corpus.blog
41,554 blogs · 5,197,919 posts Claim your blog
Record · corpus.blog/posts/01a08c5c-3134-73b0-b1a5-54dacb5ddde8

A Compendium of Access Control on Unix-Like OSes

Venam's Blog — Patrick Louis (Lebanon) · published 27 February 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at venam.net Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
551
Words captured
74,705

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://csrc.nist.gov/glossary/term/access_control
csrc.nist.gov
https://people.cs.rutgers.edu/~pxk/419/notes/access.html
people.cs.rutgers.edu
https://www.pearsonitcertification.com/articles/article.aspx?p=1998558&seqNum=4
pearsonitcertification.com
https://github.com/wertarbyte/coreutils/blob/master/src/setuidgid.c
github.com
https://www.errno.fr/TTYPushback.html
errno.fr
https://en.wikipedia.org/wiki/Extended_Backus%E2%80%93Naur_form
en.wikipedia.org
https://www.cedarpolicy.com/en/tutorial/abac-pt1
cedarpolicy.com
https://rofi.roger-ferrer.org/eiciel/
rofi.roger-ferrer.org
https://blog.ploetzli.ch/2014/understanding-linux-capabilities/
blog.ploetzli.ch
https://gist.github.com/k3a/a38f4439f85eda4f77eda19c4ae8c80c
gist.github.com
https://sites.google.com/site/fullycapable/captree
sites.google.com
https://sites.google.com/site/fullycapable/su-without-root
sites.google.com
https://manpages.debian.org/testing/libpam-cap/capability.conf.5.en.html
manpages.debian.org
https://queue.acm.org/detail.cfm?id=2430732
queue.acm.org
https://github.com/SELinuxProject/refpolicy
github.com
http://oss.tresys.com/docs/refpolicy/api/index.html
oss.tresys.com
https://raw.githubusercontent.com/SELinuxProject/selinux-notebook/main/src/notebook-examples/selinux-policy/cil/CIL_Reference_Guide.pdf
raw.githubusercontent.com
http://oss.tresys.com/docs/refpolicy/api/kernel_filesystem.html
oss.tresys.com
http://oss.tresys.com/docs/refpolicy/api/booleans.html
oss.tresys.com
Restricting even root access to a folder Read at the source ↗
blog.siphos.be
https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference
gitlab.com
https://web.archive.org/web/20170910103143/http://alum.wpi.edu/~tfraser/Software/LOMAC
web.archive.org
https://zeromac.uk/
zeromac.uk
http://tomoyo.osdn.jp/2.6/chapter-5.html.en
tomoyo.osdn.jp
https://www.rsbac.org/documentation/rsbac_handbook/architecture_implementation/framework_components
rsbac.org
https://kasten-edv.de/download/rsbac/manpages/attr_set_fd.html
kasten-edv.de
https://www.rsbac.org/documentation/rsbac_handbook/appendixes/rsbac_reference/kernel_parameters
rsbac.org
https://www.rsbac.org/documentation/rsbac_handbook/configuration_basics/setting_up_modules/cap
rsbac.org
https://github.com/apple-oss-distributions/xnu/tree/main/security
github.com
https://source.android.com/docs/security/features/selinux
source.android.com
https://cvsweb.openbsd.org/src/sys/ufs/ufs/Attic/extattr.h
cvsweb.openbsd.org
https://lwn.net/Articles/721848/
lwn.net
https://github.com/minipli/linux-unofficial_grsec/
github.com
https://en.wikibooks.org/wiki/Grsecurity/Appendix/Role_Modes
en.wikibooks.org
https://en.wikibooks.org/wiki/Grsecurity/Appendix/Subject_Modes
en.wikibooks.org
https://en.wikibooks.org/wiki/Grsecurity/Appendix/Object_Modes
en.wikibooks.org
https://en.wikibooks.org/wiki/Grsecurity/Appendix/Capability_Names_and_Descriptions
en.wikibooks.org
https://en.wikibooks.org/wiki/Grsecurity/Appendix/System_Resources
en.wikibooks.org
https://tutorial.ponylang.io/object-capabilities/object-capabilities.html
tutorial.ponylang.io
https://docs.hhvm.com/hack/contexts-and-capabilities/introduction
docs.hhvm.com
https://github.com/bytecodealliance/wasmtime/blob/main/docs/WASI-capabilities.md
github.com
https://github.com/dckc/awesome-ocap
github.com
https://capnproto.org/
capnproto.org
https://sandstorm.io/
sandstorm.io
https://www.cheribsd.org/
cheribsd.org
https://github.com/valpackett/capsicumizer
github.com
https://opencontainers.org/
opencontainers.org
https://www.openbsd.org/innovations.html
openbsd.org
https://stackoverflow.com/questions/52665377/project-quotas-in-ext4
stackoverflow.com
https://daemonforums.org/showthread.php?t=9795
daemonforums.org
http://www.citi.umich.edu/u/provos/systrace/
citi.umich.edu
https://web.archive.org/web/20051221181747/http://blafasel.org/~floh/he/
web.archive.org
http://cvsweb.openbsd.org/src/usr.bin/file/Attic/sandbox.c
cvsweb.openbsd.org
https://justine.lol/pledge/
justine.lol
https://man.openbsd.org/pledge
man.openbsd.org
https://man.freebsd.org/cgi/man.cgi?query=nullfs&sektion=5
man.freebsd.org
https://bastillebsd.org/
bastillebsd.org
https://ebpf.io/
ebpf.io
https://pypi.org/project/landlock/
pypi.org
https://github.com/landlock-lsm/rust-landlock
github.com
https://github.com/landlock-lsm/go-landlock
github.com
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/samples/landlock/sandboxer.c
git.kernel.org
https://github.com/Zouuup/landrun
github.com
https://github.com/netblue30/firejail?tab=readme-ov-file
github.com
https://man.exherbolinux.org/sydtutorial.7.html˚
man.exherbolinux.org
https://wiki.gnoack.org/SoftwareUsingLandlock
wiki.gnoack.org
https://github.com/seccomp/libseccomp
github.com
https://github.com/giuseppe/easyseccomp
github.com
https://google.github.io/kafel/
google.github.io
https://github.com/cri-o/cri-o
github.com
https://github.com/rkt/rkt
github.com
https://github.com/opencontainers/runc
github.com
https://podman.io/
podman.io
https://linuxcontainers.org/lxc/introduction/
linuxcontainers.org
https://www.docker.com/
docker.com
https://github.com/refi64/nsbox
github.com
https://github.com/lopukhov/unbox
github.com
https://github.com/ahayzen/folderbox
github.com
https://github.com/89luca89/distrobox
github.com
https://github.com/containers/oci-seccomp-bpf-hook
github.com
https://proot-me.github.io/
proot-me.github.io
https://github.com/ruanformigoni/arts
github.com
https://gvisor.dev/
gvisor.dev
https://github.com/containers/bubblewrap
github.com
https://flatpak.org/
flatpak.org
https://firejail.wordpress.com/
firejail.wordpress.com
https://google.github.io/minijail/
google.github.io
https://google.github.io/minijail/minijail0.5
google.github.io
https://nsjail.dev/
nsjail.dev
https://stemjail.github.io/
stemjail.github.io
https://developer.apple.com/documentation/xcode/configuring-the-macos-app-sandbox
developer.apple.com
https://reverse.put.as/wp-content/uploads/2011/09/Apple-Sandbox-Guide-v1.0.pdf
reverse.put.as
https://developer.android.com/guide/topics/manifest/manifest-intro
developer.android.com
https://developer.android.com/guide/components/intents-filters
developer.android.com
https://developer.android.com/guide/topics/manifest/service-element
developer.android.com
https://www.qubes-os.org/
qubes-os.org
https://katacontainers.io/
katacontainers.io
https://firecracker-microvm.github.io/
firecracker-microvm.github.io
https://github.com/ostreedev/ostree
github.com
https://github.com/castrojo/awesome-immutable
github.com
https://vanillaos.org/
vanillaos.org
https://silverblue.fedoraproject.org/
silverblue.fedoraproject.org
https://endlessos.com/home/
endlessos.com
https://rlxos.dev/
rlxos.dev
https://github.com/ashos/ashos
github.com
https://reproducible-builds.org/
reproducible-builds.org
NixOS Read at the source ↗
nixos.org
https://guix.gnu.org/
guix.gnu.org
https://www.freedesktop.org/software/polkit/docs/latest/ref-api.html
freedesktop.org
https://www.freedesktop.org/software/polkit/docs/latest/ref-dbus-api.html
freedesktop.org
https://cgit.freedesktop.org/polkit/tree/src/examples/polkit-raw-dbus.py
cgit.freedesktop.org
https://www.freedesktop.org/software/polkit/docs/latest/eggdbus-interface-org.freedesktop.PolicyKit1.AuthenticationAgent.html
freedesktop.org
https://cgit.freedesktop.org/polkit/tree/src/polkitbackend/polkitbackendinteractiveauthority.c
cgit.freedesktop.org
https://cgit.freedesktop.org/polkit/tree/src/polkitbackend/50-default.rules
cgit.freedesktop.org
https://github.com/papajoker/pkcreate/blob/master/pkcreate
github.com
https://developer.android.com/guide/topics/permissions/overview
developer.android.com
https://developer.android.com/guide/topics/manifest/intent-filter-element
developer.android.com
https://link.springer.com/chapter/10.1007/978-3-319-45744-4_19
link.springer.com
https://developer.apple.com/library/archive/documentation/General/Conceptual/ExtensibilityPG/index.html
developer.apple.com
https://www.rfc-editor.org/rfc/rfc5424
rfc-editor.org
https://github.com/USBGuard/usbguard
github.com
https://en.wikipedia.org/wiki/Mandatory_Integrity_Control
en.wikipedia.org
https://en.wikipedia.org/wiki/Multi_categories_security
en.wikipedia.org
https://en.wikipedia.org/wiki/Type_enforcement
en.wikipedia.org
https://en.wikipedia.org/wiki/Controlled_Access_Protection_Profile
en.wikipedia.org
https://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria
en.wikipedia.org
https://en.wikipedia.org/wiki/Trusted_system
en.wikipedia.org
https://en.wikipedia.org/wiki/Trusted_Computing
en.wikipedia.org
https://en.wikipedia.org/wiki/Common_Criteria
en.wikipedia.org
https://en.wikipedia.org/wiki/NIST_RBAC_model
en.wikipedia.org
https://en.wikipedia.org/wiki/Multilevel_security
en.wikipedia.org
https://en.wikipedia.org/wiki/HRU_(security
en.wikipedia.org
https://www.cs.uic.edu/~jbell/CourseNotes/OperatingSystems/14_Protection.html
cs.uic.edu
https://en.wikipedia.org/wiki/Access_control_matrix
en.wikipedia.org
https://en.wikipedia.org/wiki/Bell%E2%80%93LaPadula_model
en.wikipedia.org
https://en.wikipedia.org/wiki/Biba_Model
en.wikipedia.org
https://en.wikipedia.org/wiki/Clark%E2%80%93Wilson_model
en.wikipedia.org
https://en.wikipedia.org/wiki/Graham%E2%80%93Denning_model
en.wikipedia.org
https://en.wikipedia.org/wiki/Evaluation_Assurance_Level
en.wikipedia.org
https://www.freeipa.org/page/Main_Page
freeipa.org
https://en.wikipedia.org/wiki/Apache_Fortress
en.wikipedia.org
https://man.openbsd.org/pwd_mkdb.8
man.openbsd.org
https://www.freebsd.org/cgi/man.cgi?query=login.conf&sektion=5&format=html
freebsd.org
https://www.unix.com/man-page/FreeBSD/8/pwd_mkdb/
unix.com
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/introduction
access.redhat.com
https://man.openbsd.org/auth_subr.3
man.openbsd.org
https://en.wikipedia.org/wiki/BSD_Authentication
en.wikipedia.org
https://www.freebsd.org/cgi/man.cgi?query=cap_mkdb&sektion=1&apropos=0&manpath=FreeBSD+13.1-RELEASE+and+Ports
freebsd.org
https://linux.die.net/man/8/pam_access
linux.die.net
https://linux.die.net/man/8/pam_limits
linux.die.net
https://www.ibm.com/docs/en/ssw_aix_73/pdf/security_pdf.pdf
ibm.com
https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol
en.wikipedia.org
https://en.wikipedia.org/wiki/Identity_management
en.wikipedia.org
https://www.rsbac.org/documentation/rsbac_handbook/security_models
rsbac.org
https://www.rsbac.org/documentation/rsbac_handbook/security_models/rc
rsbac.org
https://www.rsbac.org/documentation/rsbac_handbook/security_models/cap
rsbac.org
https://www.rsbac.org/documentation/rsbac_handbook/security_models/auth
rsbac.org
https://www.rsbac.org/documentation/rsbac_handbook/security_models/jail
rsbac.org
https://www.rsbac.org/documentation/rsbac_handbook/security_models/mac
rsbac.org
https://www.rsbac.org/documentation/rsbac_handbook/security_models/acl
rsbac.org
https://www.rsbac.org/documentation/rsbac_handbook/user_management
rsbac.org
https://www.rsbac.org/documentation/why_rsbac_does_not_use_lsm
rsbac.org
https://github.com/minipli/linux-unofficial_grsec
github.com
https://wiki.gentoo.org/wiki/Hardened/Grsecurity2_Quickstart
wiki.gentoo.org
https://en.wikibooks.org/wiki/Grsecurity/The_RBAC_System
en.wikibooks.org
https://docs.oracle.com/cd/E37838_01/html/E61023/rbac-1.html
docs.oracle.com
https://docs.oracle.com/cd/E37838_01/html/E61023/rbactask-21.html
docs.oracle.com
https://docs.oracle.com/cd/E37838_01/html/E61029/txconf-14.html
docs.oracle.com
http://www.polarhome.com/service/man/?qf=privileges&af=0&sf=0&of=OpenIndiana&tf=2
polarhome.com
https://sites.google.com/site/fullycapable/pam_cap-so?pli=1
sites.google.com
https://git.hardenedbsd.org/shawn.webb/articles/-/blob/master/hardenedbsd/2023-01_decade/article.md
git.hardenedbsd.org
https://www.samba.org/samba/docs/current/man-html/vfs_acl_xattr.8.html
samba.org
https://www.cis.rit.edu/class/simg211/unixintro/Access_Permissions.html
cis.rit.edu
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security-enhanced_linux/chap-security-enhanced_linux-selinux_contexts
access.redhat.com
https://wiki.gentoo.org/wiki/SELinux/Quick_introduction
wiki.gentoo.org
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/identity_management_guide/selinux-mapping
access.redhat.com
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security-enhanced_linux/mls
access.redhat.com
https://wiki.archlinux.org/title/File_permissions_and_attributes
wiki.archlinux.org
https://en.wikipedia.org/wiki/Security-Enhanced_Linux
en.wikipedia.org
https://en.wikipedia.org/wiki/Confused_deputy_problem
en.wikipedia.org
http://wt.tuxomania.net/topics/1999_06_Posix_1e/download.html
wt.tuxomania.net
http://wt.tuxomania.net/topics/1999_06_Posix_1e/download/Posix_1003.1e-990310.pdf
wt.tuxomania.net
https://www.usenix.org/legacy/publications/library/proceedings/usenix03/tech/freenix03/full_papers/gruenbacher/gruenbacher_html/main.html
usenix.org
https://docs.freebsd.org/en_US.ISO8859-1/books/handbook/fs-acl.html
docs.freebsd.org
http://wt.tuxomania.net/topics/1999_06_Posix_1e/
wt.tuxomania.net
https://www.gsp.com/cgi-bin/man.cgi?section=4&topic=mac
gsp.com
https://www.gsp.com/cgi-bin/man.cgi?section=4&topic=mac_seeotheruids
gsp.com
https://www.gsp.com/cgi-bin/man.cgi?section=4&topic=mac_partition
gsp.com
https://www.gsp.com/cgi-bin/man.cgi?section=4&topic=mac_ifoff
gsp.com
https://www.gsp.com/cgi-bin/man.cgi?section=4&topic=mac_none
gsp.com
https://www.gsp.com/cgi-bin/man.cgi?section=4&topic=mac_portacl
gsp.com
https://www.gsp.com/cgi-bin/man.cgi?section=4&topic=mac_lomac
gsp.com
https://www.gsp.com/cgi-bin/man.cgi?section=4&topic=mac_biba
gsp.com
https://www.gsp.com/cgi-bin/man.cgi?section=4&topic=mac_mls
gsp.com
https://en.wikipedia.org/wiki/Security_modes
en.wikipedia.org
https://en.wikipedia.org/wiki/Capability-based_security
en.wikipedia.org
https://en.wikipedia.org/wiki/Capsicum_(Unix
en.wikipedia.org
https://www.freebsd.org/cgi/man.cgi?query=capsicum&sektion=4
freebsd.org
https://en.wikipedia.org/wiki/Context-based_access_control
en.wikipedia.org
https://en.wikipedia.org/wiki/Organisation-based_access_control
en.wikipedia.org
https://en.wikipedia.org/wiki/Attribute-based_access_control
en.wikipedia.org
https://en.wikipedia.org/wiki/Relationship-based_access_control
en.wikipedia.org
https://en.wikipedia.org/wiki/Extended_file_attributes
en.wikipedia.org
https://en.wikipedia.org/wiki/Discretionary_access_control
en.wikipedia.org
https://en.wikipedia.org/wiki/Access-control_list
en.wikipedia.org
https://en.wikipedia.org/wiki/Mandatory_access_control
en.wikipedia.org
https://en.wikipedia.org/wiki/Linux_Security_Modules
en.wikipedia.org
https://www.usenix.org/legacy/event/sec02/full_papers/wright/wright.pdf
usenix.org
https://kernelnewbies.org/Documents/Kernel-Docbooks?action=AttachFile&do=get&target=lsm_2.6.29.pdf
kernelnewbies.org
https://marc.info/?l=linux-kernel&m=98695004126478&w=2
marc.info
https://landlock.io/talks/2019-09-12_landlock-summary.pdf
landlock.io
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/s2-proc-execdomains
access.redhat.com
https://marc.info/?l=openbsd-cvs&m=146161167911029&w=2
marc.info
https://marc.info/?l=openbsd-cvs&m=146161509612179&w=2
marc.info
https://lobste.rs/s/ftkfnu/secure_containerized_browser
lobste.rs
https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt
kernel.org
https://www.kernel.org/doc/html/latest/userspace-api/seccomp_filter.html
kernel.org
http://man.openbsd.org/sysctl.2
man.openbsd.org
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/managing_file_systems/assembly_limiting-storage-space-usage-on-ext4-with-quotas_managing-file-systems
access.redhat.com
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/resource_management_guide/sec-cgsnapshot
access.redhat.com
http://man.cat-v.org/plan_9/4/namespace
man.cat-v.org
https://illumos.org/man/7/resource_controls
illumos.org
https://papers.put.as/papers/macosx/2016/sandbox_defcon.pdf
papers.put.as
https://papers.put.as/papers/macosx/2020/Adventures_on_hunting_for_Safari_Sandbox_Escapes.pdf
papers.put.as
https://isopenbsdsecu.re/mitigations/privsec_privdrop/
isopenbsdsecu.re
https://en.wikipedia.org/wiki/Privilege_separation
en.wikipedia.org
https://docs.oracle.com/cd/E88353_01/html/E72487/pfedit-8.html
docs.oracle.com
https://linuxhint.com/auditd_linux_tutorial/
linuxhint.com
https://isopenbsdsecu.re/mitigations/secure_levels/
isopenbsdsecu.re
https://forensicswiki.xyz/wiki/index.php?title=Basic_Security_Module_(BSM
forensicswiki.xyz
https://www.illumos.org/man/7/audit_binfile
illumos.org
https://en.wikipedia.org/wiki/Trusted_computing_base
en.wikipedia.org
https://en.wikipedia.org/wiki/Project_Verona
en.wikipedia.org
https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf
help.apple.com
https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup
en.wikipedia.org
https://isopenbsdsecu.re/mitigations/secure_boot/
isopenbsdsecu.re
https://owasp.org/www-community/Threat_Modeling
owasp.org
https://archive.fosdem.org/2020/schedule/event/security_threat_modelling_for_developers/attachments/slides/4150/export/events/attachments/security_threat_modelling_for_developers/slides/4150/Threat_modelling_for_developers.pdf
archive.fosdem.org
https://man7.org/linux/man-pages/man7/kernel_lockdown.7.html
man7.org
https://en.wikipedia.org/wiki/STRIDE_(security
en.wikipedia.org
http://ftp.ntu.edu.tw/pub/linux/libs/security/Orange-Linux/refs/Orange.html
ftp.ntu.edu.tw
https://www.redhat.com/en/blog/common-criteria
redhat.com
https://www.commoncriteriaportal.org/files/ppfiles/capp.pdf
commoncriteriaportal.org
https://www.redhat.com/en/about/press-releases/red-hat-adds-common-criteria-certification-red-hat-enterprise-linux-8
redhat.com
https://www.geeksforgeeks.org/introduction-to-classic-security-models/
geeksforgeeks.org
https://security.stackexchange.com/questions/189341/whats-the-difference-between-graham-denning-model-and-harrison-ruzzo-ullman
security.stackexchange.com
https://en.wikipedia.org/wiki/LOMAC
en.wikipedia.org
https://pncnmnp.github.io/blogs/rbac-storage-system.html
pncnmnp.github.io
https://sssd.io/
sssd.io
https://opentitan.org/
opentitan.org
https://wiki.archlinux.org/title/Doas
wiki.archlinux.org
https://trousers.sourceforge.net/
trousers.sourceforge.net
https://en.wikipedia.org/wiki/Superuser
en.wikipedia.org
http://cr.yp.to/daemontools/setuidgid.html
cr.yp.to
http://www.linfo.org/root.html
linfo.org
https://man.openbsd.org/OpenBSD-6.4/doas.conf.5
man.openbsd.org
https://man.openbsd.org/vipw.8
man.openbsd.org
How BSD Authentication Works Read at the source ↗
blog.lambda.cx
https://www.linux.com/news/authentication-methods-openbsd/
linux.com
https://man.openbsd.org/OpenBSD-5.9/login.conf.5
man.openbsd.org
https://man.openbsd.org/authenticate.3
man.openbsd.org
https://man.openbsd.org/OpenBSD-5.9/getcap.3
man.openbsd.org
https://illumos.org/man/3PAM/pam
illumos.org
https://www.linux.com/news/understanding-pam/
linux.com
http://www.slackware.com/~vbatts/pam/
slackware.com
https://linux.die.net/man/8/pam
linux.die.net
https://github.com/nuvious/pam-duress
github.com
https://linux.die.net/man/5/access.conf
linux.die.net
https://www.linux-pam.org
linux-pam.org
http://www.netbsd.org/docs/guide/en/chap-pam.html
netbsd.org
https://www.dtucker.net/pam/
dtucker.net
https://developer.ibm.com/tutorials/l-pam/
developer.ibm.com
https://pubs.opengroup.org/onlinepubs/008329799/toc.pdf
pubs.opengroup.org
https://wiki.archlinux.org/title/PAM
wiki.archlinux.org
https://pam-list.redhat.narkive.com/L5LkNbU0/linux-pam-and-openpam-diffs
pam-list.redhat.narkive.com
https://git.des.dev/openpam/openpam/wiki
git.des.dev
https://pubs.opengroup.org/onlinepubs/8329799/toc.pdf
pubs.opengroup.org
https://en.wikipedia.org/wiki/OAuth
en.wikipedia.org
https://superuser.com/questions/962683/in-linux-what-is-etc-security
superuser.com
Should we use "sudo" for day-to-day activities? Read at the source ↗
dmitry.khlebnikov.net
https://i-bsd.com/doas/
i-bsd.com
https://wiki.archlinux.org/title/Security
wiki.archlinux.org
https://en.wikipedia.org/wiki/Authentication
en.wikipedia.org
https://linux.die.net/man/5/passwd
linux.die.net
https://linux.die.net/man/5/group
linux.die.net
https://9fans.github.io/plan9port/man/man3/auth.html
9fans.github.io
https://9fans.github.io/plan9port/man/man4/factotum.html
9fans.github.io
https://9p.io/sys/doc/auth.html
9p.io
https://www.infoq.com/news/2023/02/aws-policy-language-cedar/
infoq.com
https://www.cedarpolicy.com/en
cedarpolicy.com
Cedar: A new policy language Read at the source ↗
onecloudplease.com
https://docs.osohq.com/guides/enforcement.html
docs.osohq.com
https://www.openpolicyagent.org/
openpolicyagent.org
https://zanzibar.academy
zanzibar.academy
https://www.rsbac.org/doc/media/rc-nordsec2002/index.html
rsbac.org
https://www.rsbac.org/documentation
rsbac.org
https://www.rsbac.org/doc/media/rsbac-framework.pdf
rsbac.org
https://wiki.gentoo.org/wiki/Project:RSBAC
wiki.gentoo.org
https://wiki.gentoo.org/wiki/Project:RSBAC/Introduction
wiki.gentoo.org
https://wiki.gentoo.org/wiki/RSBAC/Overview
wiki.gentoo.org
https://wiki.gentoo.org/wiki/RSBAC/Quickstart
wiki.gentoo.org
https://www.rsbac.org/doc/media/lm-rsbac1-english.pdf
rsbac.org
https://www.rsbac.org/
rsbac.org
https://www.rsbac.org/why
rsbac.org
https://grsecurity.net/featureset/rbac
grsecurity.net
http://secgroup.ext.dsi.unive.it/wp-content/uploads/2012/04/PID2308633-camera.pdf
secgroup.ext.dsi.unive.it
https://illumos.org/man/1/roles
illumos.org
https://www.unix.com/man-page/freebsd/5/rbac/
unix.com
https://en.wikipedia.org/wiki/SmartOS
en.wikipedia.org
https://docs.tritondatacenter.com/public-cloud/instances/infrastructure/managing/rbac
docs.tritondatacenter.com
https://docs.tritondatacenter.com/public-cloud/instances/infrastructure/managing/rbac/working-with-profile-shells
docs.tritondatacenter.com
https://opensource.com/business/13/11/selinux-policy-guide
opensource.com
https://github.com/SELinuxProject/selinux-notebook/
github.com
https://www.illumos.org/man/7/privileges
illumos.org
https://man.omnios.org/privileges.7
man.omnios.org
https://sites.google.com/site/fullycapable/Home
sites.google.com
https://stackoverflow.com/questions/36755412/how-do-i-use-the-pam-capabilities-module-to-grant-capabilities-to-a-particular-u
stackoverflow.com
http://www.trustedbsd.org/cap.html
trustedbsd.org
https://kmaiti.blogspot.com/2011/09/acl-and-mask-in-linux.html
kmaiti.blogspot.com
https://groups.google.com/forum/
groups.google.com
https://unix.stackexchange.com/questions/102075/why-are-666-the-default-file-creation-permissions
unix.stackexchange.com
https://askubuntu.com/questions/429848/dmask-and-fmask-mount-options
askubuntu.com
https://sel4.systems/
sel4.systems
https://web.archive.org/web/20070621155813/http://jya.com/paperF1.htm
web.archive.org
https://allthatiswrong.wordpress.com/2010/01/20/the-insecurity-of-openbsd/
allthatiswrong.wordpress.com
https://man.openbsd.org/access.2
man.openbsd.org
https://cacm.acm.org/magazines/2012/3/146252-a-taste-of-capsicum/fulltext
cacm.acm.org
https://github.com/google/capsicum-linux
github.com
https://github.com/unrelentingtech/capsicumizer
github.com
https://www.man7.org/linux/man-pages/man1/chcon.1.html
man7.org
https://web.archive.org/web/20170315162651/https://learntemail.sam.today/blog/selinux-concepts-but-for-humans/
web.archive.org
http://www.trustedbsd.org/sebsd.html
trustedbsd.org
http://www.trustedbsd.org/sebsd-july2003.pdf
trustedbsd.org
https://www.gentoo.org/proj/en/hardened/selinux/
gentoo.org
https://wiki.gentoo.org/wiki/SELinux
wiki.gentoo.org
https://wiki.gentoo.org/wiki/SELinux/Constraints
wiki.gentoo.org
https://fedoraproject.org/wiki/SELinux/Commands
fedoraproject.org
https://medium.com/information-and-technology/so-what-is-apparmor-64d7ae211ed
medium.com
https://www.apparmor.net/
apparmor.net
https://en.wikipedia.org/wiki/FLASK
en.wikipedia.org
https://www.cs.utah.edu/flux/papers/flask-usenixsec99.pdf
cs.utah.edu
https://www.kernel.org/doc/html/v4.14/admin-guide/LSM/Smack.html
kernel.org
http://tomoyo.osdn.jp/
tomoyo.osdn.jp
https://gitlab.com/apparmor/apparmor/wikis/home/
gitlab.com
https://manpages.ubuntu.com/manpages/jammy/en/man8/aa-status.8.html
manpages.ubuntu.com
https://illumos.org/man/7/privileges
illumos.org
https://en.wikipedia.org/wiki/Setuid
en.wikipedia.org
https://man7.org/linux/man-pages/man2/setgid.2.html
man7.org
https://www.golinuxcloud.com/restrict-root-directory-extended-attributes/
golinuxcloud.com
https://www.unix.com/man-page/freebsd/1/chflags/
unix.com
https://blog.ononoki.org/chattr-and-lsattr-usage/
blog.ononoki.org
https://www.linuxintheshell.com/2013/04/23/episode-028-extended-attributes-lsattr-and-chattr/
linuxintheshell.com
https://en.wikipedia.org/wiki/Chattr
en.wikipedia.org
https://en.wikipedia.org/wiki/E2fsprogs
en.wikipedia.org
https://www.oreilly.com/library/view/selinux/0596007167/ch01s04.html
oreilly.com
https://archive.ph/20130414162939/http://www.eros-os.org/pipermail/cap-talk/2003-March/001133.html
archive.ph
https://www.alanhkarp.com/Capabilities-101.html
alanhkarp.com
https://www.dropbox.com/s/g1gpwz2vbas2zdb/Capabilities-101.pdf?dl=0
dropbox.com
http://www.erights.org/talks/asian03/
erights.org
http://www.erights.org/talks/thesis/markm-thesis.pdf
erights.org
https://srl.cs.jhu.edu/pubs/SRL2003-02.pdf
srl.cs.jhu.edu
http://www.cap-lore.com/CapTheory/ConfusedDeputy.html
cap-lore.com
http://www.cap-lore.com/CapTheory/ConfusedDeputyM.html
cap-lore.com
http://www.cap-lore.com/CapTheory/index.html
cap-lore.com
http://www.cap-lore.com/CapTheory/What.html
cap-lore.com
http://habitatchronicles.com/2017/05/what-are-capabilities/
habitatchronicles.com
http://www.cap-lore.com/CapTheory/KK/OperatingSystems.html
cap-lore.com
http://www.cap-lore.com/CapTheory/Truck.html
cap-lore.com
https://linux.die.net/man/1/setfacl
linux.die.net
https://docs.freebsd.org/en/books/handbook/mac/
docs.freebsd.org
http://www.trustedbsd.org/privileges.html
trustedbsd.org
https://man7.org/linux/man-pages/man7/capabilities.7.html
man7.org
https://k3a.me/linux-capabilities-in-a-nutshell/
k3a.me
https://github.com/containers/udica
github.com
https://wiki.c2.com/?PosixCapabilities
wiki.c2.com
https://www.redhat.com/sysadmin/apparmor-selinux-isolation
redhat.com
https://lwn.net/Articles/635771/
lwn.net
https://networksynapse.net/freebsd/mandatory-access-control-mac-part-1-bsd-extended-tutorial/
networksynapse.net
https://networksynapse.net/freebsd/trustedbsd-mac-processes/
networksynapse.net
https://networksynapse.net/freebsd/trustedbsd-mandatory-access-control-part-3-policy-mac-biba/
networksynapse.net
https://csrc.nist.gov/projects/role-based-access-control
csrc.nist.gov
https://en.wikipedia.org/wiki/RBAC
en.wikipedia.org
https://www.omarine.org/blog/apparmor-vs-selinux/
omarine.org
https://help.ubuntu.com/community/AppArmor
help.ubuntu.com
https://docs.kernel.org/security/lsm.html
docs.kernel.org
https://www.cyberciti.biz/tips/selinux-vs-apparmor-vs-grsecurity.html
cyberciti.biz
https://unix.stackexchange.com/questions/411853/core-difference-between-selinux-and-apparmor
unix.stackexchange.com
http://www.hep.by/gnu/kernel/lsm/
hep.by
https://www.cs.utah.edu/flux/fluke/html/flask.html
cs.utah.edu
http://www.cs.columbia.edu/~lierranli/coms6998-7Spring2014/papers/SEAndroid-NDSS2013.pdf
cs.columbia.edu
https://borretti.me/article/introducing-austral
borretti.me
What is a Capability? Read at the source ↗
blog.sunfishcode.online
https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-947.pdf
cl.cam.ac.uk
https://github.com/NuxiNL/cloudabi
github.com
https://lwn.net/Articles/796328/
lwn.net
https://www.ibm.com/docs/en/zos-basic-skills?topic=zos-security-unix
ibm.com
https://www.ibm.com/docs/en/zos-basic-skills?topic=zos-security-facilities
ibm.com
https://sansorg.egnyte.com/dl/GBObLgJl6E
sansorg.egnyte.com
https://www.linkedin.com/pulse/what-does-security-mean-3-your-linux-kernel-roland-gharfine/
linkedin.com
https://davmac.wordpress.com/2016/10/14/cgroups-v2-resource-management-done-even-worse-the-second-time-around/
davmac.wordpress.com
https://labs.withsecure.com/blog/abusing-the-access-to-mount-namespaces-through-procpidroot/
labs.withsecure.com
https://www.openbsd.org/faq/faq16.html
openbsd.org
https://justine.lol/make/
justine.lol
https://infosecadalid.com/2021/08/19/introduction-to-landlock/
infosecadalid.com
https://landlock.io/
landlock.io
https://docs.kernel.org/userspace-api/landlock.html
docs.kernel.org
https://docs.kernel.org/security/landlock.html
docs.kernel.org
https://utcc.utoronto.ca/~cks/space/blog/unix/ChrootHistory
utcc.utoronto.ca
https://lwn.net/Articles/252794/
lwn.net
https://github.com/google/minijail
github.com
https://www.linux.com/news/minijail-googles-tool-safely-run-untrusted-programs
linux.com
https://www.packt.com/securing-network-services-freebsd-jails/
packt.com
https://web.archive.org/web/20060504192215/http://rentzsch.com/notes/virtualizationAsAnAntivirus
web.archive.org
https://linux.die.net/man/2/personality
linux.die.net
https://linux.die.net/man/8/setarch
linux.die.net
https://linux.die.net/man/1/dchroot
linux.die.net
https://linux.die.net/man/1/schroot
linux.die.net
https://www.ctrl.blog/entry/systemd-service-hardening.html
ctrl.blog
https://ruderich.org/simon/notes/systemd-service-hardening
ruderich.org
https://man.openbsd.org/OpenBSD-5.9/systrace
man.openbsd.org
https://en.wikipedia.org/wiki/Systrace
en.wikipedia.org
https://www.linux.com/news/add-extra-layer-security-systrace/
linux.com
https://fremissant.net/pledge/current/pledge.1.html
fremissant.net
https://isopenbsdsecu.re/mitigations/pledge/
isopenbsdsecu.re
https://isopenbsdsecu.re/mitigations/unveil/
isopenbsdsecu.re
https://isopenbsdsecu.re/mitigations/
isopenbsdsecu.re
https://www.openbsd.org/papers/bsdcan2019-unveil/mgp00001.html
openbsd.org
https://sandstorm.io/how-it-works
sandstorm.io
https://wiki.archlinux.org/title/Systemd-nspawn
wiki.archlinux.org
https://vermaden.wordpress.com/2021/12/15/secure-containerized-browser/
vermaden.wordpress.com
https://man7.org/linux/man-pages/man7/namespaces.7.html
man7.org
https://blog.quarkslab.com/digging-into-linux-namespaces-part-1.html
blog.quarkslab.com
https://blog.quarkslab.com/digging-into-linux-namespaces-part-2.html
blog.quarkslab.com
https://blogs.gnome.org/alexl/2017/01/18/the-flatpak-security-model-part-1-the-basics/
blogs.gnome.org
https://code.google.com/archive/p/seccompsandbox/wikis/overview.wiki
code.google.com
https://www.slideshare.net/GiovanniBechis/linux-seccomp2-vs-openbsd-pledge1
slideshare.net
https://android-developers.googleblog.com/2017/07/seccomp-filter-in-android-o.html
android-developers.googleblog.com
https://lwn.net/Articles/656307/
lwn.net
https://github.com/projectatomic/bubblewrap
github.com
https://wiki.archlinux.org/title/Bubblewrap
wiki.archlinux.org
https://www.chromium.org/chromium-os/developer-guide/chromium-os-sandboxing/
chromium.org
https://chromium.googlesource.com/chromiumos/docs/+/HEAD/sandboxing.md
chromium.googlesource.com
https://nixdoc.net/man-pages/FreeBSD/man1/limits.1.html
nixdoc.net
https://www.unix.com/man-page/freebsd/3/sysctl/
unix.com
Controlling Resource Limits with rctl in FreeBSD
klarasystems.com
https://people.freebsd.org/~blackend/doc/el/books/handbook/quotas.html
people.freebsd.org
https://wiki.debian.org/Schroot
wiki.debian.org
https://wiki.archlinux.org/title/Chroot
wiki.archlinux.org
https://manpages.ubuntu.com/manpages/xenial/man1/chrootuid.1.html
manpages.ubuntu.com
https://tbhaxor.com/pivot-root-vs-chroot-for-containers/
tbhaxor.com
https://www.informit.com/articles/article.aspx?p=363731
informit.com
https://tbhaxor.com/docker-resource-management-in-detail/
tbhaxor.com
https://manpages.ubuntu.com/manpages/bionic/man1/lscgroup.1.html
manpages.ubuntu.com
Linux Namespaces Are a Poor Man's Plan 9 Namespaces Read at the source ↗
yotam.net
https://tbhaxor.com/basics-of-seccomp-for-dockers/
tbhaxor.com
https://ajxchapman.github.io/linux/2016/08/31/seccomp-and-seccomp-bpf.html
ajxchapman.github.io
https://lwn.net/Articles/857228/
lwn.net
https://podman.io/blogs/2019/10/15/generate-seccomp-profiles.html
podman.io
Seccomp made easy Read at the source ↗
scrivano.org
https://dlc.openindiana.org/docs/20090715/SYSADRM/html/rmpool-114.html
dlc.openindiana.org
https://www.thegeekdiary.com/solaris-resource-manager-basics-understanding-resource-pools/
thegeekdiary.com
http://www.petertribble.co.uk/Solaris/pools.html
petertribble.co.uk
https://illumos.org/man/8/pooladm
illumos.org
https://docs.huihoo.com/opensolaris/solaris-containers-resource-management-and-solaris-zones/html/p37.html
docs.huihoo.com
https://www.unix.com/solaris/38152-project-vs-pool-vs-use.html
unix.com
https://dlc.openindiana.org/docs/20090715/SYSADRM/html/gentextid-6182.html
dlc.openindiana.org
https://illumos.org/man/8/poolbind
illumos.org
https://illumos.org/man/1/projects
illumos.org
https://illumos.org/man/1/prctl
illumos.org
https://illumos.org/man/5/project
illumos.org
https://illumos.org/man/8/projadd
illumos.org
https://illumos.org/man/8/projmod
illumos.org
https://illumos.org/man/8/rctladm
illumos.org
https://illumos.org/man/2/setrctl
illumos.org
https://illumos.org/man/1/newtask
illumos.org
http://www.petertribble.co.uk/Solaris/minizone.html
petertribble.co.uk
https://dlc.openindiana.org/docs/20090715/SYSADRM/html/zones.intro-1.html
dlc.openindiana.org
https://illumos.org/man/7/zones
illumos.org
http://docs.openindiana.org/handbook/systems-administration/
docs.openindiana.org
https://illumos.org/man/1/zlogin
illumos.org
https://illumos.org/man/1/zonename
illumos.org
https://illumos.org/man/8/zonecfg
illumos.org
https://illumos.org/man/8/zoneadm
illumos.org
https://github.com/Ozymandias42/macOS-Sandbox-Profiles
github.com
Apple Sandbox Guide v1.0 Read at the source ↗
reverse.put.as
https://jmmv.dev/2019/11/macos-sandbox-exec.html
jmmv.dev
https://apple.stackexchange.com/questions/258318/is-there-a-sandboxing-program-like-sandboxie-for-mac
apple.stackexchange.com
macOS: How to run your Applications in a Mac OS X sandbox to enhance security Read at the source ↗
paolozaino.wordpress.com
https://www.unix.com/man-page/osx/1/sandbox-exec/
unix.com
https://www.unix.com/man-page/osx/7/sandbox/
unix.com
https://www.romab.com/ironsuite/SBPL.html
romab.com
https://papers.put.as/papers/macosx/2016/D1-JonathanLevin-TheAppleSandbox-DeeperintotheQuagmire.pdf
papers.put.as
https://source.android.com/docs/security/app-sandbox
source.android.com
https://rlxos.dev
rlxos.dev
http://www.citi.umich.edu/u/provos/ssh/privsep.html
citi.umich.edu
https://sha256.net/privsep.html
sha256.net
https://medium.com/@jan.schreib/introduction-into-privilege-dropping-in-c-b0dca6f47b82
medium.com
https://github.com/BastilleBSD/bastille
github.com
https://bastille.readthedocs.io/en/latest/
bastille.readthedocs.io
https://medium.com/@tdebarbora/freebsd-managing-jails-with-ezjail-b2b1b9e1bd7a
medium.com
https://github.com/iocage/iocage
github.com
https://github.com/bsdpot/pot
github.com
https://github.com/cbsd/cbsd
github.com
https://forum.snapcraft.io/t/xdg-permissions-stores-should-be-configurable-with-snapd/25048/4
forum.snapcraft.io
https://flatpak.github.io/xdg-desktop-portal/portal-docs.html
flatpak.github.io
https://blog.siphos.be/2014/06/d-bus-quick-recap/
blog.siphos.be
https://blog.siphos.be/2014/06/d-bus-and-selinux/
blog.siphos.be
https://www.openbsd.org/papers/dot2016.pdf
openbsd.org
https://itsfoss.com/flatseal/
itsfoss.com
https://support.apple.com/en-lb/guide/security/secabd3504cd/web
support.apple.com
Why polkit (or, how to mount a disk on modern Linux) Read at the source ↗
collabora.com
https://docs.oracle.com/cd/E19455-01/806-1789/index.html
docs.oracle.com
https://docs.oracle.com/cd/E19455-01/806-1789/6jb25l4a2/index.html
docs.oracle.com
https://github.com/openbsm/openbsm
github.com
http://www.trustedbsd.org/openbsm.html
trustedbsd.org
https://www.linux.com/topic/desktop/linux-system-monitoring-and-more-auditd/
linux.com
What You Need to Know About Linux Audit Framework Read at the source ↗
goteleport.com
https://docs.freebsd.org/en/books/handbook/audit/
docs.freebsd.org
https://en.wikipedia.org/wiki/Utmp
en.wikipedia.org
http://www.openbsm.org/
openbsm.org
https://www.illumos.org/man/2/audit
illumos.org
https://www.illumos.org/man/8/praudit
illumos.org
https://www.illumos.org/man/8/audit
illumos.org
https://www.illumos.org/man/8/auditd
illumos.org
https://www.illumos.org/man/5/audit.log
illumos.org
https://www.illumos.org/man/8/auditconfig
illumos.org
https://www.threatmodelingmanifesto.org
threatmodelingmanifesto.org
https://elisa.tech/
elisa.tech
https://www.open-scap.org/
open-scap.org
https://mjg59.dreamwidth.org/64311.html
mjg59.dreamwidth.org
https://mjg59.dreamwidth.org/64968.html
mjg59.dreamwidth.org
https://mjg59.dreamwidth.org/63261.html
mjg59.dreamwidth.org
https://ericchiang.github.io/post/tpm-keys/
ericchiang.github.io
https://security.stackexchange.com/questions/109442/what-is-the-difference-between-a-hids-hips-and-an-anti-virus
security.stackexchange.com
https://sourceforge.net/projects/trustedgrub/
sourceforge.net
https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/
cl.cam.ac.uk
https://arxiv.org/abs/2302.13863
arxiv.org
https://github.com/microsoft/verona
github.com
http://wiki.netbsd.org/security/
wiki.netbsd.org
https://github.com/a13xp0p0v/linux-kernel-defence-map
github.com
https://docs.freebsd.org/en/books/handbook/firewalls/
docs.freebsd.org
https://www.openbsd.org/faq/pf/
openbsd.org
https://wiki.archlinux.org/title/nftables
wiki.archlinux.org
https://wiki.archlinux.org/title/Iptables
wiki.archlinux.org
https://wiki.archlinux.org/title/Firewalld
wiki.archlinux.org
https://sollove.com/2013/03/03/my-first-5-minutes-on-a-server-or-essential-security-for-linux-servers/
sollove.com
https://lkrg.org/
lkrg.org
http://pax.grsecurity.net/docs/pax.txt
pax.grsecurity.net
http://www.research.ibm.com/trl/projects/security/ssp
research.ibm.com
https://threat-modeling.com/pasta-threat-modeling/
threat-modeling.com
https://www.octotrike.org/
octotrike.org
Elsewhere on venam.net (4)