Selinux Profile

[Japplo]

Hi! I have some questions regarding selinux. Is it possible to create a selinux profile for a program like with Apparmor?

[domg472]

I have no experience with apparmor but you can create sandboxes(profiles?) for your applications with selinux

[bodhi.zazen]

Originally Posted by Japplo

Hi! I have some questions regarding selinux. Is it possible to create a selinux profile for a program like with Apparmor?

Yes, but the syntax and terminology are not as easy to understand.

Start by reading on how selinux works.

http://fedoraproject.org/wiki/SELinux

http://docs.fedoraproject.org/en-US/...nhanced_Linux/

http://docs.fedoraproject.org/en-US/...ined_Services/

Then read on how to write a policy. The end of this document covers the basics

http://wiki.centos.org/HowTos/SELinux

See also this discussion

http://serverfault.com/questions/158...derstanding-it

and dan walsh's blog

[Japplo]

I'v read many sites of selinux and I don't know how it exactly works. I like to create a profile for example for pokerth. Can I easy deny the internet-access for an application?? What I need, is I think a step-tp-step How-To.

[domg472]

There is no step by step howto. There is a book that tries to explain some policy writing but it is a bit outdated and it costs money (http://www.selinuxbyexample.com)

I guess i could help you write a policy, and although that may give you some insight, do not expect that it will make everything clear about selinux.

If you want some guidance, you can come see me on irc (irc.freenode.org channel #fedora-selinux) my nick name there is dgrift

policy writing in itself is not so hard but it requiires knowledge about security, computer security and the linux system. also it requires that you know the basics and not so basics of selinux.