Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to run my application inside an SELinux sandbox. My application needs access to /dev/urandom, and the default sandbox policy does not allow that.

What is a simple method to allow my sandbox context access to /dev/urandom?

Thanks

share|improve this question
    
Where did you get this "SELinux sandbox"? –  Michael Hampton Mar 17 '13 at 10:40

1 Answer 1

up vote 1 down vote accepted

What is a simple method to allow my sandbox context access to /dev/urandom?

Any of the following, though the first is ideal.

  • Change your policy
  • Change the context of /dev/urandom
  • Change the context of your process
  • mknod a new /dev/urandom with different name and appropriate context. Point your application at that.
share|improve this answer
    
right now I have my process running in the default sandbox_t context. Can I modify the policy to allow access to my process, but not to other sandboxed processes? –  DanJ Mar 17 '13 at 11:07
    
No, you'll have to copy the sandbox_t to another context name, bless the context to read /dev/urandom, and run your program in that new context. –  Jeff Ferland Mar 17 '13 at 12:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.