BritishTeapot 57091bf0ce Made create to grant permissions automatically.
Creating files grants permanent permissions to them now. This makes
sense because if a program creates a new file, then it clearly can't
steal any data. This is particularly useful for programs which open an
obscene amount of auxilary files (e.g. neovim with a huge amount of
plugins).
2025-03-30 19:48:11 +02:00
2024-11-13 16:27:09 +01:00
2025-03-10 17:53:47 +01:00
2025-03-30 19:06:57 +02:00

ICFS -- Interactively Controlled File System

Motivation

Traditional access control mechanisms in operating systems allow the same level of access to all processes running on behalf of the same user. This typically enables malicious processes to read and/or modify all data accessible to the user running a vulnerable application. It can be dealt using various mandatory access control mechanisms, but these are often complicated to configure and are rarely used in common user oriented scenarios. This thesis focuses on design and implementation of a file system layer which delegates the decision to allow or deny access to a file system object by a specific process to the user.

Goals

  • Analyze the problem and design a solution
  • Implement the solution using the FUSE framework
  • Test the solution and demonstrate its benefits

Building

  • Install dependencies
    • libfuse3
      • Debian: sudo apt install fuse3 libfuse3-dev
    • zenity
      • Debian: sudo apt install zenity
    • Build tools
      • Debian: sudo apt install gcc make pkg-config
  • Build using make:
    • In the project directory: make
    • Use make DEBUG=1 for testing.
  • Resulting binaries should appear in the build directory.

Usage

icfs <FUSE arguments> [target directory]

The filesystem will be mounted over the target directory, and ask user permission every time a file in that directory is opened.

Docs

Credit

Student: Fedir Kovalov

Supervisor: RNDr. Jaroslav Janáček, PhD.

Description
Filesystem with Interactive Access Control for Linux
Readme GPL-2.0 780 KiB
Languages
C 96.7%
Shell 2%
Makefile 1.3%