2

There is user1 and user2. All work is done from under user1. user2 is only created to store important information.

If important information is stored in RAM, but in the session of user1, which is easier to access for an attacker: the RAM from under user1 or the home folder of user2?

What is the threat model here?

Suppose an attacker gained access to user1's account and can execute any code, just like user1. If the attacker has gained root privileges, it is clear that the attacker can easily get to the RAM and to user2, of course.

Can the attacker run arbitrary code with user1's privileges?

Suppose there is a vulnerable or infected program that is used by user1

What would be the permissions on user2's home directory?

User2 folder (root:user2 730), files and folders inside are accessible only to user2

Are Spectre-like side-channel attacks in scope?

The device is vulnerable to these attacks, all hope is on the OS.

New contributor
bomiam is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
4
  • What is the threat model here? Can the attacker run arbitrary code with user1's privileges? What would be the permissions on user2's home directory? Are Spectre-like side-channel attacks in scope?
    – amon
    2 days ago
  • @amon Answered you
    – bomiam
    2 days ago
  • I assume the password is stored in the virtual memory of a user1 process?
    – forest
    22 hours ago
  • @forest Yes, but generally, processes can inspect/dump the memory of other processes running under the same uid (at least on linux and windows). A process may however take steps to prevent other unprivileged processes from accessing their memory. And gaining access to another user's files, I think, is much more difficult.
    – bomiam
    15 hours ago

1 Answer 1

3

Linux is designed to protect user2's files from user1, not user1's memory from itself.

If an attacker is able to run arbitrary code on user1, he will be able to fairly easily gain access to the memory of processes running under that same user. This is due to the user separation design in Linux: individual users are protected from each other, but little to no protection is provided between processes running under the same user. In other words, Linux provides strong inter-user isolation, but weak intra-user isolation. The attacker would have to break the intra-user isolation to bypass DAC (discretionary access controls) and access the home folder of user2. This would require gaining root or something equivalent, such as the CAP_DAC_OVERRIDE in capabilities(7). This is harder.

An attacker running as user1 could use ptrace(2) to attach to another process under user1 and read or modify its memory contents. Alternatively, the attacker could use process_vm_readv(2) which can do the same thing. Although that particular vector can be mitigated by using the Yama LSM which restricts certain types of direct memory access, many other techniques exist which could compromise a user1 process, for example by exporting LD_PRELOAD (see ld.so(8)) to cause the target process to load an attacker-controlled library the next time it is started.

Note that it is possible, in theory, to protect two processes running under the same user from each other, but it's non-trivial and requires a strong knowledge of Linux system architecture. Various Linux sandbox technologies and mandatory access control systems can be used to implement fine-grained isolation policies. For example, a strong whitelist implemented with seccomp(2) can restrict which syscalls the target process can use, which can prevent it from performing actions that could be used to compromise another process, even if it's running under the same user.

1
  • Which is (theoretically) harder to access: the process data/RAM (user2) or the filesystem (user2).
    – bomiam
    14 hours ago

Your Answer

bomiam is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.