3

I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish.

I would like to be able to do this as a normal user, without the involvement of configuration files, nor root access to enable said configuration, nor tagging files. I'd like to specify my security profile at runtime. In the best of world, I wouldn't need any special kernel config or parameters either.

Currently, I use apparmor, but it involves:

1) Enabling apparmor.

This is a problem since kernel support is required. I may need to be recompiled as is the case with arch-linux-arm. In a work setting running Red Hat Linux, they don't typically have apparmor because it's a selinux world.

2) Writing a simple profile (let's call it my_profile.armor):

profile restricted_books {
  deny network,
  /home/flux/_/dev/localhost.books/ r,
  /home/flux/_/dev/localhost.books/** r,
  /home/flux/_/dev/localhost.books/progress/ rw,
  /home/flux/_/dev/localhost.books/progress/** rw,
  /home/flux/_/dev/localhost.books/tmp/ rw,
  /home/flux/_/dev/localhost.books/tmp/** rw,
  /usr/bin/ebook-convert Ux,
}

2) registering the profile (requires root)

sudo apparmor_parser my_profile.armor

Alternatively, you'd move my_profile.armor in /etc/apparmor.d/ and reboot.

3) opt-in the profile programmatically

#include <sys/apparmor.h>
aa_change_profile("restricted_books");
booyah();

Instead of all that, I'd love to just do:

sandbox_my_app_please_and_Im_normal_user("""
  deny network,
  /home/flux/_/dev/localhost.books/ r,
  /home/flux/_/dev/localhost.books/** r,
  /home/flux/_/dev/localhost.books/progress/ rw,
  /home/flux/_/dev/localhost.books/progress/** rw,
  /home/flux/_/dev/localhost.books/tmp/ rw,
  /home/flux/_/dev/localhost.books/tmp/** rw,
  /usr/bin/ebook-convert Ux,
""")
booyah()

Is there something like that out there? selinux has setcon() which looks similar to what I do with apparmor, but it involves a lot of config too (which I'm sure needs root too). And the built-in seccomp() function looks really complicated so I'm not sure it can even do the simple file/directory, no network scenario.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.