Chapter 7. Securing Programs Using Sandbox
The sandbox security utility adds a set of SELinux policies that allow a system administrator to run an application within a tightly confined SELinux domain. Restrictions on permission to open new files or access to the network can be defined. This enables testing the processing characteristics of untrusted software securely, without risking damage to the system.
7.1. Running an Application Using Sandbox
Before using the sandbox utility, the policycoreutils-sandbox package must be installed:
yum install policycoreutils-sandbox
The basic syntax to confine an application is:
To run a graphical application in a sandbox, use the
-Xoption. For example:
-Xtells sandbox to set up a confined secondary X Server for the application (in this case,
evince), before copying the needed resources and creating a closed virtual environment in the user’s
homedirectory or in the
To preserve data from one session to the next:
sandbox/homeis used for
sandbox/tmpis used for
/tmp. Different applications are placed in different restricted environments. The application runs in full-screen mode and this prevents access to other functions. As mentioned before, you cannot open or create files except those which are labeled as
Access to the network is also initially impossible inside the
sandbox. To allow access, use the
sandbox_web_tlabel. For example, to launch Firefox:
sandbox_net_tlabel allows unrestricted, bi-directional network access to all network ports. The
sandbox_web_tallows connections to ports required for web browsing only.
sandbox_net_tshould made with caution and only when required.
sandbox (8)manual page for information, and a full list of available options.