Separate user account for browser, chat, etc. Worth it?

Gullible Jones · 06-04-2014, 09:13 AM

Mandatory access control is a pain to set up, and not standardized across Linux distributions. But (ab)using ACLs and UNIX discretionary access controls to run programs under secondary accounts is easy, and safe enough on desktops (though not really suitable for multiuser systems).

My question is, how useful is it really?

X11 provides no GUI isolation. (Well, unless you use Xephyr or something, and that breaks copy/paste support.) A compromised browser or chat session can be barred filesystem access to your home directory, preventing it from snooping on your emails or grabbing your SSH keys, or stuff like that; but it can still keystrokes going into any X11 program. It's even possible to take control of an application via X11, from another application in the same X session (though IIRC this would be obvious to the user).

Is filesystem isolation based on separate user accounts actually worth anything, or is it just too easily circumvented on desktops to be of any use?

linosaurusroot · 06-04-2014, 09:43 AM

Mandatory access with Apparmor is not a pain ... I have been using it and the predecessor (Subdomain) since 2001. I recommend it for browsers and other exposed programs. It comes with Suse and Ubuntu.

Another approach is qubes ( http://qubes-os.org/trac ).

Isolation of user accounts on a desktop probably suffers from these issues (in decreasing order as guessed unscientifically by me)

- X11 bugs http://www.phoronix.com/scan.php?pag...tem&px=MTU1NzA
- kernel bugs
- userspace bugs (other than X11)
- misconfiguration (place this higher if badly managed)

Gullible Jones · 06-04-2014, 11:37 AM

Hmm, thanks. Just curious though, wouldn't AppArmor also suffer from X11 related and at least some kernel issues?

Userspace bugs might be possible to mitigate with a very minimal chroot sandbox, but that would be a pain.

Qubes would be interesting to try, unfortunately I don't have any suitable hardware available. Also, to be honest, I've only ever seen bad things and breakage from Xen.

Shadow_7 · 06-04-2014, 11:39 AM

I use multiple users in X. Although I do it to isolate browser cache, game cache, and useful programming stuff into seperate /home/ locations. If I run low on drive space it's pretty easy to nuke an entertainment user to free up that space. I just need to copy the .Xauthority of the user who started X and set the DISPLAY and XAUTHORITY variables for each user after logging in. The variables can be set in the .bashrc.

It's not really that useful for security except for isolating your web browser from important data since cross user file contents cannot be read. But it's useful for space management and keeping task specific bash histories based on the user(s) for a given task. Of course all of this assumes that you're a heavy CLI type and have root access to copy the .Xauthority across users.

linosaurusroot · 06-04-2014, 11:44 AM

Quote:

Originally Posted by Shadow_7

root access to copy the .Xauthority across users.

Or have access to both accounts and do

Code:

xauth list
xauth add ...paste-here...

linosaurusroot · 06-04-2014, 11:45 AM

Quote:

Originally Posted by Gullible Jones

Hmm, thanks. Just curious though, wouldn't AppArmor also suffer from X11 related and at least some kernel issues?

... bad things and breakage from Xen.

You can Apparmor the Xorg too. I've found Xen ok - perhaps it was long ago you tried it.

Gullible Jones · 06-04-2014, 04:30 PM

AppArmor Xorg? Doesn't Xorg have to run with full root privileges, or has that changed recently thanks to KMS?

Re xauth, is there any reason I shouldn't use e.g.

Code:

xhost +si:local:my_secondary_account

which would supposedly only allow connections from that account?

linosaurusroot · 06-06-2014, 01:53 AM

Quote:

Originally Posted by Gullible Jones

AppArmor Xorg? Doesn't Xorg have to run with full root privileges,

Xorg is setuid root but also confined by Apparmor. Here's what I'm using although I don't know how useful it is in practice.

Code:

# Last Modified: Sun Mar 30 19:50:29 2014                                                                                              
#include <tunables/global>                                                                                                             
                                                                                                                                                  
/usr/bin/Xorg {                                                                                                                                               
  #include <abstractions/base>                                                                                                                                
  #include <abstractions/kde>                                                                                                                                               
                                                                                                                                                                            
                                                                                                                                                                            
  capability ipc_owner,                                                                                                                                                     
  capability setgid,                                                                                                                                                                          
  capability setuid,                                                                                                                                                                          
  capability sys_admin,                                                                                                                                                                       
  capability sys_rawio,                                                                                                                                                                       
                                                                                                                                                                                              
                                                                                                                                                                                              
  deny /bin/bash x,                                                                                                                                                                           
                                                                                                                                                                                                                   
  /dev/fb0 rw,                                                                                                                                                                                                     
  /dev/tty0 w,                                                                                                                                                                                                                               
  /dev/tty2 rw,                                                                                                                                                                                                                              
  /dev/vga_arbiter rw,                                                                                                                                                                                                                       
  /etc/X11/xorg.conf.d/ r,                                                                                                                                                                                                                   
  /etc/X11/xorg.conf.d/* r,                                                                                                                                                                                                                  
  /etc/udev/udev.conf r,                                                                                                                                                                                                                     
  /proc/*/cmdline r,                                                                                                                                                                                                                         
  /proc/cmdline r,                                                                                                                                                                                                                           
  /proc/mtrr w,                                                                                                                                                                                                                              
  /sys/bus/ r,                                                                                                                                                                                                                               
  /sys/bus/pci/devices/ r,                                                                                                                                                                                                                   
  /sys/class/ r,
  /sys/class/drm/ r,
  /sys/devices/** r,
  /usr/bin/Xorg mr,
  /usr/lib64/xorg/modules/drivers/ati_drv.so mr,
  /usr/lib64/xorg/modules/drivers/fbdev_drv.so mr,
  /usr/lib64/xorg/modules/drivers/modesetting_drv.so mr,
  /usr/lib64/xorg/modules/drivers/radeon_drv.so mr,
  /usr/lib64/xorg/modules/drivers/vesa_drv.so mr,
  /var/log/Xorg.0.log rw,
  /var/log/Xorg.0.log.old w,

}

sundialsvcs · 06-06-2014, 07:16 AM

I use multiple accounts all the time. For example, all work for a particular (human) client will be done in a separate account. Responsibilities such as accounting or what-not are done in separate accounts. And, in many cases, the associated directories are not-at-all readable by others.

To me, it's the same common-sense that says, "give different people in your office different cubicles or offices." The presence of an ordinary, even-flimsy lock on a door, or of a safety on a gun, is often all that's needed to avoid real trouble.

agentsteel · 06-07-2014, 07:49 AM

One solution would be to use a browser/chat/etc... virtual machine, isolated from the rest of your network.