The Linux Application Block Policy allows administrators to prevent specific applications from running on managed Linux devices. This policy is useful for security hardening, compliance enforcement, productivity control, or preventing the use of unapproved or risky software.
It can be applied to both BYOD and company-owned Linux devices enrolled in Swif.ai.
What This Policy Does
When this policy is applied, Swif.ai monitors process execution on the device.
Any application whose name appears in the Disallowed Application List will:
Be blocked from launching
Be terminated automatically if already running
Generate an event that appears in device logs and the AI Security Report (if enabled)
This enables admins to enforce application-level restrictions without modifying OS-level security frameworks.
Requirements
Linux device enrolled in Swif.ai
Supports major distributions such as Ubuntu, Debian, Fedora, CentOS, Rocky Linux, and others.
Configuration Options
Disallowed Application List
Type and press Enter to add value
Enter the exact names of applications or executables you want to block.
Each entry represents a process name that must match the command executed on the system.
Examples:
firefoxzoomslackspotifychromium-browserpython3(to block Python execution)gedit
Swif.ai will automatically block and stop any process whose name equals an entry in this list.
How the Blocking Works
When the device enforces this policy:
Swif.ai continuously monitors active processes.
If a process matches a disallowed name:
The process is terminated immediately.
A prevention event is logged.
If the user attempts to launch the app again:
It will be instantly blocked.
This behavior is persistent until the policy is removed or updated.
Best Practices
✔ Use exact executable names
Run:
ps -aux | grep <appname>
or
which <app>
to confirm the precise binary name.
✔ Test on a pilot group
Block policies may impact user workflows—test before applying organization-wide.
✔ Combine with Linux Tracking Policy
This provides visibility into application usage before enforcing restrictions.
✔ Keep a list of approved apps
Use your internal IT policy or baseline hardening standards.
Troubleshooting
The app is not being blocked
Verify the executable name matches the process name exactly.
Confirm that the device is online and has applied the latest policy.
Check for alternative launcher names (e.g.,
chromevsgoogle-chrome).
A user reports false positives
Some applications launch child processes with different names.
Add those process names to the list or exclude the correct executable.
Policy still not taking effect
Ensure the device has the latest version of the Swif agent.
Try forcing a sync from the device details page.
Summary
The Linux Application Block Policy is a lightweight, powerful way to control which applications users can run on Linux devices.
By defining a list of restricted applications, admins can enforce security, compliance, and productivity standards across all managed Linux endpoints with ease.