It looks like i found a way to allow only single application to access files in USB storage. This script must be run with sudo.

# create namespace
unshare -m<<EOF
# mount device in namespace
mount -U "UUID-here" "/home/$SUDO_USER/hidden"
# run unprivileged application 
sudo -u "$SUDO_USER" application
# unmount device
umount "/home/$SUDO_USER/hidden"

Obviously automounter must not mount this device.

Is it possible for other applications (except 0day exploits) run by user to read files from namespace?


Yes, other processes owned by the same user can access the files via /proc/<PID>/root.

This can be prevented by root creating a user namespace, mapping the unprivileged user, then switching to the user. These steps need to preformed by a single executable.

  • I cant reproduce it on my script (root owns /proc/keepass_PID/root and im getting 'Permission denied'), running with sudo its a reason right? – anon432 Apr 30 '19 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.