Unauthorized file writes on Linux

Question

Suppose my web browser or any other web-connected app has a minor security hole that won't allow an attacker to run code but will allow them to write a piece of text into a text file I own.

On a typical Linux distro however, certain text files, such as .bashrc, are bound to get executed (for all intents and purposes), and in the case of .bashrc quite frequently.

There's not much an attacker can't do if they can execute shell code.

How can one protect themselves from this? Would it be a good idea to keep such config files along with executables in user-writables paths chmod -w? Is this security concern far-fetched?

Answer 1

Well any program can have security flaws and one's that interact with the Internet are exposed to potentially malicious content. That said the major browsers have pretty good track records (all things considered) at reacting to security issues and issuing appropriate patches.

If you do decide to try to protect yourself from this, it might make sense to isolate your browser from the rest of your system.

The level of isolation you implement would likely depend on how much inconvenience you were willing to put up with and how concerned you were. Some options would be

• Run the program in a dedicated VM that rollsback all changes on reboot. This avoids any state being saved and if an attacker can write to the filesystem, the change is lost on reboot.
• Implement some kind of linux container (e.g. docker) to run your browser in. This has the advantage of a smaller performance hit and less disk space utilization, but you lose a bit of isolation.
• Use something like AppArmor or SELinux to restrict what the application can do on your system.