0

Is there a way to restrict the application access to the system time in linux?

I want to make the application launch as much as possible abstracted from the environment. If you can restrict access to devices/file system with permissions, it's not clear how to restrict access to the system clock, because this is not a standart system device.

Tolsi
  • 119
  • 3

1 Answers1

5

If you want to deny access to the system time, you’d pretty much have to write a system call filter; nowadays that would be a seccomp filter. See Kees Cook’s simple tutorial, or for more complex requirements, libseccomp. You’d need to deny access to gettimeofday, clock_gettime, and time, at least; the details depend on whether you’re trying to deal with an adversarial application (where you might also want to deny access to exec, system etc. to prevent an application from running external applications — although seccomp filters are inherited so that might not matter —, and deny access to external, direct or indirect time sources such as the network or even file systems).

If you want to give the application an artificial time, look at faketime and libfaketime.

Stephen Kitt
  • 411,918
  • 54
  • 1,065
  • 1,164
  • I think seccomp restrictions are inherited, so `exec()` is not a big problem. – sourcejedi Aug 30 '18 at 12:17
  • Trying to isolate from filesystem timestamps sounds like a challenge though. (`touch /tmp/t; ls -l /tmp/t`) – sourcejedi Aug 30 '18 at 12:19
  • 1
    @sourcejedi yes, “If fork/clone and execve are allowed by prog, any child processes will be constrained to the same filters and system call ABI as the parent.”, I was thinking more with a general sandboxing hat on. Good point about the file system :-/. – Stephen Kitt Aug 30 '18 at 12:21