1

Ever since firewalls appeared on the scene, it became hard for rogue programs to access the internet. But you and I know that running applications get unrestricted access to the filesystem. They can read your files and send them to poppa. (programs such as web browsers and IM clients, which are allowed thru the internet firewall)

Any way to know which programs are accessing your files? or limit their access to a specific partition?

  • 1
    Actually thinking about this as if it covers all platforms, unless someone provides an answer for every OS, there is no single answer? Maybe this should be a discussion? – BinaryMisfit Sep 5 '09 at 9:31
4

Host based intrusion prevention (HIPS) and sandboxing can be treated as filesystem firewall. HIPS applications monitor and restrict filesystem activities by applications. Sandboxing applications create a virtual filesystem for other applications so that the filesystem activities (writes/changes) done by the application running inside sandbox can be purged. Here's an article that explains different types of HIPS available for Windows:

Types of HIPS

|improve this answer|||||
  • Great to known that someone has actually thought of this before! – Robinicks Sep 5 '09 at 10:33
5

One such firewall is called SE-Linux.

|improve this answer|||||
1

Process Monitor will tell you what processes are accessing which files under Windows. You can set up filters to restrict the overwhelming amount of information that can be first displayed to just certain processes.

It also tells you about registry access and gives information about stack traces, etc...

|improve this answer|||||
  • How do I configure it to: "display any programs/services that are accessing the H: drive"? – Robinicks Sep 5 '09 at 9:30
  • Set the filter to match on the file path. – Alex Angas Sep 7 '09 at 11:56
0

Windows Vista/W7/2008/2008R2 includes "mandatory integrity levels", a program running at "Low" can only access files/folders marked as "Low". Most user files are marked "Medium" so IE running "Low" can't access them.

However this only gives limited control and requires applications to be written to make use of it.

|improve this answer|||||
0

Under Unix (including Linux) there's chroot ("change root"), which makes a directory act as the filsystem root directory for a particular program (and any programs it executes). Thus the target program can't access any files outside the given directory tree.

|improve this answer|||||
0

Forgive me for reviving an ancient thread, but in case anyone else goes looking, this is available in some antivirus applications as a feature. In Bitdefender Total Security it is called Safe Files > Application Access. F-Secure has XFENCE, which has incorporated Little Flocker which was once a fully featured filesystem "firewall" application. I had hoped that Little Flocker would become as robust as Little Snitch (a firewall application on the Mac), but when the author of Little Flocker was hired at Apple, he sold Little Flocker to F-Secure. XFENCE works, but does not have a "forever" option to store rules like Little Flocker did, the longest a rule can persist is just until reboot, which is highly inconvenient in day-to-day use. Hands Off! Is the closest thing to Little Flocker that I can find for the Mac these days.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.