Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like the user to specify a list of commands for gathering statistics about the system that he/she is interested in. I would run these under various scenarios automatically. However I'm not quite sure how to sandbox the commands safely.

One option would be to carry a whitelist of allowed commands, but it would need to be maintained. I'd like to be really flexible such as, is it possible to run an arbitrary command in Linux with read only file permissions?

What are your ideas?

share|improve this question
    
You could have a user who owns no files and can't sudo, I suppose –  Phoshi Jun 29 '10 at 20:28
add comment

2 Answers

up vote 3 down vote accepted

Under Gentoo there is the sandbox tool that allows running programs in a sandbox with only read access to the outside. I built it successfully under Ubuntu, too. The sources can be downloaded here.

share|improve this answer
    
This looks very useful. Now if only they had some documentation. –  kalaxy Jul 12 '10 at 14:55
    
@kalaxy: sandbox is used in Gentoo to safely run make install when building packages, so a lot of the documentation you'll find will be on that. This bugday.gentoo.org/sandbox.html seems useful. Tweaking more (e.g. adding selective r+w support devmanual.gentoo.org/function-reference/sandbox-functions/…) would require you to install additional Gentoo software from portage, e.g. ebuild.sh and deps from sources.gentoo.org/cgi-bin/viewvc.cgi/portage/main/branches/… –  Benjamin Bannier Jul 13 '10 at 10:48
add comment

SELinux will allow you to do this. You can either put the executables into a restricted domain, or you can create a new role with limited permissions.

share|improve this answer
    
This is exactly what I'm looking for, unfortunately we aren't running SELinux. –  kalaxy Jul 12 '10 at 14:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.