Chapter 7. Securing Programs Using Sandbox
The sandbox security utility adds a set of SELinux policies that allow a system administrator to run an application within a tightly confined SELinux domain. Restrictions on permission to open new files or access to the network can be defined. This enables testing the processing characteristics of untrusted software securely, without risking damage to the system.
7.1. Running an Application Using Sandbox
Before using the sandbox utility, the policycoreutils-sandbox package must be installed:
~]# yum install policycoreutils-sandbox
The basic syntax to confine an application is:
~]$sandbox[options]application_under_test
To run a graphical application in a sandbox, use the
-X option. For example:
~]$Thesandbox-Xevince
-X tells sandbox to set up a confined secondary X Server for the application (in this case, evince), before copying the needed resources and creating a closed virtual environment in the user’s home directory or in the /tmp directory.
To preserve data from one session to the next:
~]$Note thatsandbox-Hsandbox/home-Tsandbox/tmp-Xfirefox
sandbox/home is used for /home and sandbox/tmp is used for /tmp. Different applications are placed in different restricted environments. The application runs in full-screen mode and this prevents access to other functions. As mentioned before, you cannot open or create files except those which are labeled as sandbox_x_file_t.
Access to the network is also initially impossible inside the
sandbox. To allow access, use the sandbox_web_t label. For example, to launch Firefox:
~]$sandbox‑X‑tsandbox_web_tfirefox
Warning
The
sandbox_net_t label allows unrestricted, bi-directional network access to all network ports. The sandbox_web_t allows connections to ports required for web browsing only.
Use of
sandbox_net_t should made with caution and only when required.
See the
sandbox (8) manual page for information, and a full list of available options.
