Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to run the webbrowser (xxxterm) with a different user (XY) on an OpenBSD Desktop (different user from the one I use daily). I will reach the Browser with ssh -X in the local machine (or are there any better solutions?). The webbrowser needs NO audio, NO flash, NO html5, NO JAVA, NO plugins, NO JAVASCRIPT, etc.

How can I create a user with the smallest possible permissions? Are there any tricks? (does the user only needs to be in his group, and not else?)

Googled a few hours for keywords/tricks that I need to "expand" (mini howto to it) later:

mount /home with nodev, nosuid, noexec AND/OR with read-only option?
set high umask for users that are not XY
minimal groups needed for user
regularly check that the user isn't in the sudoers file
no o+rwx on the files in the system or suids
**restricted shell for the user?**
systrace restrictions? (or doesn't worth it?*)
pf limitations - user uid only needs http https ftp dns - no other network needed for any user besides root
put the webbrowsing in a qemu vm??
security/limits.conf - ulimit for the user?
chroot the xxxterm?
xxxterm as shell? (instead of ksh?)
only let a few dozen MByte quota for the user or zero?
guest session like? - start with a clear QEMU guest or chrome directory at every chrome exit/start?
privoxy for filtering chrome traffic? (proxy can be set to anything by the XY user..)
can pf limit that what process can use http https ftp dns?

if this howto is completed it could be useful when having a zombie terminator apocalypse :D

share|improve this question
This is actually much harder than it sounds. –  Ignacio Vazquez-Abrams Jul 15 '13 at 9:33
Bear in mind that Firefox is much older than Chromium, and Chromium vulnerabilities may be filed as Google Chrome. I don't think your metric is very scientific. –  Chris Down Jul 16 '13 at 14:53
yepp, that's why I wrote (...), Thanks –  gasko peter Jul 16 '13 at 14:54
updated with a new browser I found :) –  gasko peter Sep 20 '13 at 19:19
The title asks about creating a user account with minimal permissions, and the question asks about a feature-limited web browser. The two are very different. You would be much better off editing to indicate which one of these you really are after. –  Michael Kjörling Sep 20 '13 at 19:24
show 3 more comments

1 Answer

If you want a completely isolated browser instance that cannot affect anything outside of its little sandbox, which it sounds like (despite the title of the question), I would suggest simply running a VM and connecting to it by some means other than X11 forwarding. SSH or not, encrypted or not, does not matter in this case because you aren't really looking to actually protect the data in transit, you are only looking to isolate one application from everything else. Run the browser in there and everything else outside of it. As far as the browser is concerned, it sees its OS installation in the VM and nothing outside of that sphere of influence.

VNC, Microsoft Remote Desktop or something like it should work. X11 forwarding is out because it exposes raw data streams in a way these alternatives (likely) don't, which would allow a malicious application running on either side to snoop on everything you are doing, negating any and all security gains. (This does not require root, only your own access, because you own the X session.) Of course, it'd be a pretty serious issue if any browser allows a web page to access that kind of data.

It doesn't protect against a malicious application running as you outside the VM snooping on what you are doing with the browser inside the VM, but it should prevent anything malicious inside the VM from snooping on anything running outside of the VM.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.