Find the answer to your Linux question:
Results 1 to 10 of 10
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1

    File system granularity levels


    Is there a way to give permission levels go beyond READ. WRITE and EXECUTE. for example, if i want to restrict copy certain files to usb drives, it is good to have such control to the file owner. As far as i know, such implementation is not there yet. But why it can't implement

  2. #2
    Linux Guru Segfault's Avatar
    Join Date
    Jun 2008
    Location
    Acadiana
    Posts
    2,185
    Not clear what you want to do, but have you studied xattr and ACL?

  3. #3
    Quote Originally Posted by Segfault View Post
    Not clear what you want to do, but have you studied xattr and ACL?

    Thanks for the reply. I have studied ACL, but not xattr. Definitely I'll look into this. One use case would be like this. Suppose I'm the owner of a file and I want to give my fellow employees to edit that file. But I don't want them to copy that file into USB drive or transfer file via SCP.
    My question is, can we modify linux file system to have extended permission levels like restricting copying and transferring. If it is not implemented such functions yet, why it is not done.

  4. $spacer_open
    $spacer_close
  5. #4
    Trusted Penguin Irithori's Avatar
    Join Date
    May 2009
    Location
    Munich
    Posts
    4,031
    No filesystem has such capabilities.

    You can disable the usb-storage kernel module.
    Then usb sticks and harddiscs wont work anymore.

    You probably dont want to do the same for eSata, as regular sata drives wont work then either.
    Also: What is stopping someone from taking the internal harddrive?

    If you can read a file, then there are countless methods of copying it.

    e.g: if the information is visual and fits onto a few screens, just photograph it with a smartphone.

    You wont need scp or any known file transfer program for copying over the net.
    netcat would do. Or bash, python, whatever.

    Then there are non obvious copy methods: Why not encode the bits into soundwaves, output it via speakers and then record that?

    tl;dr:
    You either trust your fellow employees -btw, are you trusted by them? - and possibly augment that by policy and access controll (If only Bob and Alice have access, then this limits the search criteria)
    or you can spend some money:
    a) A custom built, physically locked down machine, that starts only this one "edit program" in kiosk mode.
    Hopefully this edit program does not allow any shell execution or has network capabilities
    b) A custom room with no network and a workstation in it.
    The fellow employees will be searched on exit.
    I wouldnt work in such an environment.

    Addendum: I know that there are some sandbox tools for android, that allow you to basically vpn into a corporate network and then access mails, files, etc within that network.
    It is a design principle, that nothing leakes from that sandbox into android.
    But a) This is a pita to work with
    and b) Itīs bloody android. Of course one can hack it.
    Last edited by Irithori; 05-17-2017 at 08:54 PM.
    You must always face the curtain with a bow.

  6. #5
    Thnx @Irithori. That mentioned use case is just a hypothetical situation. But don't you think it's convenient to have such granularity, go beyond RWE permissions. So, the file owner can maintain (in high security systems) AC matrix by just specifying some parameters. And he has more control. (user/operation/restrictions etc)

  7. #6
    Trusted Penguin Irithori's Avatar
    Join Date
    May 2009
    Location
    Munich
    Posts
    4,031
    Again, this is not up to a filesystem.
    Because a filesystem is only concerned to save the permissions of its own files.
    Which is then used by the OS to determine access.

    A given filesystem cannot and should not be concerned with permissions outside of its scope.

    You would need to design a sandbox system with physical limitations (ie: no usb ports, locked case) and some custom software.
    Not impossible, but also custom and harder to maintain than a standard system.
    You must always face the curtain with a bow.

  8. #7
    What if we modified file system itself to have kind of a meta header for each file that defines the AC matrix. And then kind of a interceptor module to check against that header before performing the operation.

  9. #8
    Trusted Penguin Irithori's Avatar
    Join Date
    May 2009
    Location
    Munich
    Posts
    4,031
    There are dozens of filesystems.

    But ok, itīs open source. Change it to your liking:
    https://git.kernel.org/pub/scm/linux...g/?h=v4.12-rc1
    You must always face the curtain with a bow.

  10. #9
    I have a similar question. Is there a way to lock down shared network folders so they cannot be moved or renamed while allowing all of the users to view, copy, edit, add files inside the directory? I have a huge problem in my shop where everyone needs to drop files into folders, pull files from folders, edit files, and save them to the folders. However, having this capability, the parent shared folder can also be renamed, or moved, which has been causing massive problems all over the company. When Joe Schmoe on his iMac can basically rename the main directory, suddenly, no one knows where the files are. Happened twice this week.

  11. #10
    Linux Guru Rubberman's Avatar
    Join Date
    Apr 2009
    Location
    I can be found either 40 miles west of Chicago, in Chicago, or in a galaxy far, far away.
    Posts
    14,038
    -->
    If they don't have root access (hopefully they don't) then make the directories owned by root.
    Sometimes, real fast is almost as good as real time.
    Just remember, Semper Gumbi - always be flexible!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •