Is there any way to change what files (in particular files content) an application can see?

I know you can prevent access to files with DAC or MAC, but I don't want to prevent accessing. Instead, I would like to change the content an application can see. When I access a file using an application, for example, I enter /home/user/.profile on my browser and I don't want the application to see the real content, but instead a spoofed version with the same file path however. If I open the file from the terminal or from some other application it should sees the correct content. Is this somehow possible? Can this be extended to changing the contents for specific users?

  • Maybe you want Linux namespaces. Google it, then do it no matter by lxc-run or lxc-unshare or write your own sandbox. As a question on this website, I think it's too abroad. – 炸鱼薯条德里克 Sep 13 '18 at 15:04

You can use Linux mount namespaces to set up a modified view on the filesystem. Container frameworks such as LXC use it behind the scenes. It can be used from shell quite easily as well, but requires root access to setup.

unshare -m
mount --make-rprivate /
mount --bind /spoof/x /target/x

Bind mounts are used to hide parts of the original file system tree by mounting over the original paths. mount --make-rprivate prevents any new mounts from propagating between the mount namespaces.

pam_namespace module can be used to configure users in their own mount namespace and configure bind mounts.

| improve this answer | |
  • I'm actually already running in a lxc container. I'm not sure if I can run it nested. The most important paths would be entries under /proc or /sys and I don't know how easy it would be to spoof parts of those without breaking the rest. Background is, I actually want to hide that a container is used. – tainted Sep 13 '18 at 16:22
  • Running nested mount namespaces shouldn't be an issue. For limiting /proc or /sys you probably should use MAC (SELinux/AppArmor) or choose not to make them visible for your application (run without /proc and /sys mount points altogether). – sebasth Sep 13 '18 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.