I'm considering creating a separate account for browsing, and launching my browser with sudo -u browseraccount {firefox,chromium,etc}. I wonder if this can prevent a malware (especially ransomwares) escaping the browser's sandbox from accessing the data in my $HOME.

Does it really provide security ? Can an attacker that compromises my browser still access ~/Documents, ~/Images etc. ?


It accesses the Documents/Images of the user you run it as (if they exist - if that user has no home, then it may not work, browsers usually store some data in home, such as the profiles and stuff).

Otherwise, the answer is yes. No regular user can (as per usual permissions on home folders) access homes of any other users, or change system files. The details depend on which group you add this user to, and the exact permissions of files you have in other places in the tree.

However, you may want to give your regular user permissions to read downloads, otherwise, the downloaded files are pretty useless. That kind of defeats the purpose of isolation.

However... it makes little to no sense to do this, if you know what you are doing. Downloaded files can't do any damage unless they are executed, and for that, they need the executable permission (which isn't normally set at download). That's pretty much windows-specific problem (where clicking on a file that looks like data, but is an application, executes it directly, as no concept of "execute permission" is in place, although newer versions are nagging all the time for anything you want to execute).

So in short... if you download a malicious script, and don't run it, no harm done. If you want to run it... you can do that as a separate user (while the browser can be run as yourself). And of course, if it's not a binary file, but a shell script, you can always open and look what it does.

And even more... linux software doesn't usually come as downloadable executables - you usually have either packages, source files, or something like that. In any case, when it comes to downloading files that are meant to be run as executables, you better know what you're doing.

  • I'm smart enough not to launch any downloaded malware myself ; I'm more worried about 0-day exploits in a website affecting my browser. That would be a mitigation against this type of attack. – Elzo Jan 9 '16 at 16:48
  • 1
    In that case, running as another user does the trick, yes -- I'd trust that setup. Another thing that protects you quite well is also having your data elsewhere. I generally have home for my downloads and configuration (whatever all the programs put there), and I make home partition quite small. Then I have "big data" mounted somewhere. Unless malware does a full filesystem scan, it will only attack the standard well known locations, so my data is safe (however, my ssh key isn't, so if I were dealing with these things, I'd make another user too). – orion Jan 9 '16 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.