Chapter 7. Securing Programs Using Sandbox

The sandbox security utility adds a set of SELinux policies that allow a system administrator to run an application within a tightly confined SELinux domain. Restrictions on permission to open new files or access to the network can be defined. This enables testing the processing characteristics of untrusted software securely, without risking damage to the system.

7.1. Running an Application Using Sandbox

Before using the sandbox utility, the policycoreutils-sandbox package must be installed: 
~]# yum install policycoreutils-sandbox
The basic syntax to confine an application is: 
~]$ sandbox [options] application_under_test
To run a graphical application in a sandbox, use the -X option. For example: 
~]$ sandbox -X evince
The -X tells sandbox to set up a confined secondary X Server for the application (in this case, evince), before copying the needed resources and creating a closed virtual environment in the user’s home directory or in the /tmp directory.
To preserve data from one session to the next: 
~]$ sandbox -H sandbox/home -T sandbox/tmp -X firefox
Note that sandbox/home is used for /home and sandbox/tmp is used for /tmp. Different applications are placed in different restricted environments. The application runs in full-screen mode and this prevents access to other functions. As mentioned before, you cannot open or create files except those which are labeled as sandbox_x_file_t.
Access to the network is also initially impossible inside the sandbox. To allow access, use the sandbox_web_t label. For example, to launch Firefox: 
~]$ sandbox ‑X ‑t sandbox_web_t firefox

Warning

The sandbox_net_t label allows unrestricted, bi-directional network access to all network ports. The sandbox_web_t allows connections to ports required for web browsing only.
Use of sandbox_net_t should made with caution and only when required.
See the sandbox (8) manual page for information, and a full list of available options.