How to completely restrict Steam in Linux to defend against remote zero day exploits?

Question

My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or accessing files that it shouldn't?

Basically, even if steam has a zero day exploit and an attacker can get code execution in my machine inside the steam process via for example sending a message, i want it to not be able to do anything malicious. Is this possible?

I already installed AppArmor, but at least with the default configuration it only stops simple scenarios and doesn't restrict a specific app?

EDIT: I am not saying everything else is secure, but right now i am only focused on restricting Steam and that's it, so for now lets just assume that everything else is OK and we just want to try to constraint Steam (or any other process) in case of successful exploit. And again, obviously we cannot secure ourselves against 100% of situations, but at least we can try to reach it..

I can easily do this in windows by writing a driver and restricting steam's process and its drivers(obviously 1% of attacks will still go through because of its driver, but i can block 99%), how can i achieve it in Linux?

Answer 1

1. You have NOT fully secured your [supposedly personal] box for a loooong list of reasons. Nor you should have, really - you have probably achieved a reasonable level of security there.
2. IF it is actually a high-value target for some ungodly reason, stop what you're doing and rethink the whole affair. If bad things happen if the data on this machine gets stolen, do not run Steam or anything over the bare minimum required, really, there. If you can handle this loss or data being encrypted, no point in being that paranoid. You are backing up your cat photos, aren't you?
3. Long as you've sorted out the basics (it is not exposing ports to the web, you have strong passwords, not running things - especially ones like Steam - as root etc etc), the weakest link in the chain is you. You are at less of a risk of falling victim to some complicated large-scale attack than you are at a risk using some shady ppa and running things you don't understand to make something nigh irrelevant work.
4. If Steam can run arbitrary code AND escalate privileges doing so, it is a bigger issue than just Steam. Not to say there can't be an exploit in say Proton - rather that some kind of threat is always there, and your response should be measured on both prevention and recouping fronts.

Answer 2

How can I completely restrict Steam

1. Setup new computer that is dedicated to Steam and Gaming
2. Setup an isolated subnet for your Steam computer to reside on. Most enterprise routers would be capable of this. (these can be expensive, you might want to start on this one https://www.amazon.com/dp/B00YFJT29C)
3. Setup either an IDS or IPS between your Steam computer and the Internet
4. Write a exhaustive Information Security Policy and Incident Response Plan.
5. Setup a Network Operations Control with a team of dedicated team of security engineers to monitor your NOC 24/7
6. Build a vault with multifactor authentication and armed guards.
7. Hire a mercenary army to protect your vault.
8. Start a nuclear program as a deterrent to other nation state actors
9. Setup an orbital laser array to defend against enemy nukes

-- or --

You do a risk assessment and come to the realization that what you are attempting to protect is not worth the time / man hours to protect it.

It basically comes down to this, gaming platforms are not designed to be secure, and by attempting to secure them you will most likely limit the functionality of said gaming platform. You cant "secure" steam ... so the next best option is to isolate it. The easiest and most secure way of Isolating it would be to get a different computer and put it on a different network segment. There are very secure companies that do have gaming platforms on their networks. In most cases, the device is put on the "guest" network such that it does not have access to any of the business internals. The gaming platform itself is not secured at all as the total loss of the gaming platform is insignificant in comparison to the cost of attempting to "secure" it.