1

As a developer, I ask how to approach security concerns regarding permissions of a binary which needs access to resources only available to root users.

For example, let's think of a simple tool which creates a virtual device or executes commands which may not be executed by the user opening that application.

The easiest approach of course is to change the owner of the application to root chown root <binary>and allow everyone to use it chmod 5755 <binary>. Of course, this is just an invitation for issues like privilege escalations.

How to approach this issue "securely"?

My idea was to create a custom user at the end of the installation process (where the post installation script should have root access anyway) and assign the correct permissions to write to specific directories and execute certain binaries.

  • Setup file permissions via setfacl
  • Allow executing certain binaries via /etc/sudoers

I would then change the application owner to that freshly created user and again allow everybody to execute it, tough this time the application is not bound to root but to a user only having the permission it needs to fulfil its purpose.

Is this the right way, or are there any (perhaps better) alternatives?

Best would be a universal way as not every distribution may ship with selinux, apparmor or polkit even tough those frameworks probably are well suited for such problems. Of course, setting a dependency to one of those could be a possibility.

Improve this question
5
  • Have you considered using a (systemd) service? That could run with the permissions needed, and the app just run as a user app. (Like how aptd works)
    – LvB
    Jul 7, 2021 at 15:29
  • You mean a daemon (with all the privileges) which is being controlled by the user application which doesn't have any privileges over some interface (e.g. IPC, DBUS, ...)?
    – hypnomaki
    Jul 7, 2021 at 15:40
  • Yup. Or In this case a Unix socket.
    – LvB
    Jul 7, 2021 at 16:05
  • Another alternative is to set up a dbus service.
    – user10489
    Jul 8, 2021 at 4:57
  • I would extract those privileged operations and lock them into an independent binary. This binary would be suid root and execute the required operations referring to them by number -- so you run minisudo 1, minisudo 2 and so on. Not every operation can be controlled this way, but in my experience, most can.
    – LSerni
    Jul 8, 2021 at 9:47

1 Answer 1

Reset to default
1

Use capabilities for your application.

Starting with kernel 2.2, Linux divides the privileges traditionally associated with superuser into distinct units, known as capabilities, which can be independently enabled and disabled. Capabilities are a per-thread attribute.

(formatting added)

This allows your application to get only the permissions it needs and at a very fine granularity.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .