Enforcing Least Privilege in Linux

In this lesson, you will learn how to restrict a process’s reach by confining it to only the specific file system and network resources it needs to function.

The Principle of Least Privilege

Even if a service runs as a non-root user, it often has too much access. By default, a process can read any world-readable file and open network connections to any destination. Applying the principle of least privilege means shrinking the "attack surface" so that if a process is compromised, the damage is strictly limited.

Restricting Access via Systemd

The most straightforward way to implement this on modern Linux systems is through systemd service unit hardening. You can restrict the file system view and network capabilities of a service without needing complex Mandatory Access Control (MAC) policies.

Consider a simple service that only needs to read a specific configuration directory and log to a single file. You can enforce strict boundaries in the service unit file:

[Service]
# Only allow read-only access to specific paths
ProtectSystem=strict
ReadWritePaths=/var/log/my-service/
ReadOnlyPaths=/etc/my-service/

# Restrict network access
PrivateNetwork=true

# Prevent access to other users' home directories
ProtectHome=true

Why This Works

• ProtectSystem=strict: This mounts /usr, /boot, and /etc as read-only, preventing the process from modifying system binaries or configurations.
• ReadOnlyPaths: Explicitly permits the process to see only the configuration it requires.
• PrivateNetwork=true: This gives the process its own loopback network stack, effectively cutting off its access to the external network and the rest of the system's network interfaces.
• ProtectHome=true: Makes the /home, /root, and /run/user directories inaccessible, ensuring the process cannot snoop on user data.

By setting these directives, you create a "sandbox" around the process. If a vulnerability (like a remote code execution bug) is exploited, the attacker finds themselves trapped in a minimalist environment with no write access to system files and no path to reach the internet or other network services.

Key Takeaway: By using systemd hardening directives like ProtectSystem and PrivateNetwork, you can enforce the principle of least privilege at the process level, effectively neutralizing the lateral movement potential of a compromised service.