Is there any security risk allowing regular Linux users to run arbitrary code?

Question

I'd like to allow untrusted users to run arbitrary Node apps. If I use iptables to block everything except trusted servers, make each user's home folder only visible to them, and use runuser to start their server, is there any risk of them accessing each others' data?

Basically I'll just create a new user for the instance, copy the app into the home directory, chown/chmod it, and then do:

runuser -l their-user-name -c /usr/local/bin/node /users/their-user-name/server.js

I realize they can swamp the memory/cpu/io. And obviously they can chmod their own data open, but that aside... is there any security risk that I'm missing?

My plan is to use iptables to let each specific user open a server on a one specific port, which can only receive incoming connections from my nginx server. And then allow outgoing connections to a trusted database server.

Answer 1

There is always some risk and in this case if the system isn't hardened internally it might be trivial for a "user in the know" or a bad actor to access other users data in a matter of minutes if not seconds.

In this case you still have all the local privilege escalation issues and local security hardening issues which could allow local users to become root or run things as root or simply give them full access to the other users data. In many ways this is much harder to secure than trying to secure a system from the outside. That said it's not that you cannot add a lot of security controls to protect yourself from the users or that it can't be done but it requires much more work.

It may be wise to look into setting up a chrooted environment keeping in mind that you still need to harden the system from insider attacks. Likewise it would be wise to send all of your logs off to a remote system on the off chance a user does escalate privileges it will be harder for them to hide this.

Keep in mind there may be easier ways to solve your end goal and that sometimes it's worth taking a step back to look at where all the security trade-offs are and what you are actually trying to accomplish.

The following Linux Security Hardening guides may be helpful. You may also want to run a tool similar to Nessus to look at your local risks.

CIS Security Benchmarks http://benchmarks.cisecurity.org/downloads/browse/index.cfm?category=benchmarks.os.linux

NSA Operating systems security configuration guides https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml#linux2

NIST sp800-123 Guide to General Server Security http://csrc.nist.gov/publications/nistpubs/800-123/SP800-123.pdf

Matt Brock Security Hardening on Ubuntu Server 14.04 http://blog.mattbrock.co.uk/hardening-the-security-on-ubuntu-server-14-04/

Hardening IPTables config with limit rates https://petermolnar.eu/linux-tech-coding/hardening-iptables-config-with-limit-rates/

Linux Server hardening security tips http://www.tecmint.com/linux-server-hardening-security-tips/

Hardening your TCP/IP Stack against SYN Floods https://www.ndchost.com/wiki/server-administration/hardening-tcpip-syn-flood

IBM guide to hardening Linux http://www.ibm.com/developerworks/linux/tutorials/l-harden-server/index.html