4 ms·
>I'd like to see Ubuntu, Arch, or Fedora (the big distros with the market share to push for best practices) enforce disk quotas on config directories - ie, a pr
by vram22 11y ago
>I'd like to see Ubuntu, Arch, or Fedora (the big distros with the market share to push for best practices) enforce disk quotas on config directories - ie, a program cannot use more than 5MB of space there
Potentially useful idea, in general.
There used to be a quota feature on some Unix versions (SVR3 etc, IIRC), with commands to both set and get quotas, though I never really used it.
Update: Just googled for "Linux disk quota", and some links show that there seems to be some support. But it is per file system, not per directory. though per-user limits seem to be supported too.
But even if a per-directory limit could be enforced, how would you get around the fact that the program could create files in other dirs than the controlled ones, under your overall home dir (as long as they had write permission)? I supposed some kind of script-based monitoring could be improvised, but it might be a kludge ... and even if you could detect it in near real time, it wouldn't be a good idea to kill the process responsible.
Interested to know if there are any other methods or approaches.
Restricting write permissions could be the basis for one approach.
- zanny 11y agoMAC addresses your later concerns. The fact Arch does not support MAC at all then becomes somewhat of a problem, but it is already a huge problem to begin with. You can simply make SELinux / Apparmor profiles that default-restrict applications to ~/.config/<appname> and ~/.local/share/<appname> with quotas. Applications that need exceptions would be shipped with apparmor or selinux profile files to amend that. Its also how you can make desktop Linux a lot more sophisticated in permissions management for applications. I know Apparmor at least supports the idea of network, peripheral, and display access in the same way it controls directory access. It would be a huge usability and security boon to the Linux desktop to have notifications of requests to access resources when an application does so - I think Android 6 is absolutely going in the right direction on application control, and adopting those ideas would be valuable.
- vram22 11y agoInteresting, thanks. Will check out those topics. Agree on the general point of the security benefits.
- vram22 11y ago>MAC addresses your later concerns. What's MAC,, in the context I wrote about? Googled a bit, being a common acronym as well as abbreviation for Macintosh makes it difficult to find the right links.
- vram22 11y agoOk, never mind, found it under Wikipedia link for AppArmor: https://en.wikipedia.org/wiki/Mandatory_access_control https://en.wikipedia.org/wiki/Mandatory_access_control