Application oriented firewall using Tomoyo Mandatory Access Control

Application oriented firewall using Tomoyo Mandatory Access Control

Application oriented firewall using Tomoyo Mandatory Access Control



Important notes


  • To work with this tutorial you first need to install a custom kernel from AUR, this inconvenience is due to Arch team removing every MAC except SELinux from their kernel sources
  • the following AUR packages must be installed first:
  • To speed up the build process and make the kernel optimized for your local machine's cpu
    edit /etc/makepkg.conf
    and change your CFLAGS and CXXFLAGS to
    CFLAGS="-march=native -mtune=native -O2 -pipe -fstack-protector-strong"
    CXXFLAGS="-march=native -mtune=native -O2 -pipe -fstack-protector-strong"
    and MAKEFLAGS="-j<1.5x your physical core count>“
    so should you have an 8 core cpu, the syntax would go like MAKEFLAGS=”-j12"
  • In order to edit all the files described below and to execute any of the described commands you’ll need local root access rights.
  • The firewall setting works as a white list, when you’re done with this tutorial, any Internet access to or from any application on your computer will be blocked by default,
    you will need to enable it explicitly for selected application by using tomoyo-editpolicy and changing it’s profile from 0 to 1 as simple as that.
  • After you installed the kernel from the AUR follow the tutorial

if you already configured Tomoyo, goto step 6.




Step 1

Edit /boot/grub/grub.cfg
You have to add security=tomoyo to your boot entry as shown below:
menuentry 'Antergos Linux TOMOYO LTS' --class antergos --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-a1387b32-d357-11e7-9296-cec278b6b50a' {
        set gfxpayload=keep
        insmod gzio
        insmod part_gpt
        insmod ext2
        set root='hd3,gpt2'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd3,gpt2 --hint-efi=hd3,gpt2 --hint-baremetal=ahci3,gpt2  a1387b32-d357-11e7-9296-cec278b6b50a
          search --no-floppy --fs-uuid --set=root a1387b32-d357-11e7-9296-cec278b6b50a
        echo    'Loading  linux kernel ...'
        linux   /vmlinuz-linux-lts-tomoyo root=UUID=a1387b32-d357-11e7-9296-cec278b6b50a rw  quiet resume=UUID=a1387b32-d357-11e7-9296-cec278b6b50a security=tomoyo
        echo    'Loading initial ramdisk ...'
        initrd   /initramfs-linux-lts-tomoyo.img

Step 2:

Edit /etc/default/grub
add security=tomoyo to your boot entry as shown below:
GRUB_CMDLINE_LINUX_DEFAULT="quiet resume=UUID=a1387b32-d357-11e7-9296-cec278b6b50a" security=tomoyo

# Preload both GPT and MBR modules so that they are not missed
GRUB_PRELOAD_MODULES="part_gpt part_msdos"

# Uncomment to enable Hidden Menu, and optionally hide the timeout count

# Uncomment to use basic console

# Uncomment to disable graphical terminal

# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `vbeinfo'

# Uncomment to allow the kernel use the same resolution used by grub

# Uncomment if you want GRUB to pass to the Linux kernel the old parameter
# format "root=/dev/xxx" instead of "root=/dev/disk/by-uuid/xxx"

# Uncomment to disable generation of recovery mode menu entries

# Uncomment and set to the desired menu colors.  Used by normal and wallpaper
# modes only.  Entries specified as foreground/background.

# Uncomment one of them for the gfx desired, a image background or a gfxtheme

# Uncomment to get a beep at GRUB start
#GRUB_INIT_TUNE="480 440 1"


Step 3

Install tomoyo-tools
type in the terminal:
pacman -S tomoyo-tools

Step 4

Reboot your OS.

Step 5

Initialize tomoyo default configs and profiles
type in the terminal:

Step 6

edit /etc/tomoyo/policy/current/profile.conf, Import or override your entries with the following code:
PROFILE_VERSION=20110903 0-COMMENT=-----block network inet----- 0-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 }
 0-CONFIG={ mode=disabled grant_log=no reject_log=no }
 0-CONFIG::network::unix_stream_bind={ mode=disabled grant_log=no reject_log=no }
 0-CONFIG::network::unix_stream_listen={ mode=disabled grant_log=no reject_log=no }
 0-CONFIG::network::unix_stream_connect={ mode=disabled grant_log=no reject_log=no }
 0-CONFIG::network::unix_dgram_bind={ mode=disabled grant_log=no reject_log=no }
 0-CONFIG::network::unix_dgram_send={ mode=disabled grant_log=no reject_log=no }
 0-CONFIG::network::unix_seqpacket_bind={ mode=disabled grant_log=no reject_log=no }
 0-CONFIG::network::unix_seqpacket_listen={ mode=disabled grant_log=no reject_log=no }
 0-CONFIG::network::unix_seqpacket_connect={ mode=disabled grant_log=no reject_log=no }
 0-CONFIG::network={ mode=enforcing grant_log=no reject_log=yes }
 1-COMMENT=-----allow all----- 1-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 }
 1-CONFIG={ mode=disabled grant_log=no reject_log=no }
 2-COMMENT=-----Permissive Mode----- 2-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 }
 2-CONFIG={ mode=permissive grant_log=no reject_log=yes }
 3-COMMENT=-----Enforcing Mode----- 3-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 }
 3-CONFIG={ mode=enforcing grant_log=no reject_log=yes }

Step 7

Reboot your OS.


you can edit any rule by executing:

then, by pressing s you can change application’s profile 0=block all Internet access, 1=allow all Internet access
you can exit the policy editor by pressing q.

after any changes you made to the policy, you need to save it to the disk, to do so, just type in the terminal:


Before you can allow an application you have to run it at least once, that way tomoyo notes the application’s existence.

to find an application a bit quicker in the tomoyo’s policy editor, just press f while in policy editor, and then type the first few letters of the application, after that press enter,
press n to look for the next occurrence of the application in the domain policy list

In case you still don't know how to use tomoyo's policy editor
please consult the official tomoyo documentation:


(Visited 68 times, 3 visits today)

Pin It on Pinterest

Share This