Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card information and other sensitive stuff) instead of just denying the application's action, which could be desired (eg. an email client wanting to sign an email on the user's request).

It will be beneficial to set up strict default security policies for vulnerable applications (especially web browsers and email clients) and let the user decide, whether a given action is desired or not, so vulnerability of the system can be avoided without worsening the user-friendliness.


You can take a look at the audit subsystem ( and auditd ). There is however some code to write to have a dbus enabled system to have a popup on the desktop. You can take a look at the mandi software, from mandriva ( http://wiki.mandriva.com/en/Projects/Interactive_Firewall ).


incron and inotify would let you do some action when specified files are touched.

To see this, install inotify-tools and run inotifywait -m ~/someFile. While that's running in one window, edit the file in another window. You'll see something like:

$ inotifywait -m /home/user/Dropbox/.dropbox
Setting up watches.  
Watches established.
/home/user/Dropbox/.dropbox MODIFY 
/home/user/Dropbox/.dropbox OPEN 
/home/user/Dropbox/.dropbox MODIFY 
/home/user/Dropbox/.dropbox CLOSE_WRITE,CLOSE 

Then you can edit your (or roots) incrontab just like you would edit your (or roots) crontab: incrontab -e. With the above example, you could add the following:

/home/user/Dropbox/.dropbox MODIFY /path/to/program/you/want/to/run

Check the documentation for more information.


The FEdora Core 15 SELinux advisor sort of works that way (it pops up a GUI Window when a security breach is detected in SELinux and advises workaronds if the attempt is legitimate). How it is done, though, I do not know.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.