Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to run my application inside an SELinux sandbox. My application needs access to /dev/urandom, and the default sandbox policy does not allow that.

What is a simple method to allow my sandbox context access to /dev/urandom?


share|improve this question
Where did you get this "SELinux sandbox"? – Michael Hampton Mar 17 '13 at 10:40
up vote 1 down vote accepted

What is a simple method to allow my sandbox context access to /dev/urandom?

Any of the following, though the first is ideal.

  • Change your policy
  • Change the context of /dev/urandom
  • Change the context of your process
  • mknod a new /dev/urandom with different name and appropriate context. Point your application at that.
share|improve this answer
right now I have my process running in the default sandbox_t context. Can I modify the policy to allow access to my process, but not to other sandboxed processes? – DanJ Mar 17 '13 at 11:07
No, you'll have to copy the sandbox_t to another context name, bless the context to read /dev/urandom, and run your program in that new context. – Jeff Ferland Mar 17 '13 at 12:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.