2

I wold like to set permissions on a per application basis, permissions like:

  • Creation of sockets
  • Creation of sub-process
  • If an application creates a sub-process child processes should inherit the same permissions
  • IPC
  • Shared Memory
  • System mutexes
  • Limit read/write to specific folders and files
  • etc

I'm using Windows or Linux, both are fine.

Is there any built in functionality or even a third party tool?

  • 3
    Have you heard of SELinux? – ThoriumBR Feb 24 at 19:42
  • I'll take a look, tx. – Edney Feb 24 at 20:17
1

Giving a linux-specific answer, I think SELinux (available in Red Hat like distros) or AppArmor (available in SUSE and ubuntu like distros) is exactly the thing you are looking for.

To quote wikipedia's AppArmor page:

AppArmor ("Application Armor") is a Linux kernel security module that allows the system administrator to restrict programs' capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the permission to read, write, or execute files on matching paths.

When you consider that almost all things in linux (sockets, shared memory, etc) have file paths, SELinux / AppArmor applies to most system resources.

| improve this answer | |
0

Somebody correct me if I am wrong, but this exact sandboxing model is not available in Linux because all applications run as users with user permissions. Hopefully it will be a thing of the future as WASM standard gains industry acceptance, because per application security is at the heart of it. You can probably achieve a good approximation if you run the application inside a container that runs only that application as a user with said privileges.

| improve this answer | |
  • What I criticize about user permissions is that it isn't really a different user. This is a mess (a work around), to create a new user to each new profile. Any user should map to a single person. – Edney Feb 24 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.