Dear Jan, -- dr Tóth Attila, Radiológus Szakorvos jelölt, 06-20-825-8057, 06-30-5962-962 Attila Toth MD, Radiologist in Training, +36-20-825-8057, +36-30-5962-962
On Hét, November 24, 2008 21:03, Jan Klod wrote: > Well, the idea is: if program is started with userid N != 0, what are the > ways > it can access the information, it is supposed to be forbidden to access in > a > normal Linux configuration (other users info)? > As you might think, I am not really sure of what I need other than a way > to > forbid all the users access to other users files unless they are in a > group > and permissions allow it. You don't need more than regular Unix-style access-control to achieve this basically: every user must have its own group, and files should be created without world-access rights by default. It can be configured on any regular host. > Many wild things can happen, I just think, this might be a good place > where I > could ask. > > For example: I install mailserver or run samba on a server, where some > other > things are going on and I totally don't want them to interfare in any > possible way unless it has been intended. If you want to separate services, you can install them in their own chroot/jail environment or go for separate virtual machines. For the former method grsecurity provides advanced protection and for the latter strategy there are several possibilities for implementation. > > Hope, I made it clear enough... Hardened project offers toolchain-based additional hardening and several types of mandatory access control (MAC) techniques, which makes bypassing system security much harder. Most of us would vote on their favorite method(s) and argue against the other(s). You should dig yourself a bit deeper into SELinux/RSBAC/PaX/Grsecurity/PIE-SSP and choose your combination according to your taste. > > Jan > Regards, Dw.
