1

Mobile operating systems like Android or iOS define sets of permissions (e.g. read contacts/send sms/access camera, ...) a user needs to specifically grant to an application in order for the latter to perform certain actions.

Are there similar concepts available for Linux on a Kernel-Level? For example I might want to restrict a program to a subset of the available system calls by setting certain flags/specify some meta-file/define more fine grained rules for specific users or groups than read/write/execute, ... in order to improve security.

If I could prevent a program from things like doing I/O or accessing the network, that I am sure it does not need, I might potentially be a lot safer in certain scenarios...

  • Preventing network access is not done by restricting which system calls a process may issue. Technically it works by forbidding certain parameter values in certain system calls, but usually you wouldn't specify that manually, you'd use higher-level tools. Do you actually want to restrict by system call, or do you want to restrict network access? – Gilles 'SO- stop being evil' Jul 7 '17 at 23:51
  • The question is not about a specific problem I have, but rather about the mechanisms Linux provides on a kernel level to address issues like these. Or do you say this is all supposed to be done in userspace? – Simon Fromme Jul 7 '17 at 23:53
  • So a more general question about the design of Linux abstracting from specific problems is not allowed here? – Simon Fromme Jul 7 '17 at 23:57
  • Restricting system calls was just a naive example of things I could imagine to deal with the issue in kernelspace. But let's be concrete: How do I prevent a program from accessing the network? – Simon Fromme Jul 7 '17 at 23:58
0

If you want to take the approach of the Android model, you can run the app in a Sandbox. Alternatively, or in addition to that, you can also use chroot, SELinux, DAC (Discretionary Access Controls); or, perhaps, use separate unprivileged users to further isolate specific items, which makes it easier to put in place restrictions without affecting other users and/or the system; same thing with groups: create a group with specific permissions and add a user to that group.

https://developer.android.com/guide/topics/permissions/requesting.html

The android approach is to run the apps within the sandbox, and allow the application to perform certain functions outside of that sandbox. There's a clear distinction between that and the idea of limiting the operations of a process "at the kernel level".

This answer is not, by far, a complete list of tools or use-cases available for such scenarios. For example, using the firewall is another obvious method to limit network access both inbound and outbound; the kernel itself has a number of items that can be enabled/disabled, depending on how it was built or via the sysctl tool, for example. However, for the most part, this would affect the entire system, rather than just one application.

If you're concerned that an application might be unsafe, don't run it. Alternatively, you can run it in a virtual machine or, to some extent, as a docker container. The latter of those, however, should be carefully configured.

Lastly, examine what the application does from within the source code or find info about it from those who've already done so. Ultimately, you should know what you install and try to adhere to using the official repositories of the Linux distribution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.