Brave sandbox in Secureblue

Don’t waste your time on writing good Selinux modules, if you only have one hour per day left. Selinux is difficult to learn with a lot of abstractions and Fedora’s policy is not well suited for confining desktop applications.

You can take a look into Secureblue’s Flatpak policy secureblue/files/scripts/selinux/flatpakfull at live · secureblue/secureblue · GitHub as an example on how to make a program run quasi unconfined and without Secureblue’s user namespace restrictions. The important part is secureblue/files/scripts/selinux/flatpakfull/flatpakfull.te at d69724fe37673925fe09f944fd2a5d75bf83156a · secureblue/secureblue · GitHub . It is the easiest way on how to let a program use user namespaces without disabling the namespace restrictions globally.

If you nevertheless want a more tailored policy, take a look into secureblue/files/scripts/selinux/trivalent at live · secureblue/secureblue · GitHub as a starting point and adapt it to Brave.

2 Likes