In this lesson, you will learn how to implement granular control over file system interactions by restricting specific operations like reading, writing, locking, and linking at the object level.
While standard Linux permissions (rwxrwxrwx) provide basic access control, they lack the specificity required for hardened security environments. When we talk about "Restricting File System Access Rights" in the context of advanced security hardening, we move beyond simple owner/group bits to define exactly what an application can do to a file, rather than just if it can access it.
Granular Permission Control
In a hardened environment—specifically when using Mandatory Access Control (MAC) systems like SELinux—we can dictate behavior at a micro-level. For example, an application might require read access to a configuration file, but it should never be permitted to write to it. Furthermore, we can prevent an application from linking or renameing files, which is a common technique used by attackers to replace legitimate binaries or configuration files with malicious ones.
Consider an AppArmor profile snippet designed to restrict an application’s interaction with a sensitive log file:
/var/log/app/secure.log r,
/var/log/app/data.db rwlk,
In this example:
rgrants only read access to the log file.rwlkgrants read, write, lock, and link access to the database file.
By specifying l (link) and k (lock), you ensure that the process can perform necessary maintenance on the database without being granted broad, unsafe permissions. If a process attempts to create a hard link to a file it doesn't have the l permission for, the kernel will block the system call immediately, even if the user running the process has write permissions on the directory.
This level of detail acts as a safety net. By limiting the scope of operations to only the bare minimum required for the application to function, you significantly reduce the "blast radius" of a potential compromise. If an attacker gains control of your process, they cannot manipulate the file system structure or lock critical system files, because those specific actions were never permitted in your policy.
Key Takeaway: Granular file restrictions allow you to define precise operations (read, write, lock, link) per file, ensuring that processes cannot perform unauthorized system-level manipulations even if they have standard filesystem access.