1

Are there any obvious ways of separating a (Linux) user's processes into separate groups, with each group having their own security domain.

The motivation for this question is the following:

  • I commonly have my password manager running with at least one database unlocked
  • I'm a software developer and routinely run code from "untrusted" sources (e.g. pip install matplotlib can do anything my user can, it just tends to be well behaved)
  • I don't want most programs (e.g. pip or the scripts it runs) to be able to interact with the password manager
  • I want to be able to run some code that does interact with my password manager, e.g. fetch the password for a site, send it to my browser

Qubes solves this by running each program in it's own VM (e.g. via KVM) but I don't want to go that far. I'm pretty careful about the code I run, and still want some programs to be able to talk to each other via Unix domain sockets and so on.

The separation I'm talking about is having a couple (probably more in practice) of security domains:

  1. The first one would be the "trusted" one that you log into, your window manager runs there, password manager, etc.
  2. The second would be where most other things happen, e.g. this is where I'd run the shell that I executed the pip command above from

The password manager interaction would happen in the "trusted" domain, which could, e.g., insert keyboard events into the second domain to enter the password.

Is this a solved problem? what should I be searching for? Is this better suited to https://stackoverflow.com/?

Improve this question
4
  • Maybe you're looking for cgroups (control groups)?
    – harrymc
    Mar 22, 2022 at 15:49
  • @harrymc yup, certainly occurred to me that cgroups would likely be involved in the implementation somewhere, it was a term I searched for before asking. I was hoping there might be something already written that packaged things up nicely
    – Sam Mason
    Mar 22, 2022 at 15:52
  • That would perhaps be Docker.
    – harrymc
    Mar 22, 2022 at 15:54
  • @harrymc that's far heavier than I was thinking! and which parts would be in docker, presumably the untrusted parts? would seem to imply disabling so many features in docker (i.e. use host networking, mount most of the host file system in the container, etc) that it becomes something else
    – Sam Mason
    Mar 22, 2022 at 16:24

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .