Questions tagged [lsm]

Linux Security Modules (LSM) is a framework that allows the Linux kernel to support a variety of computer security models while avoiding favoritism toward any single security implementation.

Filter by
Sorted by
Tagged with
3
votes
1answer
108 views

Are LSM tools such as AppArmor and SELinux considered IDS/IPS? [closed]

I know this is kind of an odd question. An IDS/IPS basically autonomously recognizes and optionally prevents intrusions. And while SELinux and AppArmor seem to be trying to do the same, they are never ...
1
vote
1answer
51 views

How can I recompile only a specific part of the Linux kernel on Debian Buster?

I'm currently developing a Linux Security Module which is stored in the security directory of the kernel source tree. When I compile and install the kernel using the following commands, the module is ...
0
votes
0answers
29 views

Is it possible to modify output of read event by other process?

I want to intercept event and then modify output. So main question not about how to get notification about event, but how to modify output. Example Content of file.txt Current user is When some ...
0
votes
1answer
110 views

LSM Hooks - What is the difference between inode hooks to path hooks

There are two groups of LSM hooks under Security hooks for inode operations: inode_* and path_*. Many of them look identical. For example, inode_link and path_link. What is the difference between the ...
1
vote
1answer
648 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
2
votes
0answers
1k views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
9
votes
1answer
14k views

Core difference between SELinux and Apparmor

What is the core [or kernel level] difference of SELinux and Apparmor?
2
votes
1answer
2k views

Enabling AppArmor in Linux

I've compiled a kernel (linux-libre-xtreme) with this configuration, it has most LSMs enabled: YAMA, SMACK, AppArmor, TOMOYO and SELinux. However, when I start the apparmor service with OpenRC I get: ...
1
vote
1answer
660 views

Is it MAC or DAC

I am having trouble seeing the utility or use of the LSM attribute/caps implementations. I've put together a pseudo code snippet of sorts to try to express my concern and question. It's modeled ...
1
vote
0answers
304 views

Selinux inode security struct allocation

i'm trying to understand allocation of inode_security_struct in Selinux. I looked for a source code of selinux and there is only one allocation of this struct on line 230 in hooks.c file. This ...
2
votes
1answer
283 views

Why are there no LSM hooks in the POSIX IPC APIs?

As I understand it, the Linux Security Module (LSM) framework has many hooks which are callbacks for security modules to register functions performing additional security checks before security-...
7
votes
2answers
3k views

How to determine if and which linux security module (LSM) is available?

Is there a way to find out if and in case which linux security LSM (apparmor, selinux, grsecurity) is used by the kernel? To be more specific let's assume I am a legimate root user of the machine? If ...
4
votes
2answers
710 views

Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?

In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?". User @IwillnotexistIdonotexist ...