2

I understand that running programs as a non-root user is done in order to restrict the programs from writing system files, which prevents malware from compromising the system security.

But in most cases those programs are still able to read those system files even though they cannot write them (ex. /etc/fstab) which leaves the system vulnerable to wide range of spyware.

So, is it possible to restrict programs in a more draconian way so that they would not be able to access anything outside a defined environment? For example, I could allow firefox to use ~/.mozilla, ~/.cache/mozilla and ~/Downloads, but firefox will never be able to read anything from /etc or such.

Is there such a feature in Linux?

  • 2
    "which leaves the system vulnerable to wide range of spyware." No it does not. And in case of browsers have a search for the word "sandbox". – Rinzwind Feb 22 '15 at 13:19
  • Take a look at the apparmor firefox (or other browser) profile. – Panther Feb 22 '15 at 18:55
3

The method to restrict access on Ubuntu is with apparmor.

https://wiki.ubuntu.com/AppArmor

Firefox comes with an apparmor profile for Firefox which has been specifically developed with security in mind.

as pointed out by Rinzwind , ro access is not necessarily a security problem.

Large programs such as firefox is not the best of examples as firefox has rather broad capabilities from network access to hardware access.

As you can see, the firefox apparmor profile is quite large. You can certainly modify the apparmor profile to your specific needs / concerns if you so desire. Just be sure to save a copy of the original profile so you can restore it if you break firefox functionality.

Other browsers, such as chromium, run is a sandbox.

If you are particularly interested in security, you can run Fedora with selinux and run applications in a selinux sandbox.

apparmor profiles are available here

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/AppArmorProfiles

1

Yes, there is: it is called the chroot environment (see http://en.wikipedia.org/wiki/Chroot).

  • 1
    Actually the method is to use apparmor. – Panther Feb 22 '15 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.