You are not logged in.
The security advantages to providing each user with a subfilesystem in their home directory that is automatically chrooted'd into at login seems pretty good. Also, it would help prevent "junk" (stuff resulting from installations/ uninstallations, normal system operation, etc.) from building up in important system directories (most importantly, /etc). Are there any shortcomings to such a model?
Laptops:
MSI GS60 Ghost
Asus Zenbook Pro UX501VW
Lenovo Thinkpad X120e
Offline
It will probably waste some space + http://en.wikipedia.org/wiki/Chroot#Gra … _on_chroot
Offline
Well, yes, naturally, it IS after all a separate filesystem
But my real question is if it will cause any other detrimental effects, such as perhaps decreased performance, permissions errors, whatever?
Laptops:
MSI GS60 Ghost
Asus Zenbook Pro UX501VW
Lenovo Thinkpad X120e
Offline
Chroot isn't really a security feature, if you want to use it that way. Separate virtual machines seems like a more straightforward way to isolate users, or just letting them install software in their ~/bin .
Offline
When using separate virtual machines, the user shall still have access to the other applications in the host, which itself doesn't mean good security , right?
Offline
The user has access to other applications in the sense of being able to run them, you mean? But not in the sense that they can alter those applications or write to /etc, for example, right? Not unless you give them permissions...
If each user has a separate filesystem, do you then rely on each user to keep it up to date? Or do you then need some system to enforce that, as well as updating the main install? And each user will have to build any packages desired from AUR and keep those up to date, as well. And the applications run by users will all be installed as owned by them with their privileges, right? Seems like that would make it easier for an imposter to be installed masquerading as, say, ls. And then it depends on how far the chroot can be relied on...
Just trying to think it through... It sounds very complicated and I always think complicated is dangerous because it is that much harder for a human being to see the obvious...
CLI Paste | How To Ask Questions
Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L
Offline
> The security advantages to providing each user with a subfilesystem in their
> home directory that is automatically chrooted'd into at login seems pretty good.
Not really they can be breaken out of, look into LXC containers for a more advanced solution building
on top of old chroot solutions http://lxc.sourceforge.net
You need to install an RTFM interface.
Offline