Skip to main content

Questions tagged [lsm]

Linux Security Modules (LSM) is a framework that allows the Linux kernel to support a variety of computer security models while avoiding favoritism toward any single security implementation.

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

Prevent a program from writing the HOME directory using SMACK

I have a binary program that creates an empty folder in the HOME directory everytime it starts up. I don't like that and want to use the SMACK mechanism to stop it from doing that. My idea is to label ...
Xinyu Wang's user avatar
0 votes
1 answer
57 views

Why the struct lsm_id is not present in linux kernel source tree

I am writing an LSM, and I am compiling it using my kernel 6.2.0-20-generic. When I browse the files in /lib/modules/6.2.0-20-generic/build, I can see that there is a struct named lsm_id. But When I ...
maysara's user avatar
  • 103
0 votes
1 answer
163 views

Setting file contexts on /proc files

I want to restrict access to files in /proc as much as possible using SELinux. When I try to chcon a directory in /proc, it fails: $ chcon -t staff_proc_t /proc/acpi chcon: failed to change context of ...
jiwopene's user avatar
  • 1,071
-1 votes
1 answer
711 views

ebpf: sending data from userspace and waiting for that

I'm using ebpf and bcc to write an ebpf-lsm program. I want to block a connected USB device and send its info to userspace and the user send me whether I bind that device or no. how can I do this? I ...
Redwan's user avatar
  • 1
1 vote
1 answer
1k views

Interception syscalls and make change in their arguments

I'm interested to write a kernel program that can have all possible controls on syscalls, such as intersection, filtering, and make changes in their arguments. I look up for two goals: read system ...
Mostafa Sarmad's user avatar
1 vote
1 answer
92 views

Linux Security Modules - SELinux/AppArmor

can someone explain to me why SELinux is officially broken under Ubuntu while AppArmor works fine? AppArmor is build on the "Linux Security Modules" framework and so is SELinux. As a result, ...
Questa's user avatar
  • 11
3 votes
1 answer
470 views

Are LSM tools such as AppArmor and SELinux considered IDS/IPS? [closed]

I know this is kind of an odd question. An IDS/IPS basically autonomously recognizes and optionally prevents intrusions. And while SELinux and AppArmor seem to be trying to do the same, they are never ...
Nephilim's user avatar
1 vote
1 answer
634 views

How can I recompile only a specific part of the Linux kernel on Debian Buster?

I'm currently developing a Linux Security Module which is stored in the security directory of the kernel source tree. When I compile and install the kernel using the following commands, the module is ...
unbekannt's user avatar
0 votes
0 answers
39 views

Is it possible to modify output of read event by other process?

I want to intercept event and then modify output. So main question not about how to get notification about event, but how to modify output. Example Content of file.txt Current user is When some ...
Sonique's user avatar
  • 101
1 vote
1 answer
471 views

LSM Hooks - What is the difference between inode hooks to path hooks

There are two groups of LSM hooks under Security hooks for inode operations: inode_* and path_*. Many of them look identical. For example, inode_link and path_link. What is the difference between the ...
Yosef Arbiv's user avatar
1 vote
1 answer
1k views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
pkaramol's user avatar
  • 2,879
2 votes
0 answers
2k views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
Graham Nicholls's user avatar
14 votes
1 answer
19k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
arif's user avatar
  • 1,489
2 votes
1 answer
4k views

Enabling AppArmor in Linux

I've compiled a kernel (linux-libre-xtreme) with this configuration, it has most LSMs enabled: YAMA, SMACK, AppArmor, TOMOYO and SELinux. However, when I start the apparmor service with OpenRC I get: ...
Megver83's user avatar
  • 301
1 vote
1 answer
812 views

Is it MAC or DAC

I am having trouble seeing the utility or use of the LSM attribute/caps implementations. I've put together a pseudo code snippet of sorts to try to express my concern and question. It's modeled ...
user avatar
1 vote
0 answers
428 views

Selinux inode security struct allocation

i'm trying to understand allocation of inode_security_struct in Selinux. I looked for a source code of selinux and there is only one allocation of this struct on line 230 in hooks.c file. This ...
viliam's user avatar
  • 11
2 votes
1 answer
411 views

Why are there no LSM hooks in the POSIX IPC APIs?

As I understand it, the Linux Security Module (LSM) framework has many hooks which are callbacks for security modules to register functions performing additional security checks before security-...
lgeorget's user avatar
  • 14k
7 votes
2 answers
5k views

How to determine if and which linux security module (LSM) is available?

Is there a way to find out if and in case which linux security LSM (apparmor, selinux, grsecurity) is used by the kernel? To be more specific let's assume I am a legimate root user of the machine? If ...
humanityANDpeace's user avatar
4 votes
2 answers
840 views

Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?

In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?". User @IwillnotexistIdonotexist ...
slm's user avatar
  • 372k