How to restrict access to privileged users at the Linux kernel level?

Question

I found this answer on Linux Kernel Programming training , and my question is more specific to Linux kernel security features. I want to know how to restrict privileged users or to process access rights to other processes and files as opposed to full root access.

So far I have discovered:

• user and group for discrete access control (DAC) with differentiation of reading, writing and execution for the user, group and others
• root user for higher priority tasks
• setuid and setgid to expand the DAC and set the group / user ID of the calling process, for example. a user runs ping with root privileges to open Linux sockets.
• Opportunities for fine-grained rights, for example. remove suid ping bit and set cap_net_raw
• Management Groups ( Groups ) to restrict access to resources, i.e. processors, networks, io devices
• Namespace to separate process view from IPC, network, file system, pid
• Secure Computing ( Seccomp ) to restrict system calls
• Linux Security Modules ( LSMs ) to add additional security features such as Mandatory Access Control, for example. SELinux Type Enforcement

Full list? When writing a question, I found fanotify to monitor file system events, for example. for antivirus scans. There are probably more security features available.

Are there any other Linux security features that could be used programmatically from inside or outside the file or process to restrict privileged access? Perhaps there is a complete list.

Answer 1

The traditional unix way to limit a process that somehow needs more privileges and still contain it so that it cannot use more than it needs to “chroot” it.

chroot changes the apparent root of the process. If everything is done correctly, he can only access these resources inside this newly created chroot environment (for example, chroot jail) for example he can only access these files, but also those devices, etc.

To create a process that makes it readily relatively easy, rather than something unusual.

To create an environment in which an existing piece of software (such as a web server, mail server, ...) feels at home and still functions properly, is something that requires experience. The main thing is to find the minimum set of necessary resources (shared libraries, configuration files, devices, dependent services (for example, syslog), ...).

Answer 2

You can add EFS, AppArmor, Pit auditctl, ausearch, aureport Fanotify-like tools: Snort, ClamAV, OpenSSL, AIDE, nmap, GnuPG