5 ms·

How hard would it be to strengthen a Linux-system to make the browser operate with less rights in order to give an attacker less access to the /etc/* folders? B

by wjnc 11y ago

How hard would it be to strengthen a Linux-system to make the browser operate with less rights in order to give an attacker less access to the /etc/* folders? Because that seems to be the main angle of attack. Get user permission via bug in browser, just download a lot of files / folders and see if anything useful pops up.

tachion 11y ago
I dont know about Linux, but if you'd be comfortable leaving it-is-linux-only-that-exists land, then PC-BSD[0], which is a desktop focused distro of FreeBSD[1], allows you running your browser in a Jail[2], which is a container technology with years of battle experience in production :) [0] https://www.pcbsd.org/ https://www.pcbsd.org/ [1] https://www.freebsd.org/ https://www.freebsd.org/ [2] https://www.freebsd.org/doc/handbook/jails.html https://www.freebsd.org/doc/handbook/jails.html
- cbd1984 11y ago
  And if you develop jails, you get the kernel intrinsics that Docker leverages, which brings you back to Linux...
  - tachion 11y ago
    What are those exactly? Docker seems to me more like a userland glue for kernel based containers, and since it's starting to support FreeBSD Jails, I dont see why again it has to lead to Linux only, instead to FreeBSD OR Linux (or anything else supported by libcontainer for that matter). The main point is, Linux is not the only thing, and talking like that reinforces that incorrect point of view in other unaware people. Technology diversity is extremely important and cool thing.
    - vetinari 11y ago
      Those intrinsics would be exactly cgroups, they isolate much more than just part of hierarchy in filesystem.
im3w1l 11y ago
Running applications also have labels. For example, your web browser may be running as firefox_t. Type enforcement simply allows you to specify what application label can access what resource label. In the most simple terms SELinux lets you allow an application to do something with a resource: allow firefox_t user_home_t : file { read write }; This simply allows your web browser, running as firefox_t to read and write files in your home directory, labeled as user_home_t. http://selinuxproject.org/page/FAQ#How_does_SELinux_work.3F http://selinuxproject.org/page/FAQ#How_does_SELinux_work.3F
- unfamiliar 11y ago
  Why isn't SE linux more widely deployed? Is it something that can be turned on in existing installations?
  - teh_klev 11y ago
    Funny you should ask: https://news.ycombinator.com/item?id=10025348 https://news.ycombinator.com/item?id=10025348 https://www.youtube.com/watch?v=bQqX3RWn0Yw https://www.youtube.com/watch?v=bQqX3RWn0Yw
  - Karunamon 11y ago
    A (deserved, but outdated) reputation for breaking things and being hard to configure, nonexistent or inferior toolsets on non-RPM distros due to lack of support on same.
riquito 11y ago
You can use selinux for that. In Fedora there is an application called sandbox that help you with that e.g. see http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-with-Fedora.html http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-...
- groks 11y ago
  The sandbox -X command doesn't work: https://bugzilla.redhat.com/show_bug.cgi?id=1103622 https://bugzilla.redhat.com/show_bug.cgi?id=1103622 - and hasn't worked for over a year. The author is mia from the bug and seems to have given up: https://danwalsh.livejournal.com/72697.html https://danwalsh.livejournal.com/72697.html
heinrich5991 11y ago
You could use firejail[1]. [1]: https://l3net.wordpress.com/2014/09/19/firejail-a-security-sandbox-for-mozilla-firefox/ https://l3net.wordpress.com/2014/09/19/firejail-a-security-s...
martius 11y ago
On Linux, I use the unshare command to hide my /home, you can do the same thing with /etc: sudo unshare -m bash -c "mount --make-rslave / && mount -n -o bind /tmp/empty /home && sudo -u $(whoami) firefox -ProfileManager -no-remote" it : - forks the mountpoints table for the process to be executed (bash) - it requires capabilities (hence sudo), - make / as as slave mount in this context (because of systemd which shares the / mountpoint (see: https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt https://www.kernel.org/doc/Documentation/filesystems/shareds...), - bind an empty directory to /home (that I previously created), it will only be visible for this process and its children, since it's in an unshared mountpoints table, - I run firefox in user mode.

by wjnc 11y ago

tachion 11y ago

I dont know about Linux, but if you'd be comfortable leaving it-is-linux-only-that-exists land, then PC-BSD[0], which is a desktop focused distro of FreeBSD[1], allows you running your browser in a Jail[2], which is a container technology with years of battle experience in production :) [0] https://www.pcbsd.org/ https://www.pcbsd.org/ [1] https://www.freebsd.org/ https://www.freebsd.org/ [2] https://www.freebsd.org/doc/handbook/jails.html https://www.freebsd.org/doc/handbook/jails.html

cbd1984 11y ago
And if you develop jails, you get the kernel intrinsics that Docker leverages, which brings you back to Linux...
- tachion 11y ago
  What are those exactly? Docker seems to me more like a userland glue for kernel based containers, and since it's starting to support FreeBSD Jails, I dont see why again it has to lead to Linux only, instead to FreeBSD OR Linux (or anything else supported by libcontainer for that matter). The main point is, Linux is not the only thing, and talking like that reinforces that incorrect point of view in other unaware people. Technology diversity is extremely important and cool thing.
  - vetinari 11y ago
    Those intrinsics would be exactly cgroups, they isolate much more than just part of hierarchy in filesystem.

im3w1l 11y ago

Running applications also have labels. For example, your web browser may be running as firefox_t. Type enforcement simply allows you to specify what application label can access what resource label. In the most simple terms SELinux lets you allow an application to do something with a resource: allow firefox_t user_home_t : file { read write }; This simply allows your web browser, running as firefox_t to read and write files in your home directory, labeled as user_home_t. http://selinuxproject.org/page/FAQ#How_does_SELinux_work.3F http://selinuxproject.org/page/FAQ#How_does_SELinux_work.3F

unfamiliar 11y ago
Why isn't SE linux more widely deployed? Is it something that can be turned on in existing installations?
- teh_klev 11y ago
  Funny you should ask: https://news.ycombinator.com/item?id=10025348 https://news.ycombinator.com/item?id=10025348 https://www.youtube.com/watch?v=bQqX3RWn0Yw https://www.youtube.com/watch?v=bQqX3RWn0Yw
- Karunamon 11y ago
  A (deserved, but outdated) reputation for breaking things and being hard to configure, nonexistent or inferior toolsets on non-RPM distros due to lack of support on same.

riquito 11y ago

You can use selinux for that. In Fedora there is an application called sandbox that help you with that e.g. see http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-with-Fedora.html http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-...

groks 11y ago
The sandbox -X command doesn't work: https://bugzilla.redhat.com/show_bug.cgi?id=1103622 https://bugzilla.redhat.com/show_bug.cgi?id=1103622 - and hasn't worked for over a year. The author is mia from the bug and seems to have given up: https://danwalsh.livejournal.com/72697.html https://danwalsh.livejournal.com/72697.html

heinrich5991 11y ago

You could use firejail[1]. [1]: https://l3net.wordpress.com/2014/09/19/firejail-a-security-sandbox-for-mozilla-firefox/ https://l3net.wordpress.com/2014/09/19/firejail-a-security-s...

martius 11y ago

On Linux, I use the unshare command to hide my /home, you can do the same thing with /etc: sudo unshare -m bash -c "mount --make-rslave / && mount -n -o bind /tmp/empty /home && sudo -u $(whoami) firefox -ProfileManager -no-remote" it : - forks the mountpoints table for the process to be executed (bash) - it requires capabilities (hence sudo), - make / as as slave mount in this context (because of systemd which shares the / mountpoint (see: https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt https://www.kernel.org/doc/Documentation/filesystems/shareds...), - bind an empty directory to /home (that I previously created), it will only be visible for this process and its children, since it's in an unshared mountpoints table, - I run firefox in user mode.