Hot answers tagged

58

You can disable USB storage on Linux by blacklisting the module. modprobe -r usb-storage echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf echo blacklist uas >> /etc/modprobe.d/10-usbstorage-blacklist.conf If your users have physical access to the machine, and knows the encryption keys, the game is up no matter what ...


21

Client-server architecture This is another approach that could make copying files much harder, but it requires investing more effort from your side. Access to the information could be setup on a client-server architecture basis with information being stored in a database (such as MySQL or PostgreSQL) on a remote server in a secure location. Then, provide ...


20

In addition to blocking USB (see other answers above): Disable networking, because... ... otherwise user will use remote access to your machine, e.g. via scp or ftp, and copy files from your machine. ... otherwise logged in users will be able to transfer file via net from your machine to some other machine via scp, ftp, samba, http.


13

OK, I'm totally not a security expert and maybe this is completely off the mark (let me know in the comments!), but... If you can secure the box physically (otherwise all bets are off), then maybe you can let the user log on only with user A. All the sensitive files however would belong to user B and inaccessible to user A. EXCEPT for one program "PDF ...


10

VNC Your files could be stored on a computer in a secure location. Setup a VNC server on it and disable file transfer capability. Per this question on ServerFault it can be done in TightVNC. Ensure no other ports are open on the computer that stores your files. Provide a VNC client station and lock it down by: disabling I/O ports in the OS and on the ...


5

If you're looking for signed binaries you may find elfsign and elfverify to be of interest to you. This doesn't provide a tie in for the linker. It's a manually process that writes the signature into the ELF header. Additionally, I would suggest checking out the kernel's IMA appraisal extension. See also, 2013 Signing ELF binaries 2012 IMA appraisal ...


3

If you just want to disable all usb devices, have a look at usb-storage.ko (USB Mass Storage driver under Linux). Disabling the driver would affect all usb devices, keyboards/mice included. To disable the driver, you could blacklist it by modifying /etc/modprobe.d/blacklist.conf. Just add the line: blacklist usb-storage This solution assumes other users ...


2

How about something like a human bottleneck via procedure instead of automation and access to all files at once? All of the proposed solutions propose making the computer restrict access. This suffers from the problem that computers are ultimately stupid at the lowest level, and do what they're told. Since the HD is using whole disk encryption, all files ...


2

Following the principle of "only gives one the rights needed to achieve his task", maybe you can implement a restricted shell that will enforce that users of your system only do what you allow them to do. If your users are not able to: scp mount launch any network utility (firefox, netcat, curl) Use bash builtins to open network stream. Then the only way ...


1

To be clear this question is more of an opinion then a hard fact. Selinux and Firejail preform sandboxing by separate mean. SeLinux at its core is a advances access control list (using Labels), while Firejail make use Seccomp and Linux Namespaces (https://firejail.wordpress.com/). Yes, installing setuid program do alway have a danger and since you already ...


1

SELinux contexts come in addition to permissions and ownership. In order to access a file, a process needs to have the privileges given by ownership and to pass the checks made by SELinux. To take an extreme example, it's possible to create a root account (user ID 0) on a machine where SELinux confines this account so much that it can't make use of root ...


1

I'm going to state the obvious here and just say, "don't include /contents/of/host/secrets in your builder VM." Presumably, though, you've got something going on that makes the obvious answer less obviously correct. So let's circle back to the other obvious bit, and point out that "arbitrary Docker build" is literally "arbitrary code execution", since the ...


Only top voted, non community-wiki answers of a minimum length are eligible