Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Ever since firewalls appeared on the scene, it became hard for rogue programs to access the internet. But you and I know that running applications get unrestricted access to the filesystem. They can read your files and send them to poppa. (programs such as web browsers and IM clients, which are allowed thru the internet firewall)

Any way to know which programs are accessing your files? or limit their access to a specific partition?

share|improve this question
1  
Actually thinking about this as if it covers all platforms, unless someone provides an answer for every OS, there is no single answer? Maybe this should be a discussion? –  Diago Sep 5 '09 at 9:31

5 Answers 5

up vote 4 down vote accepted

Host based intrusion prevention (HIPS) and sandboxing can be treated as filesystem firewall. HIPS applications monitor and restrict filesystem activities by applications. Sandboxing applications create a virtual filesystem for other applications so that the filesystem activities (writes/changes) done by the application running inside sandbox can be purged. Here's an article that explains different types of HIPS available for Windows:

Types of HIPS

share|improve this answer
    
Great to known that someone has actually thought of this before! –  Jarvis Sep 5 '09 at 10:33

One such firewall is called SE-Linux.

share|improve this answer

Process Monitor will tell you what processes are accessing which files under Windows. You can set up filters to restrict the overwhelming amount of information that can be first displayed to just certain processes.

It also tells you about registry access and gives information about stack traces, etc...

share|improve this answer
    
How do I configure it to: "display any programs/services that are accessing the H: drive"? –  Jarvis Sep 5 '09 at 9:30
    
Set the filter to match on the file path. –  Alex Angas Sep 7 '09 at 11:56

Windows Vista/W7/2008/2008R2 includes "mandatory integrity levels", a program running at "Low" can only access files/folders marked as "Low". Most user files are marked "Medium" so IE running "Low" can't access them.

However this only gives limited control and requires applications to be written to make use of it.

share|improve this answer

Under Unix (including Linux) there's chroot ("change root"), which makes a directory act as the filsystem root directory for a particular program (and any programs it executes). Thus the target program can't access any files outside the given directory tree.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.