2

Goal

To defend against malware (or even compromised open source libraries) that would scan the filesystem and exfiltrate data.

Question

  • I have a certain path in my filesystem that I want only a handful of whitelisted applications to be able to access. How can I do that?

NOTE: I've considered alternative methods (see the edit history of the question) but am narrowing the scope to protecting a path in the filesystem.

  • Can't comment yet so have to post this as an answer, but SELinux may be what you're looking for; you can assign security policies to define access much more prescriptively than you could on a normal distribution. – JMercer Jul 21 '18 at 1:21
  • You could separate your activities via multiple user accounts like Android does. Wayland should prevent graphical programs from interfering with each other regardless of the user accounts they are started from. – dsstorefile1 Jul 21 '18 at 2:10
  • @dsstorefile1: That would require logging in and out every time I need to access the sensitive files. I'm looking for a solution that lets one or two processes access the files (e.g. an editor I trust) in say, /mystuff, while all other processes can't access (or don't even see) that path. – Dan Dascalescu Jul 21 '18 at 3:13
  • 2
    No, I meant using su or sudo to spawn programs as other users and letting them access the Wayland socket for the active compositor. If you don't want to go that route, you could also have other user accounts logged in in the background running VNC servers and connecting to those via a client. There are lots of ways to run programs as multiple users without logging in and out of each account. – dsstorefile1 Jul 21 '18 at 4:53
2

The best solution is separate hardware and network isolation for each level of trust.

Virtual Machines are the next best thing especially when integrated like qubes-os but may someday be susceptible to hardware bugs (rowhamer, speculative execution, firewire), or software bugs.

Containers can set a bunch of kernel security features (SELinux / AppArmor, unshare, chroot, etc) to isolate a process without the overhead of a VM.

Keep in mind there are simple solutions available to the motivated;

enter image description here

So it's best to just not have access to assets you don't need access to.

Personally I use a mix of the above methods; dedicated hardware for the real sensitive bits, VMs for anything not from debian/fedora, Pixel 2 Phone (only option with software updates worth mentioning) layered security (firewalls, intrusion detection systems, etc)

prism-break is a nice collection of software recommendations

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.