Re: [gentoo-hardened] Isolate users/programs?

Dear Jan,

-- 
dr Tóth Attila, Radiológus Szakorvos jelölt, 06-20-825-8057, 06-30-5962-962
Attila Toth MD, Radiologist in Training, [phone], [phone]

On Hét, November 24, 2008 21:03, Jan Klod wrote:
> Well, the idea is: if program is started with userid N != 0, what are the
> ways
> it can access the information, it is supposed to be forbidden to access in
> a
> normal Linux configuration (other users info)?
> As you might think, I am not really sure of what I need other than a way
> to
> forbid all the users access to other users files unless they are in a
> group
> and permissions allow it.

You don't need more than regular Unix-style access-control to achieve this
basically: every user must have its own group, and files should be created
without world-access rights by default. It can be configured on any
regular host.

> Many wild things can happen, I just think, this might be a good place
> where I
> could ask.
>
> For example: I install mailserver or run samba on a server, where some
> other
> things are going on and I totally don't want them to interfare in any
> possible way unless it has been intended.

If you want to separate services, you can install them in their own
chroot/jail environment or go for separate virtual machines. For the
former method grsecurity provides advanced protection and for the latter
strategy there are several possibilities for implementation.

>
> Hope, I made it clear enough...

Hardened project offers toolchain-based additional hardening and several
types of mandatory access control (MAC) techniques, which makes bypassing
system security much harder. Most of us would vote on their favorite
method(s) and argue against the other(s). You should dig yourself a bit
deeper into SELinux/RSBAC/PaX/Grsecurity/PIE-SSP and choose your
combination according to your taste.

>
> Jan
>

Regards,
Dw.