0

Is there a program in Linux to control which processes are allowed to run with some kind of control list?

So that, when you will try to run a process that is not in the list you will be notified about it and asked if to add it to the list of allowed processes.

3
  • 1
    Is this for whole system or user control? For user control, you could use a chroot jail or you may want to look into using ACLs for both whole system and user control
    – ivanivan
    Commented Jul 30, 2017 at 23:15
  • The purpuse is to have control over processes that are running. That which are listed in some configuration file, are the ones I know about what they are doing (e.g. downloaded from trusted source and/or open source). On my laptop I usually use only two users (root and me), but some programs run under user names like ntp, avahi, daemon, syslog. So, the control would be better for every user with a list of users having privilage to add/remove processes to/from the list.
    – xralf
    Commented Jul 30, 2017 at 23:23
  • You want ACLs then.... but you should also read up on how those system users are already managed in whatever distribution you are running.
    – ivanivan
    Commented Jul 30, 2017 at 23:30

1 Answer 1

1

No. The Unix security model is based on users and resources. It is designed to control which users have access to which resources. Resources are mostly exposed as files, and access control is done through file permissions.

Processes are merely agents of the user. There is no restriction on what code a user may run. There are restrictions on which files a user may run, but this is generally not a practical restriction¹ as users can put new code in a new file and execute that.

You could set up a wrapper script around an executable to prompt the user “are you sure you want to run this program?”. But this would be pretty annoying and pointless: users could run the program directly (or install their own copy).

There may be a way to solve the actual problem you have, but it wouldn't be “allowing a process to run”.

¹ It's a restriction only in two cases: the permissions on executables that elevate privileges (setuid/setgid) restrict which users can elevate privileges, and accounts that cannot create an executable file at all (restricted accounts) cannot execute arbitrary code.

1
  • I'm looking for something like a firewall, but for processes. At the beginning, there would be forbidden almost everything (except for init, kernel processes, cron, and other stuff that is absolutely needed) and later you will find out that you like Python, so you will add a line "Python allow" to the configuration file. But I believe you understood and know that it does not exist, but I give it a chance for a while yet :-) Thank you
    – xralf
    Commented Jul 31, 2017 at 13:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .