TOMOYO

Let's talk about TOMOYO! [1] http://tomoyo.osdn.jp/1.8/chapter-3.html.en [2] http://tomoyo.osdn.jp/documentation.html [3] http://tomoyo.osdn.jp/comparison.html.en [4] https://wiki.archlinux.org/index.php/TOMOYO_Linux [5] https://antergos.com/wiki/networking/firewalls/application-oriented-firewall-using-tomoyo-mandatory-access-control/ [6] http://tomoyo.osdn.jp/wiki-e/index.php?WhatIs Have lains here had firsthand experience with TOMOYO having maybe used it exclusively at work/home? If yes, dump 'em policies here!

But is it better than sweet sweet SELinux?

Seconding this, but with AppArmor.

I thought this was discontinued in 2012 or something.

It is literally maintained by ONE person - Tetsuo Handa; and no it isn't entirely dead. The maintainer still does release patches every now and then. Of course, it is no where as near compared to grsec(fuarrrk it! it isn't going to be public anytime soon) or SELinux but TOMOYO still needs some love. It's time we embrace other MAC's too. Like this other lain said somewhere here earlier: If you are going to make people put manual labor into security enforcement, nobody's gonna DO it. So, go ahead and use obscure software, experiment with it, write blogposts it. Just because a software isn't very popular or very well maintained, doesn't necessarily mean it is like kicking dead whales down the beach wholly! Peace!

Nah! SELinux or bust! :\

>>5029 >Just because a software isn't very popular or very well maintained, doesn't necessarily mean it is like kicking dead whales down the beach It does raise questions about how secure it is, how many bugs are being found and fixed and how long it takes to push out a release to fix bugs being exploited in the wild. One man projects don't usually do well in these areas.

>>5043 exactly and depending on the access rights to a system the security software itself could be a point of entry

>>5043 This is why I'm telling, it's best when everybody experiments with the software irrespective of the fact that it is well maintained or not.

>>5047 >This is why I'm telling, it's best when everybody experiments with the software irrespective of the fact that it is well maintained or not. Users will only find usability bugs like I pressed this button and it didn't do what I wanted. Security vulnerabilities are much more subtle than that and are mostly found by people who are actively looking for them.

>>5049 Preach!

Is there a GUI software firewall for Linux? Preferably one that allows running multiple copies of same application, but with different network paths, filesystem permissions or without them at all. Something like Subgraph or Qubes, but not bloated with virtual machines or nailed up to Gn*me desktop environment. I.E. I want to see whether my calculator is trying to access Internet and have the right to block it without editing the source code prior.

>>5054 umm...firejail perhaps? Correct me if i'm wrong.

OP here! I thought this thread would bring people who use TOMOYO to share their thoughts with fellow lains. But, this has clearly transitioned to something else entirely LOL!

>>5054 firejail doesn't have a gui. firewalld has a gui but it's a dumb wrapper over netfilter, doesn't support any of the things in your post other than "gui firewall"

>>5076 Firetools is the GUI I'm using for Firejail.

What the fuarrrk is even TOMOYO? Never heard of it! Judging by their webpage, it sure looks crappy!

>>5054 >Preferably one that allows running multiple copies of same application, but with different network paths, filesystem permissions or without them at all. The oldschool way to do this would be to use each copy under a different user account and use iptables match owner module. You can also achieve the same thing with Linux namespaces. As >>5063 says, firejail would be a good choice. It is an easy to use wrapper around Linux namespaces. OP might be able to tell you how to do this with tomoyo.