.pp | grep sandbox doesn't list the sandbox module either, so is it simply not installed? Is there another way I can check? The version of selinux-basics I'm using is 0.5

share|improve this question
up vote 2 down vote accepted

The sandbox command was removed from the package because it was not ready for release. Here is the changelog entry for the removal from the command from the policycoreutils package:

  • Removed sandbox because it's a new feature that we never had working, also removed seunshare because it's not needed and brought in an annoying dependency on libcgroup1 Closes: #678590

It looks like it is still removed from the latest package from experimental. If you need the command, you will need to compile it from source or rebuild the Debian package without the sandbox removal patch.

share|improve this answer
That's really unfortunate. Since the AppArmor equivalent isn't ready for general release either, what options does that leave me? Virtualization or a chroot? That's a separate question, however. – Ricardo Altamirano Mar 7 '13 at 3:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.