2

I understand that running programs as a non-root user is done in order to restrict the programs from writing system files, which prevents malware from compromising the system security.

But in most cases those programs are still able to read those system files even though they cannot write them (ex. /etc/fstab) which leaves the system vulnerable to wide range of spyware.

So, is it possible to restrict programs in a more draconian way so that they would not be able to access anything outside a defined environment? For example, I could allow firefox to use ~/.mozilla, ~/.cache/mozilla and ~/Downloads, but firefox will never be able to read anything from /etc or such.

Is there such a feature in Linux?

2
  • 2
    "which leaves the system vulnerable to wide range of spyware." No it does not. And in case of browsers have a search for the word "sandbox".
    – Rinzwind
    Feb 22, 2015 at 13:19
  • Take a look at the apparmor firefox (or other browser) profile.
    – Panther
    Feb 22, 2015 at 18:55

2 Answers 2

3

The method to restrict access on Ubuntu is with apparmor.

https://wiki.ubuntu.com/AppArmor

Firefox comes with an apparmor profile for Firefox which has been specifically developed with security in mind.

as pointed out by Rinzwind , ro access is not necessarily a security problem.

Large programs such as firefox is not the best of examples as firefox has rather broad capabilities from network access to hardware access.

As you can see, the firefox apparmor profile is quite large. You can certainly modify the apparmor profile to your specific needs / concerns if you so desire. Just be sure to save a copy of the original profile so you can restore it if you break firefox functionality.

Other browsers, such as chromium, run is a sandbox.

If you are particularly interested in security, you can run Fedora with selinux and run applications in a selinux sandbox.

apparmor profiles are available here

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/AppArmorProfiles

1

Yes, there is: it is called the chroot environment (see http://en.wikipedia.org/wiki/Chroot).

1
  • 1
    Actually the method is to use apparmor.
    – Panther
    Feb 22, 2015 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .