Are there any obvious ways of separating a (Linux) user's processes into separate groups, with each group having their own security domain.
The motivation for this question is the following:
- I commonly have my password manager running with at least one database unlocked
- I'm a software developer and routinely run code from "untrusted" sources (e.g.
pip install matplotlibcan do anything my user can, it just tends to be well behaved)
- I don't want most programs (e.g.
pipor the scripts it runs) to be able to interact with the password manager
- I want to be able to run some code that does interact with my password manager, e.g. fetch the password for a site, send it to my browser
Qubes solves this by running each program in it's own VM (e.g. via KVM) but I don't want to go that far. I'm pretty careful about the code I run, and still want some programs to be able to talk to each other via Unix domain sockets and so on.
The separation I'm talking about is having a couple (probably more in practice) of security domains:
- The first one would be the "trusted" one that you log into, your window manager runs there, password manager, etc.
- The second would be where most other things happen, e.g. this is where I'd run the shell that I executed the
pipcommand above from
The password manager interaction would happen in the "trusted" domain, which could, e.g., insert keyboard events into the second domain to enter the password.
Is this a solved problem? what should I be searching for? Is this better suited to https://stackoverflow.com/?