0

I am new to the domain of running Linux application in secure contexts, such as jails.

I am seeking to run a desktop environment, on a Linux system, that has essentially the same capabilities as such an environment running in a normal context, with respect to hardware access, such as to sound, graphics, and peripherals, but that has a filtered view of the file system, lacking write access to /tmp, /var/tmp, any part of /home or indeed any part of the filesystem not designated as accessible for writing. The directories normally accessible to applications would be mapped into specific locations that would be the only locations manipulated by applications running under the restricted context.

Put another way, changes made by applications running in such a context to the filesystem could appear as changed only within the context, but not outside, by virtue of a layered system. Thus, any trace of the environment could be removed easily, while leaving the rest of the system entirely intact.

Ideally, it would be possible to operate the desktop environment restrained to secure environment simultaneous to running the an instance of a desktop environment in the regular context.

What tools might be the ones I should investigate?

Improve this question
3
  • 1
    Getting a full desktop environment to work with jails or containers or whatever is going to be a major challenge. A Gnome session has so many interaction points with the filesystem (libraries, dbus, /dev and /proc interfaces) that it would take serious work to get this working properly. You might want to look into alternative design patterns like VDI: give the user "regular" access to the system, sandbox the system itself and then respawn a new desktop after the user is done.
    – mtak
    Commented Dec 8, 2021 at 10:57
  • @mtak: It is only file access that needs to be contained, in particular file writes, and only to real files. Locations such as /dev and /proc would seem not a concern, since they are not targets of persistent data in the system.
    – brainchild
    Commented Dec 9, 2021 at 3:10
  • I am wondering whether a viable path may lie in the combination of Firejail and Xephyr. Constructing a Firejail profile to fully contain all file writes, unfortunately, may not be straightforward.
    – brainchild
    Commented Dec 9, 2021 at 6:06

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .