Hacker News Reader

Comment by wjnc | Hacker News Reader

How hard would it be to strengthen a Linux-system to make the browser operate with less rights in order to give an attacker less access to the /etc/* folders? Because that seems to be the main angle of attack. Get user permission via bug in browser, just download a lot of files / folders and see if anything useful pops up.

View on HN

I dont know about Linux, but if you'd be comfortable leaving it-is-linux-only-that-exists land, then PC-BSD[0], which is a desktop focused distro of FreeBSD[1], allows you running your browser in a Jail[2], which is a container technology with years of battle experience in production :)

[0] https://www.pcbsd.org/

[1] https://www.freebsd.org/

[2] https://www.freebsd.org/doc/handbook/jails.html

And if you develop jails, you get the kernel intrinsics that Docker leverages, which brings you back to Linux...

What are those exactly? Docker seems to me more like a userland glue for kernel based containers, and since it's starting to support FreeBSD Jails, I dont see why again it has to lead to Linux only, instead to FreeBSD OR Linux (or anything else supported by libcontainer for that matter). The main point is, Linux is not the only thing, and talking like that reinforces that incorrect point of view in other unaware people. Technology diversity is extremely important and cool thing.

Those intrinsics would be exactly cgroups, they isolate much more than just part of hierarchy in filesystem.

Running applications also have labels. For example, your web browser may be running as firefox_t. Type enforcement simply allows you to specify what application label can access what resource label. In the most simple terms SELinux lets you allow an application to do something with a resource:

    allow firefox_t user_home_t : file { read write };

This simply allows your web browser, running as firefox_t to read and write files in your home directory, labeled as user_home_t.

http://selinuxproject.org/page/FAQ#How_does_SELinux_work.3F

Why isn't SE linux more widely deployed? Is it something that can be turned on in existing installations?

Funny you should ask:

https://news.ycombinator.com/item?id=10025348

https://www.youtube.com/watch?v=bQqX3RWn0Yw

A (deserved, but outdated) reputation for breaking things and being hard to configure, nonexistent or inferior toolsets on non-RPM distros due to lack of support on same.

On Linux, I use the unshare command to hide my /home, you can do the same thing with /etc:

  sudo unshare -m bash -c "mount --make-rslave / && mount -n -o bind /tmp/empty /home && sudo -u $(whoami) firefox -ProfileManager -no-remote"

it :

- forks the mountpoints table for the process to be executed (bash) - it requires capabilities (hence sudo),

- make / as as slave mount in this context (because of systemd which shares the / mountpoint (see: https://www.kernel.org/doc/Documentation/filesystems/shareds...),

- bind an empty directory to /home (that I previously created), it will only be visible for this process and its children, since it's in an unshared mountpoints table,

- I run firefox in user mode.

You can use selinux for that.

In Fedora there is an application called sandbox that help you with that

e.g. see http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-...

The sandbox -X command doesn't work: https://bugzilla.redhat.com/show_bug.cgi?id=1103622 - and hasn't worked for over a year.

The author is mia from the bug and seems to have given up: https://danwalsh.livejournal.com/72697.html

You could use firejail[1].

[1]: https://l3net.wordpress.com/2014/09/19/firejail-a-security-s...

Reply on news.ycombinator.com