3 ms·
Not sure what your goals are specifically, but even apparmor and selinux can do things like block access to the network, limit read and/or write access to certa
by sliken 5y ago
Not sure what your goals are specifically, but even apparmor and selinux can do things like block access to the network, limit read and/or write access to certain directories, limiting what system calls can be made, and notify you of failed attempts.
I didn't (at the time) know that PDFs could "phone home" to report details of the system reading a PDF. A selinux profile denied access to the internet, and it was many months (and 100s if not 1000s of PDFs read) before one attempted network access and denied it. Ubuntu and Redhat (and I'm sure others) have reasonable defaults, so much of the work is already done for you.
- Anonymous4272 5y ago>I didn't (at the time) know that PDFs could "phone home" to report details of the system reading a PDF. A selinux profile denied access to the internet, and it was many months (and 100s if not 1000s of PDFs read) before one attempted network access and denied it. Ubuntu and Redhat (and I'm sure others) have reasonable defaults, so much of the work is already done for you. And does this happen on android aswell? Because a lot of custom rom/ root users run selinux as permissive for compatibility, so these pdfs would have full network access