In this lesson, you will learn how to anticipate attacker pathways to design robust access policies that neutralize privilege escalation and lateral movement.
When we model threat vectors, we shift our focus from "who has access to what" to "how could an attacker misuse current permissions to reach a higher state of privilege." In Linux, threats rarely stem from a single misconfiguration; they are usually a chain of events.
Mapping the Escalation Path
Privilege escalation often occurs when a low-privileged user gains the ability to modify a file or execute a binary that a higher-privileged process (like root) depends on. If you grant a user write access to a directory that contains a script executed by a systemd service, you have created a primary vector for escalation.
Similarly, lateral movement occurs when an attacker uses compromised credentials or a weak access policy to hop between services or containers sharing the same filesystem or namespace.
Designing Defensive Policies
To protect against these vectors, apply the Principle of Least Privilege combined with Mandatory Access Control (MAC) layers:
- Restrict Write Access: Never allow general users to write to configuration directories or binary paths, even if they "need" to update one file. Use specific ACLs to grant access only to the exact file required.
- Isolate Execution: Use
chrootor namespaces to ensure that if a process is compromised, the attacker is "trapped" in a sandbox with no access to the broader system. - Harden via SELinux/AppArmor: Since discretionary access (UGO/ACLs) can be bypassed if the owner is compromised, use SELinux to enforce that a process can only interact with specific files, regardless of what the file's
rwxpermissions state.
Consider this scenario: if a web service user needs to write logs, do not give them write access to the /var/log directory. Instead, use an ACL to grant them access only to the specific log file:
# Instead of chmod 777, grant specific ACLs
setfacl -m u:www-data:rw /var/log/app/service.log
By limiting the "blast radius" of every user and service, you ensure that an attacker who compromises one entry point finds themselves stuck in a restricted, immutable environment, unable to move laterally or elevate their status.
Key Takeaway: Effective access policies aren't just about granting permission; they are about architecting restrictions that break the attacker's chain of escalation and movement.