1

Deno (the node.js fork) is designed to be secure by default. Therefore, unless you specifically enable it, a program run with Deno has no file, network, or environment access. Deno has a set of command line flags that allow the process permissions to security-sensitive functions.

https://deno.land/manual/getting_started/permissions

--allow-env=<allow-env> Allow environment access for things like getting and setting of environment variables. Since Deno 1.9, you can specify an optional, comma-separated list of environment variables to provide an allow-list of allowed environment variables.
--allow-hrtime Allow high-resolution time measurement. High-resolution time can be used in timing attacks and fingerprinting.
--allow-net=<allow-net> Allow network access. You can specify an optional, comma-separated list of IP addresses or hostnames (optionally with ports) to provide an allow-list of allowed network addresses.
--allow-ffi Allow loading of dynamic libraries. Be aware that dynamic libraries are not run in a sandbox and therefore do not have the same security restrictions as the Deno process. Therefore, use with caution. Please note that --allow-ffi is an unstable feature.
--allow-read=<allow-read> Allow file system read access. You can specify an optional, comma-separated list of directories or files to provide an allow-list of allowed file system access.
--allow-run=<allow-run> Allow running subprocesses. Since Deno 1.9, You can specify an optional, comma-separated list of subprocesses to provide an allow-list of allowed subprocesses. Be aware that subprocesses are not run in a sandbox and therefore do not have the same security restrictions as the Deno process. Therefore, use with caution.
--allow-write=<allow-write> Allow file system write access. You can specify an optional, comma-separated list of directories or files to provide an allow-list of allowed file system access.
-A, --allow-all Allow all permissions. This enables all security sensitive functions. Use with caution.

I want to create this type of sandbox for any process that is running, for example a Ruby script, or python server, or a compiled C++ executable. I have seen you can do some of these things with AppArmor in linux or SELinux, but I'm a little hazy on the syntax. Specifically how do I disallow network requests to all but a specific hostname? How can I disallow file read/writes from everything but a specific file or directory path?

Is it possible to do this with AppArmor, or SELinux? Is there any tutorials or documentation that would be useful to review?

3
  • Have you read the documentation that comes with either SELinux or AppArmor? I think that would be an essential first step: always read the documentation first
    – Rory Alsop
    Commented Dec 8, 2021 at 19:18
  • Linux has loads of security features, but no built-in way to control them together. Whereas Docker, Flatpak, and Systemd provide an interface to some of them, I like Firejail for isolating individual processes in a desktop setting. But things might break in unexpected ways, especially if you start blocklisting individual syscalls.
    – amon
    Commented Dec 8, 2021 at 19:20
  • I think some of the things Im finding difficult to do with AppArmor is restricting outgoing and incoming network calls by specific hostnames or addresses.
    – cphoover
    Commented Dec 8, 2021 at 20:56

0

You must log in to answer this question.

Browse other questions tagged .