Top all-time · #3147
D
Dan Walsh
Personal blog · danwalsh.livejournal.comsecuritysystems
Dan Walsh writes LiveJournal, a personal blog at danwalsh.livejournal.com about security and systems. Since 2008, 24 different Hacker News readers have linked it 27 times, most often “What does SELinux do to contain the the bash exploit?”. No feed was found, so read it on the site itself.
No feed foundVisit the blog
27mentions?
24HN people?
2008–2026first – last linked?
Got SELinux?
Most-linked posts?
- What does SELinux do to contain the the bash exploit?4 people · 4 mentions · first linked 2014-09-26
- /31146.html3 people · 5 mentions · first linked 2010-10-23
- /28545.html3 people · 3 mentions · first linked 2009-06-01
- /28545.html2 people · 2 mentions · first linked 2015-08-09
What Hacker News says?
Running your browser in Red Hat's SELinux sandbox [1] [2] limits the ports you can connect to and thus limits this type of attack to those ports (80, 81, 443, 488, 8008, 8009, 8443, and 9000 in the default configuration). [1] http://danwalsh.livejournal.com/31146.html [2] http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-...
Comment linking /31146.html
on “How to steal a developer's local database”Submitted What does SELinux do to contain the the bash exploit? as a story · 39 points
HN discussionhttps://www.redhat.com/en/blog/selinux-mitigates-container-v... https://sysdig.com/blog/detecting-mitigating-cve-2022-0492-s... https://danwalsh.livejournal.com/30565.html
Comment linking /30565.html
on “SELinux is unmanageable; just turn it off if it gets in your way”Submitted What does SELinux do to contain the the bash exploit? as a story · 5 points
HN discussionI've run Firefox in a Red Hat/Fedora SELinux sandbox [1] [2] for the past 5 years or so. It is a little more tedious for things such as file uploads/downloads and cut-and-paste -- but worth it, IMHO. [1] http://danwalsh.livejournal.com/31146.html [2] http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-...
Comment linking /31146.html
on “Firefox exploit found in the wild”Submitted Labeling of xen images with SELinux as a story · 1 points
HN discussionThat link 404s due to some url-encoded garbage at the end. This should work: http://danwalsh.livejournal.com/74642.html
Comment linking /74642.html
on “The Cult of DD”It doesn’t. In fact, I would be very careful using subshellsm in general, because it can lead to bugs like this one: http://danwalsh.livejournal.com/74642.html .
Comment linking /74642.html%E2%80%8B
on “The Cult of DD”> Well that's nonsense. SELinux can protect against anything AppArmor can since AppArmor provides only a subset of features. This is from Dan Walsh who is quite famous in the SELinux community [1]. See the part "Why didn't SELinux block it?" Sure you can configure SELinux with a stricter policy, but virtually nobody does that in practice, they use the defaults, mostly because SELinux policies are really only used to…
Comment linking /71122.html
on “The Insecurity of Debian”> Still don't care about the feature set, show me a useful benchmark. "I don't care to understand the differences in security thees systems provide" That's what you're saying here. Which means you're not going to be evaluating these systems in any way that matters. > If SELinux prevents a hypothetical that's great, but security is a tradeoff and I'd opt for convenience and simplicity to sacrifice potentially negligi…
Comment linking /71122.html
on “The Insecurity of Debian”Unfortunately, this is an area that could use some work. Tools for writing new policies are a long way away from what they could/should be. If you need something to work with SELinux that doesn't come with a policy you have essentially three options, in order of preference: 1) Develop a new policy from scratch. This is fairly hard, and the tools, such as they are[0], are not great. There's a couple of good resources…
Comment linking /
on “Stop Disabling SELinux: A Real-World Guide”Funny, I've been running it on my laptop since Fedora 18 (current on 24 Beta). I might notice it maybe once every few months when a script or some software I'm futzing with tries to do something out of the ordinary: [jeff@omniscience ~]$ sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: en…
Comment linking /10131.html
on “SELinux is beyond saving”A possible solution would be sandbox[1], but it requires SELinux which is unavailable under Ubuntu (Ubuntu uses AppArmor). [1] http://danwalsh.livejournal.com/28545.html
Comment linking /28545.html
on “Protecting a Laptop from Simple and Sophisticated Attacks”If Dan Walsh says it's complicated to run a MAC system against browsers specifically and desktop software generally, you have to worry. http://danwalsh.livejournal.com/72697.html I know it is debunked lower in the thread (so long as you do not load suspicious extensions, as explained), but sandboxing browsers seems prudent, and sadly why I am afraid maybe even Qubes is not enough anymore! Haha.
Comment linking /72697.html
on “A Famed Hacker Is Grading Thousands of Programs”The sandbox -X command doesn't work: https://bugzilla.redhat.com/show_bug.cgi?id=1103622 - and hasn't worked for over a year. The author is mia from the bug and seems to have given up: https://danwalsh.livejournal.com/72697.html
Comment linking /72697.html
on “Firefox Under Fire: Anatomy of latest 0-day attack”http://sandbox.libvirt.org/quickstart/ Or even just: http://danwalsh.livejournal.com/28545.html ...an selinux sandbox without the containers stuff.
Comment linking /28545.html
on “LXC 1.0 Released”Plain SELinux would not have prevented this as Firefox would run in your users context (unconfined_t), The alternative is, the sandbox command: https://danwalsh.livejournal.com/28545.html
Comment linking /28545.html
on “Ask HN: Best Linux sandbox?”Fedora and Red Hat (+ the Red Hat clones like CentOS) have a "sandbox" command which uses SELinux to sandbox applications or entire X sessions and the applications inside them. For more info see [1] [2]. I've used it for a long time and it works well enough. It's not available in Ubuntu, though. In Ubuntu the closest thing to it, I think, is AppArmor, but I've never tried it myself. Or you could run a virtual machin…
Comment linking /31146.html
on “Ask HN: Best Linux sandbox?”Originally all the domains had 'svirt' in the name: https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_con... These days containers have their own domains: https://www.mankier.com/8/container_selinux As you say, the principle is the same. [edit] container_t is (or was?) an alias for svirt_lxc_net_t: https://danwalsh.livejournal.com/79191.html
Comment linking /79191.html
on “How We Built SELinux Support for Kubernetes”http://danwalsh.livejournal.com/31146.html One very simple way to get a sandboxed browser is to run this command (my irony meter is going off the charts here): sandbox -X -t sandbox_web_t firefox However, that will prevent any persistence between sessions, so you probably want to do something more like this: sandbox -X -H /path/to/some/directory -t sandbox_web_t firefox My recommendation is that you read the man pag…
Comment linking /31146.html
on ““Hand of Thief” Trojan Targets Linux”"sandbox -X" (writeup at http://danwalsh.livejournal.com/31146.html ) does in fact let you isolate various applications.
Comment linking /31146.html
on “The MS-DOS Security Model”And also the Linux kernel has protections against unsafe symlinks too[1]. [1]: http://danwalsh.livejournal.com/64493.html
Comment linking /64493.html
on “Exploiting ELF Expansion Variables”Keep in mind that the pcnet NIC is not used by default in most QEMU, KVM, or Xen deployments. So it's mostly a problem in scenarios where untrusted users may add pcnet NICs to their VMs. Even then, remember that additional layers of security are available. KVM is typically deployed with unprivileged QEMU processes, locked down with SELinux (more details: https://danwalsh.livejournal.com/71489.html ).
Comment linking /71489.html
on “Heap overflow in QEMU PCNET controller, allowing guest-host escape”Selinux should block the VENOM vulnerability in Qemu: http://danwalsh.livejournal.com/71489.html See also http://www.selinuxproject.org/page/SVirt Keep in mind that Grsec (which is definitely underdeployed in the linux community) is compatible with LSM such as SElinx and AppArmor, so you do not have to choose (you'll take a performance hit, though).
Comment linking /71489.html
on “Container Security with SELinux and CoreOS”I like the semantics of a pipe-oriented flow. Combined with a sandbox[1] and you could accept arbitrary code from customers/clients/whatever. [1] http://danwalsh.livejournal.com/28545.html
Comment linking /28545.html
on “Easy Map-Reduce With Hadoop Streaming”It could be difficult. My first thought would be a SELinux policy like this article attempted: https://danwalsh.livejournal.com/28545.html One might have different profiles with different permissions. A network service usually wouldn't need your hone directory while a personal utility might not need networking. Also, that concept could be mixed with subprocess-style sandboxing. The two processes, main and sandboxed,…
Comment linking /28545.html
on “Python interpreter written in Rust for use by AI”Don't misunderstand my original post. SELinux is AMAZING. But, if SELinux in the default "targeted" policy is the thing that's protecting you, that's good, but it means there are some major bugs or misconfiguration higher up (i.e., in your web server). I assume you know what a network firewall is. Think of SELinux like a "System Call Firewall". SELinux will protect you from many so-called "zero-day" vulnerabilities.…
Comment linking /71122.html
on “Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)”
