Does this prevent leaks out of homedirs without SELinux?

Question

I would like to prevent certain users from leaking info out of their home dir trees, even if they chmod their home dir. In other words, I have users alice and bob, and I want to prevent alice from ever making any of the data in her home dir tree readable by bob (or anyone else, except root). And vice versa.

This initially sounded to me like a job for selinux. But I don't want to take that plunge unless necessary.

Instead I came up with the following home directory scheme, and I would like to know if it really does what I require.

Instead of having homedirs /home/alice and /home/bob, I add intermediate dirs. The tree is:

/home               root:root   drwxr-xr-x (as usual)
/home/alice0        root:alice  drwxr-x---
/home/alice0/alice  alice:alice drwxrwxrwx (alice's home dir)
/home/bob0          root:bob    drwxr-x---
/home/bob0/bob      bob:bob     drwxrwxrwx (bob's home dir)

Where alice and bob are the only members of their respective groups (as usual). The homedir for alice is /home/alice0/alice and similarly for bob, hence a little different than normal. There is nothing else in the intermediate dir alice0 (bob0) other than the homedir alice (bob). Alice and bob still own their homedirs, but the access rights on the homedirs no longer matter much, which is the point. The intention is that the intermediate 'user0' dir layer, owned by root with only restricted 'r-x' group access for each user prevents leakage outside each user's group regardless of what each user does to or within their homedirs.

For those applications that assume /home/alice is always alice's homedir, I can add sym links in /home: /home/alice -> /home/alice0/alice and similarly for bob.

Does this work in all cases? Is there anything else wrong with it?

Answer 1

I don't understand why you should to this

/home/alice0/alice alice:alice drwxrwxrwx (alice's home dir)

and

/home/bob0/bob bob:bob drwxrwxrwx (bob's home dir)

I mean: why allow all other users to read write and execute alice and bob folders.

With rwx on 'others users' you allow alice to read bob directory content (even if not file contents, depending on file permissions) and viceversa bob can read alice directory listing. Also bob can create files into alice folder and viceversa.

With standard permissions and standard home folders bob cannot read and alter alice home, and viceversa.

Can you add an example of what do you want avoid in a standard setup ?

If in standard setup alice and bob home directories have 755 as directory permissions, you could change it to 750 so no other users than owner (and its groups and root) can see directory content