Walsh: Introducing the SELinux Sandbox

“”The discussions brought up an old Bug report of [mine] about
writing policy for the ‘little things’. SELinux does a great job of
confining System Services, but what about applications executed by
users. The bug report talked about confining grep, awk, ls … The
idea was couldn’t we stop the grep or the mv command from suddenly
opening up a network connection and copying off my /etc/shadow file
to parts unknown.” Paris also posted an introduction to the sandbox
on linux-kernel.”

Complete Story