0

My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or accessing files that it shouldn't?

Basically, even if steam has a zero day exploit and an attacker can get code execution in my machine inside the steam process via for example sending a message, i want it to not be able to do anything malicious. Is this possible?

I already installed AppArmor, but at least with the default configuration it only stops simple scenarios and doesn't restrict a specific app?

EDIT: I am not saying everything else is secure, but right now i am only focused on restricting Steam and that's it, so for now lets just assume that everything else is OK and we just want to try to constraint Steam (or any other process) in case of successful exploit. And again, obviously we cannot secure ourselves against 100% of situations, but at least we can try to reach it..

I can easily do this in windows by writing a driver and restricting steam's process and its drivers(obviously 1% of attacks will still go through because of its driver, but i can block 99%), how can i achieve it in Linux?

4
  • @CaffeineAddiction I shouldn't have put the first part in my question. Yes, what i meant by that was the fact that i have closed all the ports other than steam, obviously stream is not the only entrance, but right now i am trying to constraint steam and that's it, lets "assume" everything else is fine for now and try to solve the steam case. I edited to question and removed that part in my question, obviously nothing is 100% secure.
    – OneAndOnly
    Aug 24 at 14:39
  • how can i completely restrict Steam's processes and modules to only have access to what they suppose to ... what are they suppose to have access too? Steam is an app store that hosts tens of thousands of games requiring different levels of access for DRM, DLC, Server hosting, access to hardware for camera/controler/vr support. On top of this Steam itself is uses an insecure version of Chromium Embedded Framework that points to mass amounts of user generated content ... the short answer to your question is "you cant". The long answer is "Depends on how usable you want to leave it" Aug 24 at 14:55
  • @CaffeineAddiction Well, for example i dont need any need for Microphone, and webcam, and don't need to be able to read files in my system that are not part of its own files, for example reading my browser databases and such. So basically i want to keep it as restricted as possible, only be able to play games online and thats it, i dont need anything else.
    – OneAndOnly
    Aug 25 at 15:23
  • @CaffeineAddiction How do you think every single AV out there becomes useful and actually are able to block many attacks? its because they use drivers to execute code in kernel mode, many actions are not possible unless you're in kernel mode, such as using ntoskrnl functions..
    – OneAndOnly
    Aug 25 at 16:16
1
  1. You have NOT fully secured your [supposedly personal] box for a loooong list of reasons. Nor you should have, really - you have probably achieved a reasonable level of security there.
  2. IF it is actually a high-value target for some ungodly reason, stop what you're doing and rethink the whole affair. If bad things happen if the data on this machine gets stolen, do not run Steam or anything over the bare minimum required, really, there. If you can handle this loss or data being encrypted, no point in being that paranoid. You are backing up your cat photos, aren't you?
  3. Long as you've sorted out the basics (it is not exposing ports to the web, you have strong passwords, not running things - especially ones like Steam - as root etc etc), the weakest link in the chain is you. You are at less of a risk of falling victim to some complicated large-scale attack than you are at a risk using some shady ppa and running things you don't understand to make something nigh irrelevant work.
  4. If Steam can run arbitrary code AND escalate privileges doing so, it is a bigger issue than just Steam. Not to say there can't be an exploit in say Proton - rather that some kind of threat is always there, and your response should be measured on both prevention and recouping fronts.
1
  • I shouldn't have put the first part in my question. Yes, what i meant by that was the fact that i have closed all the ports other than steam, obviously stream is not the only entrance, but right now i am trying to constraint steam and that's it, lets "assume" everything else is fine for now and try to solve the steam case. I edited to question and removed that part in my question, obviously nothing is 100% secure.
    – OneAndOnly
    Aug 24 at 14:39
1

How can I completely restrict Steam

  1. Setup new computer that is dedicated to Steam and Gaming
  2. Setup an isolated subnet for your Steam computer to reside on. Most enterprise routers would be capable of this. (these can be expensive, you might want to start on this one https://www.amazon.com/dp/B00YFJT29C)
  3. Setup either an IDS or IPS between your Steam computer and the Internet
  4. Write a exhaustive Information Security Policy and Incident Response Plan.
  5. Setup a Network Operations Control with a team of dedicated team of security engineers to monitor your NOC 24/7
  6. Build a vault with multifactor authentication and armed guards.
  7. Hire a mercenary army to protect your vault.
  8. Start a nuclear program as a deterrent to other nation state actors
  9. Setup an orbital laser array to defend against enemy nukes

-- or --

You do a risk assessment and come to the realization that what you are attempting to protect is not worth the time / man hours to protect it.

It basically comes down to this, gaming platforms are not designed to be secure, and by attempting to secure them you will most likely limit the functionality of said gaming platform. You cant "secure" steam ... so the next best option is to isolate it. The easiest and most secure way of Isolating it would be to get a different computer and put it on a different network segment. There are very secure companies that do have gaming platforms on their networks. In most cases, the device is put on the "guest" network such that it does not have access to any of the business internals. The gaming platform itself is not secured at all as the total loss of the gaming platform is insignificant in comparison to the cost of attempting to "secure" it.

7
  • There has to be a much simpler solution than buying another computer... Steam is a process, and should only have access to certain folders and certain functionality, and some of its functionality can be restricted such as webcam/Micorophone access, or accessing folders that it doesn't own.. so solving this is much simpler than buying an entire computer..
    – OneAndOnly
    Aug 25 at 15:25
  • The funny thing is that i can solve this very easily in windows by writing a driver..
    – OneAndOnly
    Aug 25 at 15:27
  • 1
    You are correct, there is a much simpler solution than buying another computer ... simply uninstall steam. Aug 25 at 15:47
  • Tell me this, why is it so simple to solve this in windows, and we can just write a driver/minifilter that blocks certain processes from accessing certain files or accessing webcam/microphone, but you seem to suggest its impossible in Linux? I sure hope you don't get hired at an EDR company, because i don't think your clients would love to hear "Uninstall that app and you'll be fine"
    – OneAndOnly
    Aug 25 at 15:55
  • You didn't imply its simple in Windows, I did. I write windows drivers and i can at least block 99% of user-mode exploits by writing a minifilter that blocks file accesses and another driver to block other unauthorized accesses by a process. And i am 100% certain that this is also possible in Linux. Does this block 100% of attacks? no. but thats the case with every single EDR.. that doesn't make them useless.
    – OneAndOnly
    Aug 25 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.