To defend against malware (or even compromised open source libraries) that would scan the filesystem and exfiltrate data.


  • I have a certain path in my filesystem that I want only a handful of whitelisted applications to be able to access. How can I do that?

NOTE: I've considered alternative methods (see the edit history of the question) but am narrowing the scope to protecting a path in the filesystem.

  • Can't comment yet so have to post this as an answer, but SELinux may be what you're looking for; you can assign security policies to define access much more prescriptively than you could on a normal distribution. – JMercer Jul 21 '18 at 1:21
  • @dsstorefile1: That would require logging in and out every time I need to access the sensitive files. I'm looking for a solution that lets one or two processes access the files (e.g. an editor I trust) in say, /mystuff, while all other processes can't access (or don't even see) that path. – Dan Dascalescu Jul 21 '18 at 3:13

The best solution is separate hardware and network isolation for each level of trust.

Virtual Machines are the next best thing especially when integrated like qubes-os but may someday be susceptible to hardware bugs (rowhamer, speculative execution, firewire), or software bugs.

Containers can set a bunch of kernel security features (SELinux / AppArmor, unshare, chroot, etc) to isolate a process without the overhead of a VM.

Keep in mind there are simple solutions available to the motivated;

enter image description here

So it's best to just not have access to assets you don't need access to.

Personally I use a mix of the above methods; dedicated hardware for the real sensitive bits, VMs for anything not from debian/fedora, Pixel 2 Phone (only option with software updates worth mentioning) layered security (firewalls, intrusion detection systems, etc)

prism-break is a nice collection of software recommendations

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.