I am trying to secure a custom application as much as possible from outside tampering.
I've seen many pages on jailing a user, but they usually include many exceptions, and I want to lock down this user as much as possible.
The user only needs to execute an application that is a websocket++ client & server that needs the ability to:
- Accept incoming connections port forwarded from 443 to another port, for example 8000
- Seek outgoing connections
- Communicate with a local PostgreSQL server
- Read from & write to a few specific files in the directory where the application is executed
- Get output from
ntpd -c 'rv'
- Accept keyboard input
How can my intent be implemented?