Questions tagged [lsm]
Linux Security Modules (LSM) is a framework that allows the Linux kernel to support a variety of computer security models while avoiding favoritism toward any single security implementation.
18
questions
0
votes
1
answer
46
views
Why the struct lsm_id is not present in linux kernel source tree
I am writing an LSM, and I am compiling it using my kernel 6.2.0-20-generic. When I browse the files in /lib/modules/6.2.0-20-generic/build, I can see that there is a struct named lsm_id. But When I ...
- 103
0
votes
1
answer
85
views
Setting file contexts on /proc files
I want to restrict access to files in /proc as much as possible using SELinux. When I try to chcon a directory in /proc, it fails:
$ chcon -t staff_proc_t /proc/acpi
chcon: failed to change context of ...
- 1,022
-1
votes
1
answer
575
views
ebpf: sending data from userspace and waiting for that
I'm using ebpf and bcc to write an ebpf-lsm program. I want to block a connected USB device and send its info to userspace and the user send me whether I bind that device or no.
how can I do this? I ...
- 1
1
vote
1
answer
828
views
Interception syscalls and make change in their arguments
I'm interested to write a kernel program that can have all possible controls on syscalls, such as intersection, filtering, and make changes in their arguments.
I look up for two goals:
read system ...
1
vote
1
answer
83
views
Linux Security Modules - SELinux/AppArmor
can someone explain to me why SELinux is officially broken under Ubuntu while AppArmor works fine? AppArmor is build on the "Linux Security Modules" framework and so is SELinux. As a result, ...
- 11
3
votes
1
answer
425
views
Are LSM tools such as AppArmor and SELinux considered IDS/IPS? [closed]
I know this is kind of an odd question. An IDS/IPS basically autonomously recognizes and optionally prevents intrusions.
And while SELinux and AppArmor seem to be trying to do the same, they are never ...
- 49
1
vote
1
answer
522
views
How can I recompile only a specific part of the Linux kernel on Debian Buster?
I'm currently developing a Linux Security Module which is stored in the security directory of the kernel source tree. When I compile and install the kernel using the following commands, the module is ...
- 21
0
votes
0
answers
38
views
Is it possible to modify output of read event by other process?
I want to intercept event and then modify output. So main question not about how to get notification about event, but how to modify output.
Example
Content of file.txt
Current user is
When some ...
- 101
1
vote
1
answer
422
views
LSM Hooks - What is the difference between inode hooks to path hooks
There are two groups of LSM hooks under Security hooks for inode operations: inode_* and path_*.
Many of them look identical. For example, inode_link and path_link.
What is the difference between the ...
- 121
1
vote
1
answer
1k
views
SELinux vs AppArmor applicability
I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux.
I am aware of this discussion but this does not make very clear one question I am ...
- 2,689
2
votes
0
answers
2k
views
Yama LSM seems to do nothing. RHEL/Centos 7.5
The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace).
...
- 732
14
votes
1
answer
19k
views
Core difference between SELinux and Apparmor
What is the core [or kernel level] difference of SELinux and Apparmor?
- 1,429
2
votes
1
answer
3k
views
Enabling AppArmor in Linux
I've compiled a kernel (linux-libre-xtreme) with this configuration, it has most LSMs enabled: YAMA, SMACK, AppArmor, TOMOYO and SELinux. However, when I start the apparmor service with OpenRC I get:
...
- 301
1
vote
1
answer
797
views
Is it MAC or DAC
I am having trouble seeing the utility or use of the LSM attribute/caps implementations.
I've put together a pseudo code snippet of sorts to try to express my concern and question. It's modeled ...
user33567
1
vote
0
answers
405
views
Selinux inode security struct allocation
i'm trying to understand allocation of inode_security_struct in Selinux. I looked for a source code of selinux and there is only one allocation of this struct on line 230 in hooks.c file. This ...
- 11
2
votes
1
answer
389
views
Why are there no LSM hooks in the POSIX IPC APIs?
As I understand it, the Linux Security Module (LSM) framework has many hooks which are callbacks for security modules to register functions performing additional security checks before security-...
- 13.8k
7
votes
2
answers
5k
views
How to determine if and which linux security module (LSM) is available?
Is there a way to find out if and in case which linux security LSM (apparmor, selinux, grsecurity) is used by the kernel?
To be more specific let's assume I am a legimate root user of the machine?
If ...
- 14.1k
4
votes
2
answers
822
views
Are there other LSM (Linux Security Modules) in addition to SELinux and AppArmor?
In researching this U&L Q&A titled: permission denied for ptrace under GDB, the question came up, "Is there other software similar to SELinux & AppArmor?".
User @IwillnotexistIdonotexist ...
slm♦
- 367k