Introducing the SELinux Sandbox
The other day some of my colleagues and I were discussing a recent request for the Linux Kernel to add "security sandbox" functionality. We talked about how we could do this with SELinux. The discussions brought up an old Bug report of my about writing policy for the "little things". SELinux does a great job of confining System Services, but what about applications executed by users.  The bug r
SELinuxã§ã„ã‚ã„ã‚ãƒãƒƒã‚¯ã‚¢ãƒƒãƒ—ï¼ãƒªã‚¹ãƒˆã‚¢ã—ã¦ã¿ãŸâ€• ï¼ IT
第2回 SELinuxã§ã„ã‚ã„ã‚ãƒãƒƒã‚¯ã‚¢ãƒƒãƒ—ï¼ãƒªã‚¹ãƒˆã‚¢ã—ã¦ã¿ãŸ é¢ å’Œæ¯… サイオステクノãƒã‚¸ãƒ¼æ ªå¼ä¼šç¤¾ OSSテクノãƒã‚¸ãƒ¼ã‚»ãƒ³ã‚¿ãƒ¼ 開発支æ´ã‚°ãƒ«ãƒ¼ãƒ— グループマãƒãƒ¼ã‚¸ãƒ£ãƒ¼ 2007/6/20 今回ã¯ã€å‰å›žã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ—ã—ãŸPloneï¼Zopeã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„管ç†ã‚·ã‚¹ãƒ†ãƒ を基ã«ã€SELinuxを有効ã«ã—ãŸå ´åˆã®ãƒãƒƒã‚¯ã‚¢ãƒƒãƒ—ã«é–¢ã—ã¦è€ƒå¯Ÿã—ã¦ã¿ã¾ã—ょã†ã€‚引ã続ãã€å‰å›žä½œæˆã—ãŸCentOS 4.4＋Plone用ã«ã‚«ã‚¹ã‚¿ãƒžã‚¤ã‚ºã—ãŸSELinuxを用ã„ã¾ã™ã€‚ SELinuxã®ãƒãƒƒã‚¯ã‚¢ãƒƒãƒ—ã«ã“ã ã‚ã‚‹ç†ç”± ãƒãƒƒã‚¯ã‚¢ãƒƒãƒ—ï¼ãƒªã‚¹ãƒˆã‚¢ã¯Linuxé‹ç”¨ã®åŸºç¤Žã®åŸºç¤Žã§ã¯ï¼Ÿ ã¨æ€ã‚ã‚ŒãŸã‹ã‚‚ã—ã‚Œã¾ã›ã‚“。ã‚ãˆã¦SELinuxã®ãƒãƒƒã‚¯ã‚¢ãƒƒãƒ—ã«ã“ã ã‚ã£ãŸç†ç”±ã¯ã€SELinuxã«ã¯ãƒ•ã‚¡ã‚¤ãƒ«ã‚·ã‚¹ãƒ†ãƒ 上ã§ã€Œæ‹¡å¼µå±žæ€§ï¼ˆXATTR）ã€æƒ…å ±ã‚’æŒã¤ã¨ã„ã†ç‰¹å¾´ãŒã‚ã‚‹ã‹ã‚‰ã§ã™ã€‚ 従ã£ã¦å®Ÿéš›ã«é‹ç”¨ã—ã¦ã„ãã†ãˆã§ã¯ã€å„種ãƒãƒƒã‚¯ã‚¢ãƒƒãƒ—プãƒã‚°ãƒ©ãƒ ã«ã‚ˆã£ã¦å–
ã‚»ã‚ュアＯＳã®è½ã¨ã—ç©´
[evil@gateway.example.com ~] $ ssh [email protected] root:$1$d8kgaeX7$PqJEIeNsGAGPw4WwiVy0C/:14217:0:99999:7::: bin:*:14189:0:99999:7::: daemon:*:14189:0:99999:7::: adm:*:14189:0:99999:7::: lp:*:14189:0:99999:7::: sync:*:14189:0:99999:7::: shutdown:*:14189:0:99999:7::: halt:*:14189:0:99999:7::: mail:*:14189:0:99999:7::: news:*:14189:0:99999:7::: uucp:*:14189:0:99999:7::: operator:*:14189:0:9
SVirt - SELinux Wiki
Overview sVirt is a community project which integrates Mandatory Access Control (MAC) security and Linux-based virtualization (KVM, lguest et al). sVirt was created by James Morris Resources Presentations "sVirt: Hardening Linux Virtualization with Mandatory Access Control" presented at linux.conf.au 2009 Code drops v0.10 v0.20 v0.30 Now merged into upstream libvirt. Requirements analysis v1.0 Pro
ãŠçŸ¥ã‚‰ã›
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
audit2allow ? Why not audit2dontaudit?
Why doen't SELinux give me the full path in an error message?
SELinux and guestfish
Cool things with SELinux... Introducing sandbox -X
Tip: Autorelabel a VM
More on guestfish and SELinux
Secure Virtualization Using SELinux (sVirt)
Understanding SELinux
What's new in Fedora 11 from SELinux
PECL :: Package :: selinux
selinux-policy-minimum
The incredible shrinking SELinux footprint
Redesign of setroubleshooter.
Security-Enhanced Linux
Security vs Usability
Adventures with a certain Xen vulnerability (in the PVFB backend) version 1.0 Rafal Wojtczuk Invisible Things Lab 
{{#tags}}- {{label}}
{{/tags}}