2

I'm following the Debian SELinux setup guide with my Linux Mint Debian Edition system. I installed the necessary packages:

sudo aptitude install selinux-basics selinux-policy-default selinux-utils policycoreutils

Activated SELinux and rebooted twice:

sudo selinux-activate

Checked the installation. No critical errors were reported:

sudo check-selinux-installation

When I run a simple sandbox command, e.g.

sandbox -X -H ~/selinux/home -T ~/selinux/tmp -t sandbox_web_t firefox

it tells me that the sandbox command wasn't found. I've seen other questions that seem to indicate with Debian, there are issues with the sandbox command, but its nonexistence isn't one of them.

Running semodule -l or locate *.pp | grep sandbox doesn't list the sandbox module either, so is it simply not installed? Is there another way I can check? The version of selinux-basics I'm using is 0.5

Improve this question

1 Answer 1

Reset to default
2

The sandbox command was removed from the package because it was not ready for release. Here is the changelog entry for the removal from the command from the policycoreutils package:

  • Removed sandbox because it's a new feature that we never had working, also removed seunshare because it's not needed and brought in an annoying dependency on libcgroup1 Closes: #678590

It looks like it is still removed from the latest package from experimental. If you need the command, you will need to compile it from source or rebuild the Debian package without the sandbox removal patch.

Improve this answer
1
  • 1
    That's really unfortunate. Since the AppArmor equivalent isn't ready for general release either, what options does that leave me? Virtualization or a chroot? That's a separate question, however.
    – Ricardo Altamirano
    Mar 7, 2013 at 3:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .