2

I wold like to set permissions on a per application basis, permissions like:

  • Creation of sockets
  • Creation of sub-process
  • If an application creates a sub-process child processes should inherit the same permissions
  • IPC
  • Shared Memory
  • System mutexes
  • Limit read/write to specific folders and files
  • etc

I'm using Windows or Linux, both are fine.

Is there any built in functionality or even a third party tool?

2
  • 3
    Have you heard of SELinux?
    – ThoriumBR
    Feb 24, 2020 at 19:42
  • I'll take a look, tx.
    – user227678
    Feb 24, 2020 at 20:17

2 Answers 2

1

Giving a linux-specific answer, I think SELinux (available in Red Hat like distros) or AppArmor (available in SUSE and ubuntu like distros) is exactly the thing you are looking for.

To quote wikipedia's AppArmor page:

AppArmor ("Application Armor") is a Linux kernel security module that allows the system administrator to restrict programs' capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the permission to read, write, or execute files on matching paths.

When you consider that almost all things in linux (sockets, shared memory, etc) have file paths, SELinux / AppArmor applies to most system resources.

0

Somebody correct me if I am wrong, but this exact sandboxing model is not available in Linux because all applications run as users with user permissions. Hopefully it will be a thing of the future as WASM standard gains industry acceptance, because per application security is at the heart of it. You can probably achieve a good approximation if you run the application inside a container that runs only that application as a user with said privileges.

1
  • What I criticize about user permissions is that it isn't really a different user. This is a mess (a work around), to create a new user to each new profile. Any user should map to a single person.
    – user227678
    Feb 24, 2020 at 20:20

You must log in to answer this question.