Add an extra layer of security with systrace

Niels Provos' Systrace is a utility that monitors and controls what an application can access on a system by creating and enforcing access policies for system calls. For the Linux crowd, it's something like the US National Security Agency's SE Linux, but it's more flexible and, if used properly, it can improve a system's overall security by "sandboxing" untrusted applications and users.
Systrace is included by default in NetBSD and OpenBSD, and the project lists ports for Mac OS X, FreeBSD, and Linux on its home page -- though the Mac OS X port is not being maintained at the moment.
Systrace acts as a wrapper to the actual application. It intercepts the system calls made by the application, processes them through the kernel using the /dev/systrace device, and then handles the system calls according to your policies.
You can use Systrace to restrict a daemon's access to the system by defining which files it can access and how (such as read-only), and which port it can bind to. Also, if a daemon doesn't support privilege separation, you can avoid running it as root the whole time and keeping setuid and setgid binaries on the system. It's obvious how this can enhance the security of an untrusted daemon, or at least minimize the damage on a system if someone manages to exploit it.
-
- Login or register to post comments
Printer-friendly version
- 1396 reads
PDF version
More in Tux Machines
- Highlights
- Front Page
- Latest Headlines
- Archive
- Recent comments
- All-Time Popular Stories
- Hot Topics
- New Members
- August 2022 (455)
- July 2022 (1160)
- June 2022 (1211)
- May 2022 (1127)
- April 2022 (1130)
- March 2022 (1232)
- February 2022 (1022)
- January 2022 (1178)
- December 2021 (1206)
- November 2021 (1140)
- October 2021 (1117)
- September 2021 (1132)
- August 2021 (1125)
- July 2021 (1129)
- June 2021 (1088)
- May 2021 (1123)
- April 2021 (1180)
- March 2021 (1220)
- February 2021 (1136)
- January 2021 (1088)
- December 2020 (1091)
- November 2020 (1042)
- October 2020 (1161)
- September 2020 (1124)
- August 2020 (1064)
- July 2020 (1162)
- June 2020 (1104)
- May 2020 (1203)
- April 2020 (1211)
- March 2020 (1184)
Recent comments
1 day 11 hours ago
1 day 15 hours ago
1 day 15 hours ago
2 days 22 hours ago
2 days 23 hours ago
3 days 55 min ago
3 days 56 min ago
3 days 58 min ago
3 days 3 hours ago
3 days 4 hours ago