0

Is it possible to limit programs' access only to certain directory, for example, to run Viber on Fedora and force it to only be able to read under /home/username/.local/share/viber/exchange and no other directories?

I have managed to create and run Viber as another user:group (viber:viber). When I try to open from inside Viber files that belong to me or any other user, it can't read them. Goal achieved but partly. Now, I stumbled against another problem, which is Viber works only with messages and when I try to make a call, it says, that it can't find neither microphone nor speakers? It feels that I know why (I run X Server (GNOME) as myself and Viber as viber:viber (user:group) ) but I'm not sure how to let viber user to use microphone and speakers while running X server under my name?

May be, I need to add viber user to a certain group? Probably there are some workarounds with SELinux? If so could you provide proper policy example? :D

Viber seems to be great but it's not open-source and only God knows, what is on the source-code of that pre-compiled piece of software!

2

Using chroot

Create a small root directory containing /bin, /usr, /lib, /tmp and so on (depending on your need), copy all your stuff into this new root, than run chroot into this directory.

chroot command is a very old Un*x tool, built exactly in this meaning.

You could bind directory in container by using mount --bind.

Have a look at man chroot and man mount!

Little try:

ldd /bin/bash 
    linux-vdso.so.1 =>  (0x00007fff3e4b5000)
    libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f06290a1000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f0628e9d000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f0628b12000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f06292e8000)


sudo -s

Warning, from there!

mkdir /tmp/test/chrooted/lib64
cp -t /tmp/test/chrooted/lib/x86_64-linux-gnu/ \
    /lib/x86_64-linux-gnu/{libc.so.6,libdl.so.2,libtinfo.so.5}
cp -t /tmp/test/chrooted/lib64 /lib64/ld-linux-x86-64.so.2 
chroot /tmp/test/chrooted

I'm jailed!

ls
bash: ls: command not found

There is no ls command in /bin!

Using openvz or lxc

Next step in light virtualisation is to run one of openvz or lxc (or other, maybe).

This tools do approx. same than chroot, but use isolated kernel namespace. This let you simulate network interfaces or other devices and some limitations around memory, cpu and other resources...

With this kind of light virtualisation, you could share directories in same manner than using chroot, by using mount --bind (or under openvz maybe using mount -t simfs could be usefull).

Strong virtualisation

Next you may use kvm, xen or other propretary virtalization software...

But from there, sharing directories implie some kind of (pseudo) network service...

| improve this answer | |
  • I think, after re-reading your question, the simpliest way is to use chroot. Maybe one copy in each user's homedir. You could use hardlinks for that: see cp -l. – F. Hauri Nov 30 '13 at 11:20
  • Thank you, F.Hauri! I was trying to do it before, but on Fedora it says: chroot: failed to run command ‘/bin/bash’: No such file or directory? – Ilia Rostovtsev Nov 30 '13 at 12:18
  • You have to install a copy of /bin/bash in chrooted env, but you have copy used libraries too! Try the command ldd /bin/bash to see what's needed. – F. Hauri Nov 30 '13 at 12:50
  • I tried that! I create a directory /home/username/viber/chroot, then under it, I created bin,lib,home,var,etc. Inside of lib I put those files that were output on ldd and inside of bin I put bash? Not sure why it's not working? What about owner permissions? What about cmd? Is it chroot /home/username/viber/chroot? I still got that error? Do I run it as root? I did. What are permission settings should be on folders? – Ilia Rostovtsev Nov 30 '13 at 16:09
  • Be very careful not to run Viber as root (after chroot, you will be root unless you change user). Since Viber is a presumably a GUI application, it will also have access to all other visisble windows by default. For the "easiest" separation using virtualization software, I would personally use QEMU (KVM), but others like VirtualBox should work fine too. In other cases, I try to use AppArmor. – Lekensteyn Nov 30 '13 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.