1

I'm setting up a system in which any external command that does something with real effect must be crypthographically signed before before the system will execute them. The restrictions are in place and the command that verifies their signature is the only one that can run them.

I would like to, if possible, to make is so that every command is ran though this exeuctor for the simple sake of convenience without the user having to specifically specify that they are running the command though it. I wonder if it is possible to implement such a feature?

Improve this question
2
  • Can you write more about the tools/interfaces/... you plan to use, please? How should the external commands be delivered to the system?
    – jofel
    Apr 9, 2015 at 12:04
  • Currently, they are delivered through ssh. For most normal uses, this will be a hidden implementation but developers and possibly some service technicians might use it directly through raw command-line ssh.
    – Pierre Andersson
    Apr 9, 2015 at 12:21

1 Answer 1

Reset to default
2

You aren't going to be able to enforce such a scheme through . It would be too easy to circumvent since there are so many other ways to launch child processes.

You could, however, develop an entire locked-down UI the way iOS is implemented. Make it so that there just isn't any tool available to even write code to the filesystem without going through approved channels (app store or similar repository).

OS X (which is technically Unix) has a code signature verification feature, which is optionally enforced.

Improve this answer
3
  • Are SELinux or AppArmor infraestructures to get that behavior?
    – jcbermu
    Apr 9, 2015 at 12:16
  • @jcbermu SELinux and AppArmor rely on filesystem attributes and paths rather than code signatures. However, it might be possible to write a signature-based mechanism using Linux Security Modules.
    – 200_success
    Apr 9, 2015 at 12:19
  • The whole automatically run the executables through a specific program is not a security feature though, just a convenience. The security should come through the external user only being able to interact with a severely restricted shell. That is is possible to cirumvent running through the signed code exeuctor is thus not a problem.
    – Pierre Andersson
    Apr 9, 2015 at 12:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .